A Culture of Security - The Best Infection!

   I was recently reading an interesting article at SearchSecurity entitled Staff infection: IT security education is contagious.  The article notes that security is the responsibility of every individual and that for an organization to have even a semblance of security, there has to be both buy-in and shared action by the members of the organization.

   The article, very correctly, mentions:

Even in today’s world, the general IT worker tends to view security as a barrier and a pain. It is implemented by someone else, and it makes their job harder to perform.

   This is one of the key problems caused by many security programs.  The information security industry often causes problems for itself by being difficult and inflexible.  Security is often viewed as a barrier.  Security is the group that adds extra requirements, delays projects and increases costs.  And with all of that, Security can't guarantee prevention, nor even provide a reliable probability of, an incident or breach.

The Need To Read

   I recently read a great article on summer brain drain on ParentsChoice.org's Read More. Play More. Learn More. blog.

   The article is mostly directed to parents, making the point that kids forget school topics over the summer and often need time to get back up to speed.  This can be remedied with fun, stimulating activities, like brain games.  The article links to some brain games from the Museum of Science and Industry in Chicago.

   And, as the post points out, adults can also suffer from the same brain drain due to the inevitable schedule variations of the summer.

   But the specific article aside... what a great name and concept.  We could all read more, play more and learn more.

   We all need to exercise our brains.  Many people read articles and other material as part of their job.  But regardless of how in-depth, creative or technical that job may be, I think it's important to read and learn about other topics.

   So read.  Read blogs, and books of all kinds: non-fiction, historical fiction, mysteries, sci-fi... whatever you enjoy.  Read things in your field, but be sure to also read other info and read for enjoyment.  And, if you don't have time to sit down with a book, try audiobooks and podcasts.

   What are some of your favorite reading, educational or brain activity resources?

Macs don't get viruses... right?

   It's that time of year again, when many first time college students and their parents explore that age old question... Mac or PC?


   Most schools will give one of two non-answers:

• it's personal preference - just use what you like best, or
• check with your major department for their requirements

   While these aren't terrible answers, they really won't help most people.  Most kids just use features of a computer like the web browser, chat client, skype and office tools, and don't really interact with the operating systems.  In fact, it's the same for many parents.
   And, most academic departments don't have specific requirements, and if the require specific software it will run on PC or Mac.  (YMMV/Your Mileage May Vary - and you should check with that academic department!).

   So, we haven't helped answer the question!  But here are criteria you shouldn't use: price (alone); "free" items included (like printers), and; don't choose a Mac just because you think it won't get malware!

Are You the Customer... or the Product?

   I regularly speak with people about Internet/Online Safety.  One message I frequently give about free online services is:

You're not the Customer... You're the Product.

   We often see people upset about changes in social networks like Facebook.  Folks complain about "customer service", not realizing that they are not the customer!  It's often the advertisers, or other backers, who are the real customers.  And what those customers want is information... about the users of the service.

   I'm a big fan of free online services, but it's important that people realize what's going on.  It starts with the privacy policy, which explains how an online service intends to use your data and information about you.

   But I want to talk about cloud storage services.  These services allow you to backup files, sync files between systems and devices, and have files available from anywhere.  How are your files protected?

The More Things Change...

   As the saying goes... the more they stay the same.  In our ever-changing world of technology and security, it always amazes me how things often don't change!

   Let me clarify... there's always a totally new technology, programming language or social network to learn. Of course, computing power has changed drastically.  Many of the techniques used by attackers to gain improper access to our information have changed.

   Though many have not.  And the advice we give to consumers and business users to protect themselves has not changed!   Consider...

Want someone's password? Just ask!

   SC Magazine recently put out an article entitled: More users than ever experiencing phishing attack attempts.  According to the article, phishing attacks are on the rise.

   Phishing is simply any kind of communication intending to extract (typically) personal information from someone.  The scam usually tries to either get the victim to visit a malicious website or directly provide their information, via a reply to the attacker or in an online form.

   Years ago, phishing emails were easy to spot.  They typically used obvious From: addresses, poor grammar and spelling, clearly misleading url's, and overall poor imitation of a legitimate organization's communication.

   But, as is often the case, the phishers have gotten better.  The emails look legit, the grammar and use of language is good, and the links often go to realistic-looking, but malicious, sites.  And email isn't the only delivery method.

   So, how do we avoid, and help others avoid, these attacks?

Countdown - the end of a (Google) reader

   The clock is ticking.  On July 1, Google will remove support for the RSS aggregator tool, Google Reader.

   In the past I've talked about how I keep up with the vast amount of information and changes in the security and IT fields.  That article focused on podcasts.  Another key tool I use is an RSS aggregator.

   An RSS aggregator is a program used to collect information from online sources.  You "subscribe" to a site (such as this blog), and then notices of new articles are automatically brought into the aggregator.  The power of the tool is that you can organize your subscriptions by categories you choose.  You can then quickly browse new articles by category.