Inside Jobs
Roland Jones, Sun Microsystems senior product manager for Java security, said you can spend all of the money in the world on encryption, but security is a bigger package.
"Why go off the deep end and encrypt every little thing, only to find out everyone has their passwords stuck on their computers?" he said.
The whole package includes better business practices, Dumas said. You should train all existing staff and new hires about Internet security and give a refresher course every year. Support should come from the top, down. One way to test your business processes is to think about whom you would call if you discovered a security breach. You should have at least one full-time person dedicated to securing infrastructure.
Finn noted that employee security breaches also are an issue. Insiders often inappropriately use company information.
"There are not any foolproof technological means for preventing that; you have to rely on good procedural measures to address those kinds of risks," he said.
If you have a database server that is storing credit-card information or user profiles, you can do several things to make sure your system can't be compromised. Methods include doing background checks and maintaining strong host security. Host security means locking down and limiting access to your systems where you maintain sensitive information. You should issue policies stating which users are allowed to log in to a computer, who is allowed to maintain systems and how often employees must change passwords. Keep records of who accesses internal systems, and audit what they do when they are connected.
Dumas added that sometimes untrustworthy employees will defend criminal actions by saying that nobody told them breaching inside security was wrong. You should notify employees that you don't permit internal breaches. Another way to maintain security while connected to the Internet is to partner with security companies or organizations. When programmers develop a product, or when web designers create a site, they think about functionality and design rather than security. Asking a cryptologist or security specialist to check out your system can plug security holes. Vestcom's Ward said organizations such as the National Automated Clearinghouse Association are working to set industry standards for EBPP that address security and passing data.
Ward pointed out you should ask your bank how it is enabling electronic information exchange, and follow its lead. Most big banks have their own initiatives and will share them with you. You also should make sure you are dealing with a reputable party before you ask a company to help you. Finn said you can gauge reputation by asking a company if it is certified by the International Computer Security Association. This industry group evaluates firewalls and ensures they meet minimum security criteria. Potential partners should be familiar with the various kinds of attacks that hackers can mount against computer systems. Look for a company with vast experience, and check its references.
Ryan said you can have the best security system in the world, but the real challenge is implementation. Look for vendors with the most experience in security. Government agencies, for example, are not likely to hire amateurs, so references such as post offices or other federal agencies are a good sign the vendor is legitimate.
More:
Tuesday, May 3, 2011
How to Prevent Hacking of your PC? Part. 1
Hack Attack
Before you can implement web-security solutions, you first must understand potential problems. David Dumas, GTE Laboratories principal member of technical staff, said passive attacks are when hackers listen and collect data, often as a prelude to an active attack. Active attacks are when they change, delete, alter or add to your data.
Dumas explained the various ways people can hack into your billing records and data through the World Wide Web. Social engineering is a common, non-technical way to access system passwords, and sometimes all too easy. The attacker socializes with company personnel to find out people's names and the departments in which they work, then he name-drops in conversations with other employees to learn user names and passwords as a front end to an electronic attack. Once he has that information, he can break through firewalls to look at customer records, credit-card numbers and security PINs.
Other hackers will pose as employees. They might make an authentic-looking company badge and walk into your building or apply to the company as a janitor. Sometimes a hacker will install a sniffer while he is there. Dumas said a sniffer, which is commonly available from various Internet sites, plugs into a network jack and collects user names and passwords.
"It could be on your box today," Dumas said. "You can't detect it."
Some hackers don't even have to install a device because they find Post-It notes in plain view with passwords written on them.
Hackers have other means to get at your passwords. One is through simple trial and error. If they know you have security in place, hackers actually will slow down attacks to avoid setting off bells and whistles, Dumas added. Password-guessing software, such as Cracker, also facilitates attacks. Some can listen to your system, capture passwords and then knock the legitimate user off the system so the hacker becomes the user.
Attacks known as man-in-the-middle, spoofing and Trojan horse also can capture passwords and PINs. A "man-in-the-middle" attack is when a hacker appears to the server as if he were the legitimate remote agent. To the end user, he looks like the server. The user unknowingly sends credit-card information to the hacker. Spoofing occurs when a user logs in to a remote system. The workstation is not actually connected to the remote system, but it generates the log-in banner and prompts the user to input his user ID and password. Software captures the information and kicks the end user off the system. In a Trojan horse attack, the hacker alters the local system to allow a later entry. He may use a bogus code to bypass system controls to hide the existence or current status of an account.
