This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

Having a hard time remembering the password to your favorite sites? You’re not alone. When email first became widely available, people only had one password to remember. Now that we bank, shop, and socialize online, password management has become a real challenge. Some people solve this problem by using the same password for everything—a bad idea, since hackers only have to discover one password to leave your computer network security in ruins. This article will briefly review current methods for remembering the dozens of passwords your daily online life requires.

Pen and Paper. The oldest method of password management, this is also a chancy option, especially in work environments where malicious insiders could find that sticky note stashed under the keyboard. Still, many computer experts rely on this. If you must manage your passwords in writing, keep them in a very secure place, such as a wallet.

Browser tools. Maybe you’re sitting back thinking, “I have nothing to worry about! Firefox does all the remembering for me!” Many people on the handy Firefox tool that offers to remember each password the first time you type it in.  But you should know that this method leaves your machine open to hackers, and indeed anyone who accesses it remotely or in-person. Yikes! Thankfully, there is an option in Firefox and many other browsers to turn on a master password—view this video to learn more.

Desktop Programs. If your computer is always handy, you’ll find desktop-based password reminder programs easy to use. This type software is commonly called a password vault, since you type in one master password to access a highly encrypted (and therefore safe) file showing all of your passwords. Several free open-source options are available, such as Password Safe and KeePass. Those who want to shell out money for vault software can purchase 1Password ($39.95), the most highly recommended option in its field. SplashID is an option for those who are addicted to their mobile devices; it’s available for a variety of platforms, but isn’t as easy to use.

Online Services. Like everything else these days, password reminders are going virtual. Several online data backup services store your passwords in the cloud, enabling you to reach them no matter where you are. Keep in mind that library and other public computers are not secure, so it’s unwise to access cloud-based information on them. As with all other cloud technology, your information is ultimately at the mercy of the hosting company, so find a well-respected firm if you choose to follow this route. CNN recently reviewed one cloud-based password program called RoboForm Online.

Improve your memory. In the end, each of the methods listed above is vulnerable. The only 100% safe method for password retrieval is to remember them in your own noggin. How? Nykema Wright, an occupational therapist who works with brain injury patients, provides several techniques. One method is called spaced repetition. For especially sensitive information, such as bank logins, repeat the pin to yourself a couple of times immediately. A few hours later, try to remember it. Keep challenging yourself to remember that one pin several times throughout the rest of the day. Read our post on setting memorable passwords for more suggestions.

Regardless of which memory device you choose, be sure to set strong passwords in the first place. Too many people use easy-to-crack passwords, such as 123456. And if your office workers are having a hard time remembering company passwords, consult with a local IT consulting company to decide which program is the best option for your firm.

Photo via husin.sani

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

Does your company have a computer and internet use policy? Policy creation is often a long, tedious process, yet every organization must have rules in place to protect company computers from viruses, spamware, and other online nasties. Large companies have ample resources to develop and update computer use policies, but for the Small to Medium Size Business (SMB) owner, this task often detracts from far more pressing business issues. Fortunately, Joe Kennedy, author of The Small Business Owner’s Manual, has compiled the following basic set of rules for company computer use:

1) Every employee must check the status of antivirus, anti-scumware, and antiphishing  programs twice a day. These programs must be running smoothly in order to protect your company’s machines from online threats.

2) At the end of the business day, employees should set aside ten minutes to run computer security programs and reboot their machines. This ensures a quick, clean start to the next business day.

3) Use online monitoring tools associated with antivirus programs (usually in the address bar of your browser) to avoid phishing scams, and be alert for new schemes. Be very cautious of any website that includes a pop-up directing you to install a new program or update. When concerned or confused, ask for help.

4) Email messages may have infected attachments, so employees should never open attached files from unknown sources. Even emails from known sources can be infected; if the email doesn’t make sense or contains blatant spelling errors, it is likely infected with spamware or a virus.

5) Employees should not add new programs without management’s permission. Some hackers include malicious software with system updates; for this reason you may want to leave all machine updates and software patches to your IT staff, whether it is internal or outsourced.

