Category Archives: mobile os

Top 16 Ways SMBs Can Mitigate Cyber Risks and Threats.

Fig. 1. Stock Cyber Brain Graphic, 2022.
  1. Sign up for DHS CISA e-mail alerts specific to your company and industry needs and review the alerts:
    1. Sign up here.
    2. Use the free DHS developed CSET (Cybersecurity Evaluation Tool) to assess your security posture – High, Med, or Low. CSET is downloadable here.
  2. Educate Employees About Cyber Threats and Hold Them Accountable:
    1. Educate your employees about online threats and how to protect your business’s data, including safe use of social networking sites. Depending on the nature of your business, employees might be introducing competitors to sensitive details about your firm’s internal business.
    2. Employees should be informed about how to post online in a way that does not reveal any trade secrets to the public or competing businesses. 
    3. Use games with training and hold everyone accountable to security policies and procedures.
    4. This needs to be embedded in the culture of your company.
    5. Register for free DHS cyber training here.
    6. Use the free DHS SMB cyber resource toolkit.
  3. Protect Against Viruses, Spyware, and Other Malicious Code:
    1. Make sure each of your business’s computers are equipped with antivirus software and antispyware and updated regularly. Such software is readily available online from a variety of vendors. All software vendors regularly provide patches and updates to their products to correct security problems and improve functionality. Configure all software to install updates automatically. Especially watch freeware which contains malvertising.
  4. Secure Your Networks:
    1. Safeguard your Internet connection by using a firewall and encrypting information. If you have a Wi-Fi network, make sure it is secure and hidden. To hide your Wi-Fi network, set up your wireless access point or router so it does not broadcast the network name, known as the Service Set Identifier (SSID).
    2. Have a secure strong password to protect access to the router (xeeityyg18695845%&*&RELxu78IGO) — example.
    3. Lastly, use a VPN (virtual private network).
  5. Control Physical Access to Computers and Network Components:
    1. Prevent access or use of business computers by unauthorized individuals. Laptops can be particularly easy targets for theft or can be lost, so lock them up when unattended. Make sure a separate user account is created for each employee and require strong passwords.
    2. Administrative privileges should only be given to trusted IT staff and key personnel.
  6. Create A Mobile Device Protection Plan:
    1. Require users to password-protect their devices, encrypt their data, and install security apps to prevent criminals from stealing information while the phone is on public networks.
    2. Use a containerization application to separate personal data from company data.
    3. Be sure to set reporting procedures for lost or stolen equipment.
  7. Protect All Pages on Your Public-Facing Webpages, Not Just the Checkout and Sign-Up Pages:
    1. Make sure submission forms can block spam and can block code execution (cross-side scripting attacks).
  8. Establish Security Practices and Policies to Protect Sensitive Information:
    1. Establish policies on how employees should handle and protect personally identifiable information and other sensitive data. Clearly outline the consequences of violating your business’s cybersecurity policies and who is accountable.
  9. Base Your Security Strategy Significantly on the NIST Cybersecurity Framework 1.1: Identify, Detect Defend, Respond, and Recover:
    1. The NIST Cybersecurity Framework Small Business Resources are linked here.
No alt text provided for this image
Fig. 2. NIST Cyber Security Framework Sub Tasks, NIST, 2022:
  1. Require Employees to Use Strong Passwords and to Change Them Often:
    1. Consider implementing multifactor authentication that requires additional information beyond a password to gain entry. Check with your vendors that handle sensitive data, especially financial institutions, to see if they offer multifactor authentication for your account. Smart card plus passcode for example.
  2. Employ Best Practices on Payment Cards:
    1. Work with your banks or card processors to ensure the most trusted and validated tools and anti-fraud services are being used. You may also have additional security obligations related to agreements with your bank or processor. Isolate payment systems from other, less secure programs and do not use the same computer to process payments and surf the Internet. 
    2. Outsource some or all of it and know where your risk responsibility ends.
  3. Make Backup Copies of Important Business Data and Use Encryption When Possible:
    1. Regularly backup the data on all computers. Critical data includes word processing documents, electronic spreadsheets, databases, financial files, human resources files, and accounts receivable/payable files. Backup data automatically if possible, or at least weekly, and store the copies either offsite or on the cloud. 
    2. Having all key files backed up via the 3-2-1 rule — three copies of files in two different media forms with one offsite — thus reducing ransomware attack damage.
  4.  Make Sure Your Vendors Have the Required Security Compliance Attestations and Insurance:
    1. SOC 2, PCI, and HIPAA for example.
    2. Cyber/data breach insurance should be separate from general business liability, and you should know the exclusions and sub-limits.
  5. Use A Password Management Tool and Strong Passwords:
    1. Another way to stay safe is by setting passwords that are longer, complex, and thus hard to guess. Additionally, they can be stored and encrypted for safekeeping using a well-regarded password vault and management tool. This tool can also help you to set strong passwords and can auto-fill them with each login — if you select that option. Yet using just the password vaulting tool is all that is recommended. Doing these two things makes it difficult for hackers to steal passwords or access your accounts.
  6. Use Only Whitelisted Sites Not Blacklisted Ones or Ones Found Via the Dark Web:
    1. Use only approved whitelisted platforms and sites that do not expose you to data leakages or intrusion on your privacy. Whitelisting is the practice of explicitly allowing some identified websites access to a particular privilege, service, or access. Backlisting is blocking certain sites or privileges. If a site does not assure your privacy, do not even sign up let alone participate.
  7. Mimic Your Likely Threats with a Threat Modeling Methodology that works for your Industry:
    1. PASTA, VAST, and FAIR are just a few.