More: http://web.ebscohost.com/ehost/detail?sid=1fff7848-8fc8-464a-8ccc-fd71bf9a203d%40sessionmgr11&vid=5&hid=14&bdata=JnNpdGU9ZWhvc3QtbGl2ZQ%3d%3d#AN0001858715-3
Before you can implement web-security solutions, you first must understand potential problems. David Dumas, GTE Laboratories principal member of technical staff, said passive attacks are when hackers listen and collect data, often as a prelude to an active attack. Active attacks are when they change, delete, alter or add to your data.
Dumas explained the various ways people can hack into your billing records and data through the World Wide Web. Social engineering is a common, non-technical way to access system passwords, and sometimes all too easy. The attacker socializes with company personnel to find out people's names and the departments in which they work, then he name-drops in conversations with other employees to learn user names and passwords as a front end to an electronic attack. Once he has that information, he can break through firewalls to look at customer records, credit-card numbers and security PINs.
Other hackers will pose as employees. They might make an authentic-looking company badge and walk into your building or apply to the company as a janitor. Sometimes a hacker will install a sniffer while he is there. Dumas said a sniffer, which is commonly available from various Internet sites, plugs into a network jack and collects user names and passwords.
"It could be on your box today," Dumas said. "You can't detect it."
Some hackers don't even have to install a device because they find Post-It notes in plain view with passwords written on them.
Hackers have other means to get at your passwords. One is through simple trial and error. If they know you have security in place, hackers actually will slow down attacks to avoid setting off bells and whistles, Dumas added. Password-guessing software, such as Cracker, also facilitates attacks. Some can listen to your system, capture passwords and then knock the legitimate user off the system so the hacker becomes the user.
Attacks known as man-in-the-middle, spoofing and Trojan horse also can capture passwords and PINs. A "man-in-the-middle" attack is when a hacker appears to the server as if he were the legitimate remote agent. To the end user, he looks like the server. The user unknowingly sends credit-card information to the hacker. Spoofing occurs when a user logs in to a remote system. The workstation is not actually connected to the remote system, but it generates the log-in banner and prompts the user to input his user ID and password. Software captures the information and kicks the end user off the system. In a Trojan horse attack, the hacker alters the local system to allow a later entry. He may use a bogus code to bypass system controls to hide the existence or current status of an account.
More: http://web.ebscohost.com/ehost/detail?sid=1fff7848-8fc8-464a-8ccc-fd71bf9a203d%40sessionmgr11&vid=5&hid=14&bdata=JnNpdGU9ZWhvc3QtbGl2ZQ%3d%3d#AN0001858715-3
Computer hackers...
What is a computer hacker?
The article focuses on computer hardware hacking and the methods and rationales for this practice. A computer hardware hacker operates in a mode that is the opposite of an academic researcher, the author argues. The author focuses on the hacking work of Andrew Huang while he was a Ph.D. candidate at the Massachusetts Institute of Technology (MIT). Huang worked on taking apart the hardware of Microsoft's original Xbox game device in 2001. His work identified potential security vulnerabilities of the device and gave Microsoft insight into what computer hackers may choose to do with such devices.
A BRIEF HISTORY OF HARDWARE HACKING
Hardware hacking dates back almost 200 years. Charles Babbage's Difference Engine In the early 1800s was a mechanical form of hardware hacking. The method William Crookes used to discover the electron in the mid-i8oos might have been the first form of electronics-related hardware hacking. Hardware hackers have since been involved in the development of wireless telegraphy, vacuum tubes, radio, television, and transistors. Benjamin Franklin, Thomas Edison, Nikola Tesia, and Alexander Graham Bell were all hardware hackers. So were William Hewlett and David Packard and Steve Jobs and Steve Wozniak.
Contrary to how the word hacker is sometimes used to describe criminals breaking into computer systems, a hacker can be defined more simply as someone involved in the exploration of technology. A "hack" in the technology world usually defines a new and novel creation or method of solving a problem, typically in an unorthodox fashion [2-4]. Here, I focus on an idealistic vision of hardware hackers—the good guys—even though some people, corporations, and agencies may use the same techniques for illegal, illegitimate, or unethical purposes, seeking some sort of financial gain or market advantage. Hardware hacking means different things to different people, coming down to personal preferences, as in art or music. Someone can be taught, to a point, to have the hacker mindset and break the mold of conventional thinking, but hacking goes much further. It is a passion, a drive, something that stems from some amount of anti-establishment and anti-authority sentiment coupled with the desire to do things on one's own agenda and with one's own hands. Hardware hacking is the technologists' version of the classic
phrase "Don't judge a book by its cover." Hackers are driven by a variety of motivations:
Cunosit^ and jun. See how things work, scratch the curiosity itch, and have fun experimenting with and modifying products;
Education. Learn by doing;
Improvement and innovation. Build a better mousetrap;
Consumer protection. Ensure a product does what its marketing pitch claims it to do. Often distrustful of marketing or sales literature, hackers want to find out for themselves whether certain claims are true and how they can make a particular product do more; and
Security. Test whether hardware devices are secure, identifying failures or weaknesses. Beyond strengthening the perceived value of a product, it allows users to mitigate the risk of an attack by updating, fixing, or discarding the product.