Additionally, many companies limit computer use to corporate needs. In other words, employees are not allowed to surf the web or use company email for their own purposes. Of course, this restriction can be very difficult to enforce; one approach is to archive all email to be analyzed later. Ultimately, you will need to consult with an employment law attorney to draft a solid computer use policy; until that time, you may choose to use the above rules as a stopgap to protect your machines. Even after a computer policy has been put in place, it’s a good idea to hire an IT consultant to assess, maintain, and fine tune your business’ IT infrastructure. Ascensha is a Beaverton computer consultant that can help any SMB improve and protect its IT infrastructure.

Top photo: Martin Terber

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

Do your employees know how to avoid malvertising? This new form of malware has online publishers worried. Malvertising, a portmanteau of malware and advertising, has been popping up even on respected news sites, such as the New York Times Online.  Like all malware, malvertising installs programs designed to harm the host computer or its software. Hackers buy advertising from online publishers, and then post advertisements warning visitors that their anti-virus protection is out of date. Nieve web surfers will click on the warning, and voila, spyware or other forms of malware are installed on their machines.

To protect your company from malvertising, follow these five tips:

1) Keep your anti-virus protection up to date. Make sure all of your company’s machines are protected with anti-virus software. Download security patches regularly to make every machine is protected against new threats. And remember that virtual machines must also be protected.

2) Carefully Maintain your Operating System. Many malvertisements rely on weaknesses in outdated operating systems. As with your anti-virus programs, installing all new OS patches will help keep your company’s computers safe.

3) Tell employees to download with extreme caution. Remember, malware can hide in email attachments, program downloads, and instant-message links. Educate employees on how malvertising works, and tell them to avoid any questionable advertisements.

4) Report Questionable Advertisements. If you do come across an advertisement that looks questionable, you can report it to Google here.

Finally, if you suspect that one of your machines is already infected, you can buy any number of products to detect and clear malware. Be aware that there are spammy solutions out there, too, so be sure to choose a product from a reputable company.

Additional Resources
6 Tips for Halting Social Engineer Hackers
Evading Social Network Hackers: The Employee Side
How to Protect Your SMB from Online Fraud

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

A recent Gartner Research survey of CIOs showed that, on average, companies are spending 5% of their budgets on IT security, down 1% from last year. Despite this slight dip in security spending, the number of security threats has not decreased. Therefore, it’s crucial for each firm to maximize its security assets. Here are a few methods for optimizing your firm’s security resources no matter how generous (or strapped) your budget might be.

1) Use Built-In Security Features. “Leverage the free stuff,” encourages Gartner VP Vic Wheatman, speaking at Gartner’s Security and Risk Management Summit. Operating systems, hardware, and network appliances such as routers often include built-in security features. Turn on these free tools to save IT costs. For instance, many email programs include complimentary encryption tools. Utilizing your email program’s free encryption service could save money on encryption software.

2) Play Defense, Not Catch-Up. Defensive IT spending can reduce problems down the road. When assessing technology options, prioritize security. Look for software and hardware that include built-in security features. A slightly higher up-front cost will likely be offset by fewer hours spent patching and updating later.

3) Consider Outsourcing IT Security. Outsourcing IT security services makes sense when your IT staff is already overburdened. It’s also wise to outsource highly specialized IT security tasks. For instance, a CIO-for-hire may be able to assess and shore up your network more effectively than full-time staff members. Having fixed multiple security systems, IT specialists have a broad understanding of the security landscape surrounding the issues they follow. Their specialized knowledge also allows them to anticipate the latest security threats.

Many companies categorize IT security spending as operational maintenance. IT spending may not directly contribute to ROI, but it is absolutely necessary to compete in the Information Age. By using and prioritizing built-in security features, and selectively outsourcing IT security, you can maximize your IT budget even in this dismal economy.

Additional Resources:
5 Benefits of Outsourcing IT Security Management
Res10 Computer Security Habits to Adopt
IT Services: The Benefits to Small Business

Top photo by Paul Sapiano.

