Tag Archives: security

Posted on

Apple Upgrades iOS Security

With the release of iOS 7, part of the upgrade includes new features built into Find My iPhone that make it harder for anyone else to use or sell your device if it is ever lost or stolen.

With Find My iPhone turned on in iOS 7, your Apple ID and password will always be required before anyone can:

  • Turn off Find My iPhone on your device.
  • Erase your device.
  • Reactivate and use your device.

There is nothing you need to do except to make sure that you turn on Find My iPhone and remember your Apple ID and password. For more information, read the FAQ.

If you plan to give your device to someone else, make sure to erase all content and settings before transferring it to the new owner. This will remove the device from your account and allow the new owner to activate it.

This is a great safety feature for those of you who use iPhones. It adds another layer of protection if you have any private client information stored on your device.

Posted on

Internet Explorer XP Security Hole – The Biggest Problem is Not What You Think

Editor’s Note: This is a version of my article that was published on LinkedIn last week. I decided the information was important enough to include in this post. Even if you have already upgraded your systems and are no longer using Windows XP, you will want to pay attention to the Internet Explorer vulnerability and take steps to protect your organization.

An insurance agent approached me just last week during a break at a seminar I was teaching to ask: “Does my five-person office really need to change to a new operating system when Windows XP is working just fine?” I suspect there are a lot of businesses – especially small and medium-size – asking the same question.

In truth, nothing will immediately change. No features will be disabled, you will not be forced to upgrade, and even technical support will still be relatively easy to come across. Literally millions of articles have been published about Windows XP, and they won’t disappear overnight.

But – and it’s a big but – the biggest problem your organization faces is the financial ruin you will suffer when you have a data breach because you have allowed personal and private client information stored on your systems to be exposed. Federal and state data breach laws will come down on you hard. And you will have no excuse or defense.

Posted on

Small Business Owners Dismiss Risk of Data Breach

As the number of data breaches involving smaller businesses continues to grow, a new survey by The Hartford finds 85% of small business owners believe a data breach is unlikely, and many are not implementing simple security measures to help protect their customer or employee data.

data breach

“Most of the business owners surveyed believe they are not at risk, when in fact smaller businesses are increasingly being targeted,” said Lynn LaGram, assistant vice president of small commercial underwriting at The Hartford. “As cyber criminals set their sights on smaller firms, it is important for business owners to take proactive measures to protect data and minimize the likelihood of a breach.”

The Hartford Small Business Data Protection Survey found that business owners varied in their adoption of eight data protection “best practices” to help reduce a business’s risk of a breach:

  • Lock and secure sensitive customer, patient or employee data—48%
  • Restrict employee access to sensitive data—79%
  • Shred and securely dispose of customer, patient or employee data—53%
  • Use password protection and data encryption—48%
  • Have a privacy policy—44%
  • Update systems and software on a regular basis—47%
  • Use firewalls to control access and lock-out hackers—48%
  • Ensure that remote access to their company’s network is secure—41%

The Hartford survey also found that nearly two-thirds of business owners believe a data breach violates trust and would jeopardize their relationships with customers, patients, and employees. More than a third say they have a more negative opinion of companies that have recently experienced a breach, based on the companies’ handling of the breach.

About a third of business owners say they would have difficulty complying with government notification requirements, and nearly half acknowledge it would be impossible for a small business to completely safeguard customer, patient or employee data.

“Given the potential business and reputational costs of a data breach, it’s also important for business owners to have insurance in place to help them respond and recover quickly and effectively in the event of a breach,” said LaGram.

The Hartford Small Business Data Protection Survey of 501 U.S. small business owners with fewer than 50 employees was developed by The Hartford and fielded by the Pert Group in January 2012. Margin of error is +/- 4%.

Posted on

Microsoft: Frequent Password Resets are a Waste of Time

In a recent research paper, Microsoft principal researcher Cormac Herley asserted that security measures that are being recommended are a waste of time. He argues that security protocols that attempt to protect an individual or organization from the consequences of a security breach often exact a much steeper price—in the form of user effort and time expended.

While everyone knows that “123456” is not a good choice for a password, is it worth the effort to force users to change their passwords? “Most security advice simply offers a poor cost benefit tradeoff to users and is rejected,” said Herley. Following certain password rules “shields [users] from the direct costs of attacks, but burdens them with far greater indirect costs in the form of effort.” Herley contends that users who ignore security advice aren’t lazy or stupid; rather they’re acting rationally. Required security activities are complex, and the benefits are “largely speculative or moot.”

He particularly slams the common requirement that users change passwords at specified intervals. A hacker who steals your password is going to use it right away; he won’t wait two months. “Insisting that users choose a unique strong password for each [[account]] which they change often and never write down is clearly a large burden.

The study also says that teaching users to recognize phishing URLs is a losing proposition, not worth the time spent. Herley calculates that a task requiring one minute per day from every working adult in the United States costs about $15.9 billion per year. Unnecessary security advice “treats as free a resource that is actually worth $2.6 billion an hour.”

While he might have a point, don’t go changing all your passwords to “123456” just yet. Using different passwords for different accounts and Web sites really is beneficial, as is using complex, non-guessable passwords. You can cut down on the time and effort required by using a password manager and letting it generate strong passwords for you.

Posted on

The Problem with Passwords

Last December, someone hacked into the Web site RockYou.com, and exposed a list of usernames and passwords on the Web, in plain text. A month later, security analysis firm Imperva analyzed the most common passwords. The results are eye-opening and should serve as a reminder to you and your staff about the importance of creating and using good passwords.

By far, the most popular password on RockYou.com was “123456,” which satisfies the minimum character limit for the site’s password restrictions, but does little for security. A full 290,731 users had this password, far more than the runner-up, 12345, which had 79,078 users.

Of the list of compromised passwords, other usual suspects surfaced: Password; the site’s name, or rockyou; abc123; and first names, such as Ashley and Daniel. Imperva published a list of the most popular passwords, all of which are extremely weak from a security standpoint.

For years, security experts have argued that users need to use more complex passwords, especially as the computing power and algorithms behind brute-force password crackers become ever more sophisticated. But 30% of the RockYou users picked a password less than six characters in length, and 40% used only lowercase letters.