Most hardware hacks fall into four categories:
Personalizing and customizing. Often called "hotrodding for geeks" it includes modifications, custom skins, and even art projects (such as creating an aquarium out of a vintage computer);
Adding functionality. Making the system or product do something it wasn't intended to do (such as converting an iPod to run Linux or modifying a classic Atari 2600 video game console to support stereo sound and composite video output);
Improving capacity or performance. Enhancing or otherwise upgrading a product (such as expanding the recording capacity of a TiVo box by adding a larger hard drive, modifying a wireless network card to support an external antenna, or overclocking a PC's motherboard);
Defeating protection and security mechanisms. Included are finding "Easter eggs," hidden menus, and backdoors in DVD players or video game consoles or creating a custom cable to unlock the secrets of a cell phone.
Reverse engineering, generally viewed as a subset of hardware hacking, is essentially the art of learning from practical examples and experience. Examining technologies or any kind of product to see how they work is an integral part of the hardware hacking process and is a great way to learn the state of the art. I use reverse engineering to add to my mental toolbox of circuit designs, manufacturing techniques, and printed circuit board layout tricks, all of which improve my knowledge of the product development process.
Reverse engineering and hardware hacking represent continuing education, interconnected with developing new products and technologies.
Tuesday, April 19, 2011
How to make a computer faster... Part. 6
6. Upgrade to Windows 7
If you try all the previous remedies and your computer still isn't as fast as you would like it to be, you may want to consider updating to Windows 7.
Find out if your computer can run Windows 7 using the Upgrade Advisor.
Compare Window 7 editions.
Read a third-party review of Windows 7 by David Pogue of The New York Times.
If the Windows 7 Upgrade Advisor determines that your computer can't run Windows 7 and you still have the need for speed, it might be time for a new computer. There are some great deals on new computers right now:
• Shop for new desktop computers.
• Shop for new laptop computers.
• Shop for netbooks.
If you try all the previous remedies and your computer still isn't as fast as you would like it to be, you may want to consider updating to Windows 7.
Find out if your computer can run Windows 7 using the Upgrade Advisor.
Compare Window 7 editions.
Read a third-party review of Windows 7 by David Pogue of The New York Times.
If the Windows 7 Upgrade Advisor determines that your computer can't run Windows 7 and you still have the need for speed, it might be time for a new computer. There are some great deals on new computers right now:
• Shop for new desktop computers.
• Shop for new laptop computers.
• Shop for netbooks.
How to make a computer faster... Part. 5
5. Learn about ReadyBoost
If you're using Windows 7 or Windows Vista, you can use ReadyBoost to speed up your system. A new concept in adding memory to a system, it allows you to use non-volatile flash memory—like a USB flash drive or a memory card—to improve performance without having to add additional memory.
More info: http://windows.microsoft.com/en-us/windows7/Turn-ReadyBoost-on-or-off-for-a-storage-device
If you're using Windows 7 or Windows Vista, you can use ReadyBoost to speed up your system. A new concept in adding memory to a system, it allows you to use non-volatile flash memory—like a USB flash drive or a memory card—to improve performance without having to add additional memory.
More info: http://windows.microsoft.com/en-us/windows7/Turn-ReadyBoost-on-or-off-for-a-storage-device
How to make a computer faster... Part. 4
4. Detect and repair disk errors
In addition to running Disk Cleanup and Disk Defragmenter to optimize the performance of your computer, you can check the integrity of the files stored on your hard disk by running the Error Checking utility.
As you use your hard drive, it can develop bad sectors. Bad sectors slow down hard disk performance and sometimes make data writing (such as file saving) difficult or even impossible. The Error Checking utility scans the hard drive for bad sectors and scans for file system errors to see whether certain files or folders are misplaced.
If you use your computer daily, you should run this utility once a week to help prevent data loss.
Run the Error Checking utility:Close all open files.
Click Start, and then click Computer.
In the Computer window (My Computer in Windows XP), right-click the hard disk you want to search for bad sectors, and then click Properties.
In the Properties dialog box, click the Tools tab.
Click the Check Now button.
In the Check Disk dialog box (called Error-checking in Windows 7), select the Scan for and attempt recovery of bad sectors check box, and then click Start.