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

Cloud computing is the current IT buzz term. According to research from the World Economic Forum, potential users from around the world see multiple possible benefits from cloud technologies, including increased collaboration capabilities and reduced IT costs. With huge prospective changes in health care, education, and business, the impact of cloud data storage could exceed that of mobile technology. However, as the above hype cycle graph from Gartner Research shows, we are at the peak of inflated expectations for this new technology, and we’re beginning to tip into the “trough of disillusionment,” when users will recognize the drawbacks of switching to the cloud. CIO magazine’s survey of IT professionals shows that IT professionals are indeed more concerned about cloud computing hang-ups than they were just a year ago. Their main concerns include loss of control over data, vendor lock-in, and regulation and compliance confusion. Additionally, the WEF’s research found that 63% of IT providers are concerned about privacy requirements for cloud computing.

As with many new technologies, wise adopters will protect themselves by acting cautiously. If you’re thinking of bringing your small or medium-sized business into the cloud, you should carefully think through the implications. Here are five questions to ask your vendor before diving into the cloud:

1.)    How secure is data stored in the cloud? What steps does the vendor take to assure that your data will be safe? Encryption is one approach to protecting data.

2.)    Who will have access to company data stored in the cloud? Your cloud vendor should provide methods for ensuring that only authorized vendors, employees, and clients can access data and applications.

3.)    What back-up systems will protect data stored in the cloud? Of course, in-house back-up standards will figure large in any case of data loss, but you should also ask your provider about their record of technological reliability, and what their procedure is should a data breach occur. What is their disaster recovery plan?

4.)    Where will data be stored? Before signing on with a cloud vendor, find out where their data centers are physically located, and think through the legal implications for your company.  For instance, privacy laws in the United States are fairly strong, but data centers in China or India do not have to follow the same standards.

5.)    How easy is it to switch vendors? Vendor lock-in is a serious concern of many considering cloud-based applications. The basic issue is that the cloud storage vendor maintains your company’s data. Ask potential vendors about the procedure for cutting ties with clients. How will they purge their systems of your company’s data? And how easy will it be for you to switch cloud vendors?

Because cloud computing is still in its infancy, there are no hard-and-fast rules for best practices. However, asking these questions will help protect your company’s data and reputation.

Additional Resources
Where’s the best place to store your data?
Is Cloud Computing Really Green?
Does your business know about SaaS?

Photo:  World Economic Forum

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

We’ve all heard about how important it is to change your passwords often. And how we shouldn’t use street addresses, phone numbers, birthdays, or anything else personal as our passwords. Yet, as a successful hack job recently showed, many people fail to follow these and other password security guidelines. In December of last year, RockYou.com suffered a massive security breach. 32 million passwords were hacked and published online, independent of any identifying information. The Application Defense Center analyzed the passwords and published a white paper titled “Consumer Worst Practices.” Having scoured that report, we’re providing a list of the very worst password practices. Tell your employees NOT to do these things:

1. DON’T use consecutive numbers or letters.
The most common password among RockYou.com’s followers was 123456. This is one of the first passwords hackers try. Do not include any obvious patterns of numbers or letters in your passwords. As the following list of the top ten passwords from RockYou.com shows, many people fail to follow this rule:

1. 123456
2. 12345
3. 123456789
4. Password
5. iloveyou
6. princess
7. rockyou
8. 1234567
9. 12345678
10. abc123

2. DON’T use passwords that are shorter than 6 characters.
Shorter passwords are much more susceptible than longer passwords to being hacked. Take a statistical perspective to appreciate why this is the case; if you only have five characters in your password, there are far fewer combinations for hackers to wade through than if you had a nine-character password. NASA recommends that passwords be at least 8 characters long.

3. DON’T use all upper case letters, all lower case letters, or all numbers.
Again, doing so limits the statistical pool that hackers have to choose from. The Imperva study found that nearly 42% of users choose passwords that are all lower case letters. Only 3.81% of the passwords from RockYou.com contained special characters, which are a sign of a strong password. G0n3F15H!ng is an example of a strong password. It makes sense to the user (GoneFishing; see it?) and it contains lower case letters, upper case letters, numbers, and special characters.

4. DON’T use the same password across multiple accounts.
If you use the same password over and over again,  a hacker only has to figure out that one password in order to access your entire online profile. Instead of choosing one password for all of your accounts, try concocting passwords according to how you use each site. So, for instance, your Facebook password could be “Fr!3Nd5&FaM” (Friends&Fam), and your bank password could be C07dH@rdC*5h (ColdHardCash).