Three Points on Artificial Intelligence and Cyber-Security for 2017

icit-new-logo-for-website5
Although I have been known for longer posts, I would like to offer only three things to watch out for related to artificial intelligence and cyber-security for 2017, followed by sharing two videos.

1) Cyber attackers have long used machine learning and automation techniques to streamline their operations and may soon use full-blown artificial intelligence to do it. Botnets will become self-healing and will be able to detect when they are being discovered and can re-route in response. The botnet and cyber crime business will grow and become more organized. Showdan, the world’s first search engine for internet connected devices, will be used to target companies and individuals negatively. Yet it can also be used for safety and compliance monitoring, most likely when its feed into another analytical tool.

How to Hack with Showdan (For Educational Purposes Only):

2) It won’t be long until A.I. learns the patterns of mutating viruses and then has the ability to predict and/or stop them in their tracks. This is dependent on the most up to date virus definitions, and corresponding algorithms. How a Zero Day is made is heavily a math problem applied to a certain context and operating system. There should be a math formula to predict the next most likely Zero Day exploit – A.I. could provide this. It’s a matter of calculating all possible code various and code add on variations. It’s a lot more advanced than a Rubix Cube.
975f495fafd8c494591892412ecf87e33) A.I. has the potential to close the gap between the lesser developed world and the developed world. The technology behind A.I. is not limited to big companies like IBM or Microsoft for the long term. We may be surprised with tech start-ups out of the lesser developed world who are very creative. Lack of fiber optic cable connectivity has forced many lesser developed nations to rely heavily on cell tower smartphone based internet communications. This has inspired a mobile app growth wave in parts of Africa as described here; “the use of smartphones and tablets within the country has led to a mobile revolution in Nigeria. Essentially, people now tend to seek mobile solutions more often and thus, enhance the growth of the mobile app development industry” (Top 4 Mobile App development companies in Nigeria, IT News Africa, 2015). A.I. will likely close the gap between these two sectors though not drastically change it. If lesser developed countries can build their own mobile apps and outsource things to A.I.; they could become more independent from the economic constraints of the developed world.