If bad sectors are found, choose to fix them.
Tip: Only select the "Automatically fix file system errors" check box if you think that your disk contains bad sectors.
In addition to running Disk Cleanup and Disk Defragmenter to optimize the performance of your computer, you can check the integrity of the files stored on your hard disk by running the Error Checking utility.
As you use your hard drive, it can develop bad sectors. Bad sectors slow down hard disk performance and sometimes make data writing (such as file saving) difficult or even impossible. The Error Checking utility scans the hard drive for bad sectors and scans for file system errors to see whether certain files or folders are misplaced.
If you use your computer daily, you should run this utility once a week to help prevent data loss.
Run the Error Checking utility:Close all open files.
Click Start, and then click Computer.
In the Computer window (My Computer in Windows XP), right-click the hard disk you want to search for bad sectors, and then click Properties.
In the Properties dialog box, click the Tools tab.
Click the Check Now button.
In the Check Disk dialog box (called Error-checking in Windows 7), select the Scan for and attempt recovery of bad sectors check box, and then click Start.
If bad sectors are found, choose to fix them.
Tip: Only select the "Automatically fix file system errors" check box if you think that your disk contains bad sectors.
How to make a computer faster... Part 3
3. Speed up access to data
Disk fragmentation slows the overall performance of your system. When files are fragmented, the computer must search the hard disk as a file is opened (to piece it back together). The response time can be significantly longer.
Disk Defragmenter (sometimes shortened to Defrag by users) is a Windows utility that consolidates fragmented files and folders on your computer's hard disk so that each occupies a single space on the disk. With your files stored neatly end to end, without fragmentation, reading and writing to the disk speeds up.
When to run Disk Defragmenter
In addition to running Disk Defragmenter at regular intervals (weekly is optimal), there are other times you should run it, too, such as when:
• You add a large number of files.
• Your free disk space totals 15 percent or less.
• You install new programs or a new version of the Windows operating system.
• To use Disk Defragmenter:
Windows 7 usersClick Start, click All Programs, click Accessories, click System Tools, and then click Disk Defragmenter.
In the Disk Defragmenter dialog box, click the drives that you want to defragment, and then click the Analyze disk button. After the disk is analyzed, a dialog box appears, letting you know whether you should defragment the analyzed drives.
Tip: You should analyze a volume before defragmenting it to get an estimate of how long the defragmentation process will take.
To defragment the selected drive or drives, click the Defragment disk button. In the Current status area, under the Progress column, you can monitor the process as it happens. After the defragmentation is complete, Disk Defragmenter displays the results.
To display detailed information about the defragmented disk or partition, click View Report.
To close the View Report dialog box, click Close.
You can also schedule the Disk Defragmenter to run automatically. (Your computer might even be set up this way by default.) Under Schedule, it reads Scheduled defragmentation is turned on and then displays the time of day and frequency of defragmentation. If you want to turn off automatic defragmentation or to change the time or frequency, click Configure schedule (or Turn on Schedule, if it is not currently configured to run automatically). Change the settings, and then click OK.
To close the Disk Defragmenter utility, on the title bar of the window, click the Close button.
Windows Vista usersOpen Disk Defragmenter: Click the Start button, click All Programs, click Accessories, click System Tools, and then click Disk Defragmenter. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
In the Disk Defragmenter dialog box, click the drives that you want to defragment and then click the Analyze disk button. After the disk is analyzed, a dialog box appears letting you know whether you should defragment the analyzed drives.
Tip: You should analyze a volume before defragmenting it to get an estimate of how long the defragmentation process will take.
To defragment the selected drive or drives, click the Defragment disk button. In the Current status area, under the Progress column, you can monitor the process as it happens. After the defragmentation is complete, Disk Defragmenter displays the results.
To display detailed information about the defragmented disk or partition, click View Report.
To close the View Report dialog box, click Close.
You can also schedule the Disk Defragmenter to run automatically. (Your computer might be set up this way by default.) Click Modify schedule....
In the Disk Defragmenter: Modify Schedule dialog box, choose how often, which day, and at what time of day you want defragmentation to occur, and then click OK.
Click OK again.
Windows XP usersClick Start, point to All Programs, point to Accessories, point to System Tools, and then click Disk Defragmenter.
In the Disk Defragmenter dialog box, click the drives that you want to defragment and then click the Analyze button. After the disk is analyzed, a dialog box appears, letting you know whether you should defragment the analyzed drives.
Tip: You should analyze a volume before defragmenting it to get an estimate of how long the defragmentation process will take.