5. DON’T use your name, a slang word, or any word in the dictionary.
Now that RockYou.com’s users’ passwords are publicly available, hackers basically have a reference guide of commonly used passwords. Hackers can feed this list  into  “brute force” programs, which quickly try hundreds of passwords every second. To avoid choosing a password that hackers already know about, avoid using your name, slang, or regular words. For instance, the 17th most common password on RockYou.com was “michael,” which 14,898 visitors used as their password. If you choose to use “michael” as your password, you can bet that a hacker will catch on pretty quick.

You’re probably wondering just how to  create a memorable, secure password without breaking any of these rules. In addition to the technique of trading out letters for similar-looking numbers and special characters, you can translate a phrase into a password. For instance, let’s say that you’re wondering how to create a password for your Netflix account. Just think about a phrase from your all-time favorite movie, and translate some of it into an acronym. So, if your favorite movie happens to be The Godfather, your password could be “InP3r50n@L1b,” short for “It’s not personal, it’s business. As you can see, the word “personal” is spelled out in numbers and letters. If you follow the suggestions in this post, the chances of a hacker gaining access to your account will be slim to none.

Additional Resources
Five Must-Answer IT Security Questions
Eliminating Small Business Security Threats
Question: How do I create a strong, memorable password?

Top photo by Roman Pinzon-Soto

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

In “Catch Me If You Can,” Leonardo DiCaprio plays Frank Abegnale, Jr, arguably one of the most successful social engineering criminals in American history. Abegnale passed more than $4 million in bad checks in his youth. He successfully posed as a doctor, lawyer, and airline pilot—and all before the age of 21. What allowed this minor to get whatever he wanted? Limitless charm and sharp powers of observation. Those same qualities are the keys today’s social engineer criminals use to slip through lock-tight security barriers. These days, having served six years in prison, Abegnale is helping the FBI catch modern cybercriminals. He has said, “What I did in my youth is hundreds of times easier today. Technology breeds crime.” This article will explain how to protect yourself and your company against social engineer hackers.

In techno-speak, a social engineer is a person or virus who uses charm to sneak through computer security systems, often to steal valuable personal or corporate data. Basically, a social engineer is a hacker with a personality. Social engineer hackers gain access to precious data by building trust.

One of the first widely successful social engineering hack jobs was the LoveBug virus, which was delivered as an email with the subject line “ILoveYou.” Millions of corporate email users clicked on the attachment, which appeared as “Love-Letter-For-You.txt.” The LoveBug virus caused an estimated $5.5 million in damage. It spread across the globe in a single day, 5/4/2000. Victims of the LoveBug—including the CIA, the Pentagon, and the British Parliament—lost many files, which the virus overwrote. And all of this because people couldn’t resist opening something so flattering.

As you can see, sometimes social engineers operate remotely. They may call your receptionist and charm him or her out of her network password. Or a social engineer may actually show up at your company, pretending to be a technician who needs to “fix” something in the server room. Either way, your firm could lose valuable data. To halt such hackers, you must train your staff to be on the lookout. Here are six tricks you can use to thwart would-be social engineers:

1. Don’t Give Out Your Password. Ever.
Let’s say a hacker calls your human resources director, posing as a frantic IT tech. “I need your password right away, so I can fix what I just messed up before my boss gets back from lunch!” he cries. Don’t believe such claims. The truth is that network administrators almost never need to ask for passwords—they usually have access to all the passwords they need. Make it company policy that no one hands out passwords to anyone else—or set up policies and procedures for sharing them in-house (see #6, below).

2. Beware Ploys for Sympathy.
Sometimes, social engineers garner sympathy to gain access. The example above falls into this category. Another example would be a social engineer posing as a tech from the ISP, who says he only has an hour to check the wiring in the server room, or else he’ll get fired. Train your employees to notice their gut reactions, and take note when an outsider is bringing up emotional turmoil—those are signs that a social engineer could be on the prowl.