The below video highlights some of the complications around these points. It is from a conference hosted by the ICIT on April 25, 2016, and I did not attend this. In the video, Donna Dodson (Associate Director, Chief Cybersecurity Advisor and Director, NIST), Mark Kneidinger (Director, Federal Network Resiliency, DHS), Malcolm Harkins (ICIT Fellow – Cylance) and Stan Wisseman (ICIT Fellow – HPE) discuss related concepts and share realistic examples of how these technologies are reshaping the cyber-security landscape.

ICIT Forum 2016: Artificial Intelligence Enabling Next-Generation Cybersecurity

If you want to contact me to discuss these concepts click here.

Windows 10 Review: Mobile $ Centric, Cloud Informed, Touch Winner!

Ever since Google’s Android and Apple’s iOS have dominated the mobile operating system (OS) market, Microsoft has been running scared and has realized they cannot rest on their non-mobile products and established business application strongholds. The present and future OS market is heavily about mobile cloud-connected devices and that is why Android holds 78% of the mobile OS market (Fig. 1, 2015). Google’s release of the Chromebook in June 2011 was a quiet nuclear bomb against Windows, thus threatening their personal computer OS leadership.

Microsoft’s counterattack was supposed to be Windows 8.1 in 2012 to 2013 which was designed to run effectively on mobile and traditional devices but as per Fig. 1. their phone market share fell from 3.2% in 2013 to 2.5% in 2014 and then rose only to 2.7% in 2015. These results are horrible for a global software company that dominates the non-mobile OS and business application markets with more than 1.5 billion daily users according to Corporate Vice President of Education Marketing at Microsoft, Tony Prophet (2014). Windows 8.1 did not go over well because the Microsoft Store has few apps, people did not like the new tile start menu, it is clumsy to navigate, Internet Explorer is slow, and next to no one was inspired to get a Windows Phone because of Windows 8.1.

Fig. 1. Smart Phone OS Market Share
Mobile Phone MarketShare 2015
(IDC, May 2015, http://www.idc.com/prodserv/smartphone-os-market-share.jsp)

Windows 10 is supposed to be Microsoft’s comeback album and it’s going to be just as big as Carlos Santana’s 1999 Supernatural album with the hit song “Smooth”. Windows 10 was released on July 29th and so far the reviews are great all bugs aside. To share the love they are giving away free upgrades from Windows 8.1, 8.1 Phone, and 7 for one year. Microsoft never could quite sell the idea to everyone that you didn’t need a start menu. The Windows 8.1 start menu became the start screen, much the same way your tablet or cell phone works with tiles laid out like a board game. Thus Microsoft is bringing back the start menu on the bottom left yet they are leaving a partial live tile display for mobile enthusiasts that can be collapsed or expanded as per Fig. 2.

Fig. 2.
windows_10_start_screen_desktop_full_screen_0Windows 10 also introduces a function that allows you to utilize multiple desktops not just screen extensions, and this is a lot like Mission Control from Apple OS X. This will be a big benefit for business users, creative users, students, and people who do a lot of multitasking. The hot key shortcut to open a virtual desktop is: Windows key + Ctrl +D. Windows 10 also adds something new for gamers and graphics focused users, direct X12, which is a Microsoft proprietary graphics card decoder that communicates with and optimizes the many different graphics chips on thousands of computer models. It is the industry standard and that is why it’s used on the hugely popular X-Box. Windows 7 and 8.1 will not get access to direct X12 so graphics will be better on Windows 10. A creative person could even game in one desktop while they work in another assuming they have the RAM and CPU power needed for those specific applications – this is pretty cool. Another interesting visual add is the Windows Snap feature which allows you to split your screen into two, three or four separate areas and the hotkey shortcuts for this are:

  • Windows Key + Left – Snap current window to the left side of the screen.
  • Windows Key + Right – Snap current window to the right side of the screen.
  • Windows Key + Up – Snap current window to the top of the screen.
  • Windows Key + Down – Snap current window to the bottom of the screen.