To defragment the selected drive or drives, click the Defragment button. Note: In Windows Vista, there is no graphical user interface to demonstrate the progress—but your hard drive is still being defragmented.
After the defragmentation is complete, Disk Defragmenter displays the results.
To display detailed information about the defragmented disk or partition, click View Report.
To close the View Report dialog box, click Close.
To close the Disk Defragmenter utility, on the title bar of the window, click the Close button.
Running Disk Cleanup and Disk Defragmenter on a regular basis is a proven way to help keep your computer running quickly and efficiently. If you'd like to learn how to schedule these tools and others to run automatically, please read Speed up your PC: Automate your computer maintenance schedule.
Disk fragmentation slows the overall performance of your system. When files are fragmented, the computer must search the hard disk as a file is opened (to piece it back together). The response time can be significantly longer.
Disk Defragmenter (sometimes shortened to Defrag by users) is a Windows utility that consolidates fragmented files and folders on your computer's hard disk so that each occupies a single space on the disk. With your files stored neatly end to end, without fragmentation, reading and writing to the disk speeds up.
When to run Disk Defragmenter
In addition to running Disk Defragmenter at regular intervals (weekly is optimal), there are other times you should run it, too, such as when:
• You add a large number of files.
• Your free disk space totals 15 percent or less.
• You install new programs or a new version of the Windows operating system.
• To use Disk Defragmenter:
Windows 7 usersClick Start, click All Programs, click Accessories, click System Tools, and then click Disk Defragmenter.
In the Disk Defragmenter dialog box, click the drives that you want to defragment, and then click the Analyze disk button. After the disk is analyzed, a dialog box appears, letting you know whether you should defragment the analyzed drives.
Tip: You should analyze a volume before defragmenting it to get an estimate of how long the defragmentation process will take.
To defragment the selected drive or drives, click the Defragment disk button. In the Current status area, under the Progress column, you can monitor the process as it happens. After the defragmentation is complete, Disk Defragmenter displays the results.
To display detailed information about the defragmented disk or partition, click View Report.
To close the View Report dialog box, click Close.
You can also schedule the Disk Defragmenter to run automatically. (Your computer might even be set up this way by default.) Under Schedule, it reads Scheduled defragmentation is turned on and then displays the time of day and frequency of defragmentation. If you want to turn off automatic defragmentation or to change the time or frequency, click Configure schedule (or Turn on Schedule, if it is not currently configured to run automatically). Change the settings, and then click OK.
To close the Disk Defragmenter utility, on the title bar of the window, click the Close button.
Windows Vista usersOpen Disk Defragmenter: Click the Start button, click All Programs, click Accessories, click System Tools, and then click Disk Defragmenter. If you are prompted for an administrator password or confirmation, type the password or provide confirmation.
In the Disk Defragmenter dialog box, click the drives that you want to defragment and then click the Analyze disk button. After the disk is analyzed, a dialog box appears letting you know whether you should defragment the analyzed drives.
Tip: You should analyze a volume before defragmenting it to get an estimate of how long the defragmentation process will take.
To defragment the selected drive or drives, click the Defragment disk button. In the Current status area, under the Progress column, you can monitor the process as it happens. After the defragmentation is complete, Disk Defragmenter displays the results.
To display detailed information about the defragmented disk or partition, click View Report.
To close the View Report dialog box, click Close.
You can also schedule the Disk Defragmenter to run automatically. (Your computer might be set up this way by default.) Click Modify schedule....
In the Disk Defragmenter: Modify Schedule dialog box, choose how often, which day, and at what time of day you want defragmentation to occur, and then click OK.
Click OK again.
Windows XP usersClick Start, point to All Programs, point to Accessories, point to System Tools, and then click Disk Defragmenter.
In the Disk Defragmenter dialog box, click the drives that you want to defragment and then click the Analyze button. After the disk is analyzed, a dialog box appears, letting you know whether you should defragment the analyzed drives.
Tip: You should analyze a volume before defragmenting it to get an estimate of how long the defragmentation process will take.
To defragment the selected drive or drives, click the Defragment button. Note: In Windows Vista, there is no graphical user interface to demonstrate the progress—but your hard drive is still being defragmented.
After the defragmentation is complete, Disk Defragmenter displays the results.
To display detailed information about the defragmented disk or partition, click View Report.
To close the View Report dialog box, click Close.
To close the Disk Defragmenter utility, on the title bar of the window, click the Close button.
Running Disk Cleanup and Disk Defragmenter on a regular basis is a proven way to help keep your computer running quickly and efficiently. If you'd like to learn how to schedule these tools and others to run automatically, please read Speed up your PC: Automate your computer maintenance schedule.
Subscribe to:
Posts (Atom)