3. Protect Against Shoulder Surfing.
Sadly, many social engineering plots originate from within companies. A disgruntled worker may try to convince other employees to get revenge against an especially toxic boss, for instance. Often, these mutineers rely on shoulder surfing to pick up key data. Shoulder surfing is exactly what it sounds like—looking over someone’s shoulder to read important data on their screen, or to catch a password as it is typed. Other than being aware of their surroundings, your employees can protect against shoulder surfing by locking their keyboards when they are not in use. Otherwise, an observant shoulder surfer could easily notice when someone gets up for that mid-morning coffee, slide into the empty seat, and access delicate data.

4. Destroy With Care.
Social engineers are not adverse to unsavory tasks such as dumpster diving. They would be happy as clams to discover your data on a discarded disc. Avoid throwing away anything with proprietary or personal information; shred important documents before tossing them in the recycling bin. Finally, be sure to erase or write over hard drives on any used computers that you plan to donate or sell.

5. Don’t open questionable attachments.
Social engineers often infect machines through attachments, as seen with the LoveBug virus. If you don’t know the sender well, don’t open the attachment. If you do know the sender well, but the attachment looks funny, hesitate. Call the sender to verify the attachment’s contents. Just as we encourage people to cover their mouths as they sneeze, workers should be careful about opening questionable attachments, since that’s a favorite route for malware.

6. Formalize & Educate.
By setting technology policies and educating employees on potential dangers, you can protect yourself against the majority of threats.  If you’d like employees to share passwords in certain circumstances, you should create a particular set of steps to take before the password is divulged. For instance, an internal technician could call the user, request the password, and hang up the phone. Then the employee could call the administrator back using the company phone list. Simple plans like this are hard for social engineers to anticipate. Additional security may be obtained through professional security solutions, such as smart tokens or even biometrics.

By heeding the six tips listed above, you can evade most social engineering schemes. Overall, be wary of charisma and other emotional tools. If you feel like you’re being charmed, you probably are. Be conscientious and consistent, and you can protect your SMB’s vital data.

Additional Resources
Is your company being targeted for attack?
Eliminating Small Business Security Threats
Protecting Your Business Against Scareware

Top photo by Anonymous9000.

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

Computers are so ubiquitous these days that we have to take vacations from our technology by “unplugging.” And yet, despite our ever-increasing reliance on our computers, many of us leave ourselves open to attack when we are “plugged in.” Computer security surveys show that our cybereducation has not kept pace with cybercrime. For instance, the Computer
Security Institute’s 14^th annual Computer Crime and Security Survey, released in December of 2009, shows that 64.3% of Americans experienced a malware infection, up 50% from 2008. Ultimately, only you can take a bite out of cybercrime—by eliminating the easy hacking routes, you can reduce your chances of being attacked. In this post, we’ve collected ten basic habits for computer security. How many of these habits does your business or household follow?

1. Lock your computer when you walk away from it.
The world’s fanciest encryption software won’t stop someone from sifting through your data while you run off to the restroom—unless you lock your computer, that is. Locking a computer forces would-be social engineer hackers from gaining access (unless they also have your password).

2. If you’re not using the Internet, get offline.
If you are on a broadband or wireless connection, you shouldn’t leave your computer online all the time. Doing so increases the amount of time that hackers have to work their way in. Put probability on your side by disconnecting when you’re not using the web.

3. Maintain and check antivirus security programs.
You do have an antivirus program, don’t you? Sure, that’s a gimme. But how often do you actually check your antivirus program? You should be checking it at least once a month to make sure that it doesn’t need any updates. New viruses are created every day; update your security program to make sure you have the antidotes to the new nasties.

4. Set up a firewall. Check it regularly.
Firewalls are required for doing business these days. A firewall protects an internal network from outside assaults. Basically, a firewall is a barrier between areas of different trust levels. For instance, the Internet has no trust (anything can pass through it easily), while an internal network at an office would have a high level of trust. The firewall prevents online viruses from infiltrating your company’s network.