For years customers have been unimpressed with the slow speed and incompatibility of ad-ons with Internet Explorer. Microsoft made a good move to create an all new browser similar to Google Chrome and it’s included for free with Windows 10. Code named Project Spartan and unveiled as Edge the new browser is up to 112% faster than Chrome according to Business Insider (07/15/15, http://www.businessinsider.com/microsoft-edge-windows-10-faster-than-google-chrome-2015-7). Edge allows you to circle, highlight and write your thoughts directly on web-pages. It also has a very cool reading view that strips out all the ads, sidebars, pop-ups and links, so you can scroll through a single column of text and pictures. However this does not work on all web-sites because some websites have not made the updates for 10. We really like this feature as we have been annoyed by these distractions when reading on-line and we like a lot of people do a lot of on-line reading.

Yet probably the second biggest addition to 10 will be Cortana. This is Microsoft’s digital assistant and promises to be much bigger than other voice assisted programs out there. Cortana is much like Dragon or Siri but much more advanced and integrated into the operating system. It will tell you your schedule and schedule things for you and is also an advanced web encyclopedia. It will learn more about you based off of Microsoft’s cloud databases which you can opt to share information with, including your e-mails, phone numbers, and web search data.

Fig. 3.
CortanaAfter upgrading to Window’s 10, we weren’t sure if we would use Cortana, but the more we use it the more we like it. In playing around with Cortana, you can provide feedback with screenshots that go right back to the teams at Microsoft. To prepare for the 10 release Microsoft was using an estimated five million external testers known as “insiders” to get this type of bug feedback.  This impressive number is a considerable increase from prior releases. Cortana is easy to locate in the bottom left of the screen next to the start menu. We find that if the user types a question in the search bar it will add tips and give you interesting facts each and every day, if you let it. Cortana starts out giving you information on the weather, finance, and sports but you can customize this under notebook settings (Fig. 3). Cortana is very intuitive and can track things for you. If you’re receiving a package, it will tell you the progress or details of that package. Say you’re picking someone up at the airport, Cortana will tell you if the flight is on time.

We really see Microsoft using Cortana to compete with Google Search and Google Analytics. Much the same way Google uses search on Android, Microsoft can use Cortana to provide different results for what you are looking for on phones, tablets, or computers. This really gives Microsoft a link to future ad and analytics revenue which could seriously challenge Google’s revenue streams.

In summary, Windows 10 is a much better product than prior operating systems and is a real threat to Apple and Google’s OS growth. It is designed for mobile and non-mobile devices and has the ability to exponentially learn about you from your use habits and Microsoft’s big data in the cloud. It is also a threat to Apple because they do not have a touch based OS on their computers but only on their iPads and iPhones. A lot of companies up to this point are still using Windows 7 but we see some of them moving to Windows 10 thus bypassing Windows 8.1. Imagine an HVAC worker, health care worker, or tax assessor having the power of Windows 10 to query their corporate database with Cortana while working in the field customized from their GPS trail.

With Cortana, the cool mobile aesthetics, the useful features of touch, the speed of the Edge browser, the ability to use multiple virtual desktops, the quad split screen, this is a growing hit among consumers. Based off these new upgrades it is much easier to use and much closer to what people are familiar with from previous versions of Windows yet it is still creatively different. We think app makers who have focused much of their energy in the past on the Android and iOS platforms will be forced to make more apps for Windows 10 and this will force more phone makers to sign on with Windows 10. We predict Windows 10 in conjunction with Microsoft’s own proprietary devices like the Surface will help them gain a lot more of the mobile OS market in the next 18 months thus driving Microsoft’s stock price above $55-$60 per share.

Jeremy Swenson and Mike Cassem are two seasoned, Intel certified, retail technology marketing and training representatives on assignment at Best Buy for clients including Intel, Trend Micro, Adobe, and others. Tweet to them @jer_Swenson and @micassem.

Jeremy Swenson About Photo for BlogMike Cassem