5. Obtain and maintain anti-spyware.
Spyware is an especially malicious form of cybercrime. It can capture your keystrokes (read: passwords) and activity online. One way to prevent your machine from being infected with spyware is to be very careful about which programs you download. (Usually, the user downloads spyware unwittingly.) However, even this won’t protect you from certain websites that actually force your computer to download spyware. The best way to protect yourself against spyware is to get a strong anti-spyware program. (Note that many antivirus programs include anti-spyware software.)

6. Use power strips and unplug during electrical storms.
Okay, so this one doesn’t have much to do with cybercrime, but failing to follow this habit result could still destroy your computer. Electrical storms send surges of electricity down to earth. A nearby lightening strike could fry your computer if it is plugged in. If you don’t want to have to dig around behind your computer before every thunderstorm, purchase a surge protector. (FYI, it’s a good idea to unplug all major appliances during electrical storms.)

7. Back up your data regularly.
Maintain backup copies of your hard drive, network files, and anything else that is crucial for smooth sailing. Some modern computers (such as MacBooks) automatically prompt the user to back up data every 90 days. This is a good rule of thumb for all computer users.

8.   Update software regularly.
Yes, software updates are irritating, but they are also crucial. Software updates often include new stopgaps against viruses, so be sure to update your system regularly.

9.  Do not supply private information via email.
Many cyberscams involve persuading individuals to willingly pass on their passwords and other private information. Don’t believe what you read. Even if you’re emailing someone you trust, email is not a good way to pass on private information, since it may be phished. Whip out your cell phone instead.

10. Use strong passwords and change them regularly.
Avoid using the same password across different platforms. Use a combination of letters, numbers, and other characters (like *$!) to create strong passwords. Change your passwords frequently. If you have a hard time remembering your passwords, write them down in a memo book near your desk. (Emailing them to yourself is not a secure solution.) Click here to learn how to create a strong, memorable password.

Now, merely following these ten tips won’t protect you against all computer threats. However, by adopting these ten habits, you’ll be distinguishing yourself from the “easy marks” who fail to practice basic computer hygiene, as it were.

Additional Resources:
Recognizing Five Small Business Security Threats
How to Protect Your SMB from Online Fraud
Is your Backup Data Secure?

Top photo by Steve Winton.

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

Since ancient times, people have relied on various forms of encryption to keep some information secret.  History abounds with stories emphasizing the importance of codes. Queen Mary’s use of a weak code landed her in the Tower after royal code breakers deciphered her missives arranging Queen Elizabeth’s assassination. The French used visual codes, in the form of semaphore telegraphs, to convey information quickly during the Revolution. And American and British code breakers are said to have shortened WWII by two years by figuring out Hitler’s code-producing Enigma machine. Until the digital revolution, codes were rarely used by laypeople. Nowadays, however, smart computer users everywhere use encryption to protect their data. After explaining how modern data encryption works, this article will provide tips on selecting an encryption program to protect your SMB’s data from prying eyes.

Encryption occurs constantly online. If you’ve ever sent an email or shopped online you have exchanged encrypted data. By encrypting credit card information, online merchants promise security. Emails are often encrypted as well, since emails are notoriously open to server administrators. For SMBs, data encryption is a smart precaution. If, heaven forbid, your files should fall into the wrong hands, data encryption is your final line of defense; a would-be hacker might have all your precious data in his or her hands, but without the encryption key, it would be unreadable.

The first step in setting up encryption for your business is to check your current operating systems for integrated encryption features. Windows 2000, Windows XP, and Vista all include encryption systems. Most email providers, including Gmail, offer encryption features as well, although you may need to dig a bit to figure out how to turn them on.

You can also find free open-source encryption programs. Some free programs just encrypt files. Others, like TrueCrypt, encrypt entire disks. Open source programs can codify everything from flip drives to servers. For a more complete comparison of free encryption programs, read Freebyte’s Guide to Free Encryption and Computer Security.

Finally, you may feel your data is so sensitive that you need a totally uncrackable solution. If your reputation depends on your privacy, it may make sense to pay for top-of-the line encryption. In this case, you’ll need to understand a little more about how encryption software works. Typically, encryption is done in chunks of data, usually 64 or 128 bits in length. The shorter the chunk, the easier it is to crack the code. The human mind on its own is basically incapable of such decryption; however, networks of computers working together can break a 56-bit cipher in a matter of minutes. Basically, 128-bit encryption is better than 56-bit encryption, so ask about this as you’re perusing encryption software.

A few other characteristics to keep in mind include:

• Overlay capabilities: Will you need to change anything in your system, or will the encryption software integrate seamlessly into your current setup?

• Technical support: Some encryption software is too complex for the average user. As you compare encryption packages, scan for information on technical support.

• Application-Based Security: Yes, all encryption offers some security, but there are also different types of encryption for different applications. Think about whether your needs will be covered.

Ultimately, encryption systems are as fallible as the humans that use them. Many require a password; be sure that you don’t share that password with anyone. Certain encryption programs only require you to key in a password when you begin your work session, meaning that someone could view your data when you walk away from your computer to get that mid-morning cup of coffee. We’ll cover such social engineering hacking techniques in an upcoming post. Until then, happy coding!

Additional Resources:
Question: How can I protect data on portable devices?
An Introduction to the Use of Encryption
IT Security: Back to Basics

Top photo by Rob Pongsajapan.

bookmark to:

This post originated at IT Services Info & News | Ascensha. Ascensha is a Portland, OR IT company that manages and develops network infrastructure for Oregon small businesses.

Like filing taxes, clearing hard drives is something no one enjoys, but everyone should do. It is absolutely imperative to erase hard drives before donating or selling old computers. Why? Because otherwise, even those with rudimentary IT knowledge can access your data.  The news is chock full of stories about companies that failed to clear the hard drives before donating or selling their old computers.

In fact, one study of computers sold on eBay found that 40% of them still contained personal information.  Most recently, the Buffalo, NY police department has come under fire for failing to scrub clean the memory of sold printers.  From confidential human resources information to secret business strategies, business computers contain millions of bits of data. To prevent later users from accessing your private data, it’s crucial to completely wipe out old computer memory.

It’s not enough to simply hit the “delete” key, or to move an item to the trash bin and then empty the bin. That’s because deleting an item in this way usually removes just the directions for where the data is stored. A copy of the data is still somewhere on the disc unless you erase the hard drive completely.

Another good reason to clear old hard drives is that you may be liable if you don’t.  Federal laws including HIPAA protect consumer information; if you don’t delete such records before getting rid of your old computer or printer, and someone accesses it later, the feds will hold your company accountable.

There are generally three methods of erasing old hard drives:

1.) If I had a hammer… I’d use it to “erase” my hard drive. The low-tech approach to wiping away old data is to smash the hard drive to smithereens. Of course, this also destroys the machine, so you can’t get any donation tax benefits, and who would buy such a machine? Still, feel free to pound away if you need some stress relief.

2.) Darik’s Boot and Nuke (DBAN) This open-source (read: free) program can help you wipe the memory from nearly any machine. Access this resource at http://www.dban.org/. Before running DBAN, it is highly recommended that you review the “Read Me” text files included in the program. This will ensure that you understand that DBAN is as irreversible as dropping an atomic bomb. It will wipe out everything.

3.) Commercial Erasers. If your firm deals with especially sensitive material (state secrets, medical files, etc.), you may want to choose a commercial disc eraser. Those who hope to clear printer hard drives will also need to find a commercial solution. A Google search will turn up any number of products in this field.

If you are clearing the hard drive from an older machine, keep in mind that you may have to make more than one “pass.” In IT parlance, one pass is akin to one eraser swipe trip through the drive. Due to the fact that identical data may be stored in side-by-side locations on older hard drives, experts recommend several passes to completely scrub clean hard drives. (Because they can more accurately locate and record data, new hard drives are good to go after just one pass. Read more about this here.)

Commercial products generally provide several security options for overwriting or erasing hard drives. If you are convinced that you need to match the Department of Defense’s standards, most disc erasure programs offer this level of security. In upcoming posts, we will discuss encryption and other techniques for erasing data as you go. Using the techniques listed in this article to completely erase old data will protect your company in the long term.

Additional Resources
Wikipedia entry: “Data remanence”
Where’s the best place to store your data?
Is your backup data secure?

Top photo by mrbill.

bookmark to: