 |
Landmark Leadership Conferences for IT Executives
|
||
The IT Blogby Fred F. Farkel, Thursday, January 30th, 2014
“IT as a service” can be a patchwork of “solutions” which ultimately make resource management more of a nightmare than a dream. Preventing that nightmare is where AppSense shines. AppSense solutions are designed to meet the needs of even the most demanding global enterprises. With AppSense, desktops, PCs, applications and devices all become interchangeable building blocks that IT can draw from to build their own optimized “IT as a service” fabric. This includes: traditional PCs, virtual desktops, locally installed applications, virtualized applications, remote application sessions, mobile devices and tablet pcs. In March 2012, AppSense commissioned Forrester Consulting to examine the total economic impact and potential return on investment (ROI) enterprises may realize by deploying the AppSense Management Suite. The purpose of the study was to provide readers with a framework to evaluate the potential financial impact of the User Virtualization Platform on organizations having shared server-based computing environment. For those who are interested in the short, to the point version of the story, Forrester Consulting found that users saw IT operation cost savings,worker productivity cost savings, capital expense cost savings and project-based cost savings associated with application migration. The composite three-year risk-adjusted ROI was 284%, with a “payback” period of merely 5 months. This is precisely the sort of savings that “IT as a service” should provide but often doesn’t. For more details, the complete report is available here to read or download. by Fred F. Farkel, Monday, January 27th, 2014
Guest column by Citadel Information Group Weekend Vulnerability and Patch Report The following software vulnerabilities and updates were announced last week. Citadel Information Group strongly recommends that readers update their computers and take other action as indicated. Important Security Updates Adobe Digital Editions: Adobe has released version 3.0 for Digital Editions to fix a highly critical unpatched vulnerability reported in version 2.0.1. Updates are available through the program or from Adobe’s website. Apple iTunes: Apple has released version 11.1.4 for iTunes. Updates are available through the program or from Apple’s website. Apple Pages: Apple has released version 5.1 for Pages to fix a highly critical vulnerability reported in previous versions. Updates are available through the program or from Apple’s website. Apple Pages for iOS: Apple has released version 2.1 for Pages for iOS to fix a highly critical vulnerability reported in previous versions. Updates are available through Apple’s iTunes or from Apple’s website. Avast: Avast has released version 9.0.2013. Updates are available on Avast’s website. Dropbox: Dropbox has released version 2.6.2 for its file hosting program. Updates are available at Dropbox’s website. [See Citadel’s warning below] Piriform CCleaner: Piriform has released version 4.10.4570 for CCleaner. Download is available from Piriform’s website. Skype: Skype has released version 6.13.0.104. Updates are available on Skype’s website. Current Software Versions Adobe Flash 12.0.0.38 [Windows 7: IE] Adobe Flash 12.0.0.43 [Windows 7: Firefox, Mozilla] Adobe Flash 12.0.0.38 [Windows 8: IE] Adobe Flash 12.0.0.38 [Macintosh OS X: Firefox, Opera, Safari] Adobe Reader 11.0.06 Dropbox 2.6.2 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.] Firefox 26 Google Chrome 32.0.1700.76 Internet Explorer 11.0.9600.16476 [Windows 7: IE] Internet Explorer 11.0.9600.16384 [Windows 8: IE] Java SE 7 Update 51 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have a particular web site that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser — such as Chrome, IE9, Safari, etc — with Java enabled to browse only the sites that require it.] QuickTime 7.7.4 Safari 5.1.7 Safari 7.0.1 [Mac OS X] Skype 6.13.0.104 Newly Announced Unpatched Vulnerabilities None For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel’s website. For Your IT Department Cisco Multiple Products: Secunia reports that Cisco has released many updates for multiple products, including Cisco TelePresence Systems (CTS), Secure Access Control System (ACS), TelePresence Video Communication Server, Video Surveillance Operations Manager, NX-OS, Aggregation Services Routers (ASR) 5000 Series and others. Citrix XenClient XT: Secunia reports that Citrix has released version 3.2 of XenClient XT to fix a weakness and two vulnerabilities in previous versions. If you are responsible for the security of your computer, Citadel’s Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated. If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated. Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer’s computers.
Citadel Information Group publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities. Citadel Information Group … Delivering Information Peace of Mind ® to Business and the Not-for-Profit Community The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. by Fred F. Farkel, Monday, January 27th, 2014
Guest column by Citadel Information Group Cyber Crime Gang Rigged Pumps With Bluetooth Skimmers: Authorities in New York on Tuesday announced the indictment of thirteen men accused of running a multi-million dollar fraud ring that allegedly installed Bluetooth-enabled wireless gas pump skimmers at filling stations throughout the southern United States. KrebsOnSecurity, January 22, 2014 A Sneaky Path Into Target Customers’ Wallets: It was, in essence, a cybercriminal’s dream. For months, an amorphous group of Eastern European hackers had been poking around the networks of major American retailers, searching for loose portals that would take them deep into corporate systems. The New York Times, January 17, 2014 A Closer Look at the Target Malware, Part II: Yesterday’s story about the point-of-sale malware used in the Target attack has prompted a flood of analysis and reporting from antivirus and security vendors about related malware. Buried within those reports are some interesting details that speak to possible actors involved and to the timing and discovery of this breach. KrebsOnSecurity, January 16, 2014 Cyber Warning Bug Exposes IP Cameras, Baby Monitors: A bug in the software that powers a broad array of Webcams, IP surveillance cameras and baby monitors made by Chinese camera giant Foscam allows anyone with access to the device’s Internet address to view live and recorded video footage, KrebsOnSecurity has learned. KrebsOnSecurity, January 23, 2014 DHS Alerts Contractors to Bank Data Theft: A security breach at a Web portal for the U.S. Department of Homeland Security has exposed private documents and some financial information belonging to at least 114 organizations that bid on a contract at the agency last year. KrebsOnSecurity, January 21, 2014 ANDROID VULNERABILITY ENABLES VPN BYPASS: A vulnerability in the Android mobile operating system could allow hackers to write applications that would bypass a secure virtual private network connection and redirect traffic in clear text to an attacker. ThreatPost, January 20, 2014 Cyber Security Management Risk and responsibility in a hyperconnected world: Implications for enterprises: For the world’s economy to get full value from technological innovation, it must have a robust, coordinated approach to cybersecurity. A new report from the World Economic Forum and McKinsey & Company looks at how that could happen. Mckinsey&Company, January 2014 National Cyber Security Obama Stands Fast on Intelligence Gathering but Promises More Oversight: In his speech on Friday the U.S. president made no apologies for the National Security Agency’s work. The government will, however, stop storing citizen phone records. Scientific America, January 20, 2014 Cyber Misc Google pulls browser extensions after complaints: Such extensions are part of a larger business that focuses on installing software add-ons, such as toolbars, on people’s computers when they download some other type of software from the Internet. USA Today, January 20, 2014 The Adventures of a Cybercrime Gumshoe: I was fortunate to spend several hours this past week with two reporters whose work I admire. Both wanted to learn more about my job as an independent investigative reporter. Their stories about my story are below. KrebsOnSecurity, January 18, 2014 Unto the Breach: On Wednesday, a letter landed in my email inbox from Gregg Steinhafel, the chief executive of Target. He wanted me to know that there was a decent likelihood that some of my personal information had been stolen by criminals who had “forced their way into our systems,” as Steinhafel put it, and pulled off one of the biggest data breaches in history. The New York Times, January 17, 2014 Cyber Sunshine Feds Infiltrate, Bust Counterfeit Card Shop: Federal authorities in New Jersey announced a series of arrests and indictments of 14 individuals thought to be connected to an online one-stop shop selling embossed, counterfeit credit cards and holographic overlays. KrebsOnSecurity, January 24, 2014 Cyber Calander Join OWASP Los Angeles, Orange County, San Diego, Santa Barbara, and the Bay Area as we join forces to host AppSec California!: AppSec California is the first of hopefully many annual conferences hosted by all of the California chapters. Join us on the beaches of Santa Monica which is closest to our Los Angeles Chapter. Space is limited to around 200 attendees so be sure to get your ticket before we sell out! AppleSec California, Event Date: January 27-28, 2014 “Lunch Meeting – It Takes the Village to Secure the Village”: Dr. Stan Stahl, President of the Los Angeles Chapter of the Information Systems Security Association and President of Citadel Information Group presents. SOCALAFP, Event Date: February 14, 2014 Cybersecurity Essentials for Business Professionals: Please join us in this free presentation where we will discuss essential issues that every entrepreneur and business professional must know about cybersecurity laws, guidelines, and protocols. This event will be moderated and conducted by Salar Atrizadeh, Esq., principal and founder of the Law Offices of Salar Atrizadeh. Also, Stan Stahl, Ph.D., President of Citadel Information Group and ISSA-LA, Brad Maryman, and Howard Miller will serve as panelists Law Offices of Salar Atrizadeh, Event Date: February 21, 2014 The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. by Fred F. Farkel, Monday, January 20th, 2014
Guest column by Citadel Information Group Cyber Crime A First Look at the Target Intrusion, Malware: Last weekend, Target finally disclosed at least one cause of the massive data breach that exposed personal and financial information on more than 110 million customers: Malicious software that infected point-of-sale systems at Target checkout counters. Today’s post includes new information about the malware apparently used in the attack, according to two sources with knowledge of the matter. KrebsOnSecurity, January 15, 2014 Target confirms malware used on point-of-sale terminals: During an interview with CNBC, retailer’s CEO defends four-day delay in notifying customers of security breach as necessary for the investigation and preparation for consumer reaction. Cnet, January 12, 2014 Yahoo says malware attack farther reaching than thought: The company posts guidelines for Yahoo users worried about infection and says people outside Europe may have been hit. It also says the attacks went on longer than previously reported. CNet, January 11, 2014 Cryptolocker scrambles eight years of data belonging to US town hall: The Cryptolocker ransom Trojan has claimed another victim in small-town America, scrambling eight years-worth of files held by a New Hampshire town authority. Some are believed to be irretrievable. ComputerWorld, January 7, 2014 Cyber Attack Is your refrigerator really part of a massive spam-sending botnet?: Security researchers have published a report that Ars is having a tough time swallowing, despite considerable effort chewing—a botnet of more than 100,000 smart TVs, home networking routers, and other Internet-connected consumer devices that recently took part in sending 750,000 malicious e-mails over a two-week period. ArsTechnica, January 17, 2014 Cyber Privacy The Next Data Privacy Battle May Be Waged Inside Your Car: Cars are becoming smarter than ever, with global positioning systems, Internet connections, data recorders and high-definition cameras. Drivers can barely make a left turn, put on their seatbelts or push 80 miles an hour without their actions somehow, somewhere being tracked or recorded. The New York Times, January 10, 2014 Cyber Warning Java ‘Icefog’ Malware Variant Infects U.S. Businesses: Beware Java-based malware that’s been used to exploit at least three US-based organizations. DarkReading, January 15, 2014 STARBUCKS APP STORES USER INFORMATION, PASSWORDS IN CLEAR TEXT: A vulnerability in Starbucks’ mobile app could be putting coffee drinkers’ information–including their usernames, email addresses and passwords–at risk. ThreatPost, January 15, 2014 Cyber Security Management – Cyber Update ORACLE PATCH UPDATE TAKES ON 36 JAVA VULNERABILITIES: All has been relatively quiet of late on the Java security front, which is in stark contrast to a year ago when Java was the scourge of the Internet. Vulnerabilities in Java were being exploited at an alarming rate in a number of targeted attacks including watering hole attacks against prominent government agencies, manufacturers and activists. ThreatPost, January 15, 2014 Securing the Village LA Is Actively Seeking Cyber Security Experts: As the public-at-large continues to become more subservient to advancing technology, its susceptibility to social media fraud and corporate security breaches has become burdensome. Daily lives and economic solvency are at stake. To the rescue is the near-six-figure cyber security profession, an effective cyber warfare weapon that out-smarts pathological terrorist groups, relentless criminals and even disgruntled employees. [David Lam, Citadel VP Technology Management Services, is quoted] CBS Los Angeles, January 13, 2014 Cyber Research RESEARCHERS FIND BEST TIME FOR HACKERS TO STRIKE: For hackers, timing is key. At least that’s according to a group of University of Michigan based researchers that authored a paper on hacking and how timing could factor into the decisions and decision making processes engaged in by cyber criminals. Digital Trends, January 14, 2014 Cyber Law Calif. senators intro bill to stop state from aiding NSA spying: Two California senators have introduced legislation that would ban state agencies, officials – and even corporations providing services to the state – from assisting the National Security Agency’s sweeping surveillance of citizens. SC Magazine, January 9, 2014 Cyber Misc BitTorrent Creator’s New Software DissidentX Hides Secrets In Plain Sight: Encryption tools help people keep secrets. Bram Cohen has a more subtle ambition: he wants to help people keep secret the act of keeping secrets. Forbes, January 15, 2014 Cell Phones Let Cops Track People For A Thousandth Of The Price, Study Finds: It’s no secret that the ability to track a cell phone has led to a sea change in law enforcement surveillance methods. But now a pair of researchers have actually put a number to the plummeting cost of that covert spying in the modern world: Tracking a cell phone’s location, they found, costs somewhere between 1.9% and .015 % of the price of tailing someone the old fashioned way. Forbes, January 9, 2014 RSA boycott splits security industry on tactic’s effectiveness: Some see protest as justified, others believe it to be impulse reaction to reports of RSA collaboration with NSA. CSO, January 9, 2014 Cyber Calander Join OWASP Los Angeles, Orange County, San Diego, Santa Barbara, and the Bay Area as we join forces to host AppSec California!: AppSec California is the first of hopefully many annual conferences hosted by all of the California chapters. Join us on the beaches of Santa Monica which is closest to our Los Angeles Chapter. Space is limited to around 200 attendees so be sure to get your ticket before we sell out! AppleSec CA 2014, Event Date: January 27-28 The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. by Fred F. Farkel, Monday, January 20th, 2014
Guest column by Citadel Information Group Weekend Vulnerability and Patch Report The following software vulnerabilities and updates were announced last week. Citadel Information Group strongly recommends that readers update their computers and take other action as indicated. Important Security Updates Adobe Acrobat / Reader: Adobe has released updates for both Acrobat and Reader to fix at least three highly critical vulnerabilities reported in previous versions. Updates are available through the programs or from Adobe’s website. Adobe Air: Adobe has released Version 3.9.0.1380 of Adobe Air to fix at least two highly critical vulnerabilities reported in previous versions. Updates are available through the program or from Adobe’s Air Web Site. Adobe Flash Player: Adobe has released updates for its Flash Player. Updates are available through the program or from Adobe’s Flash Web Site. Axantum AxCrypt: Axantum has released version 1.7.3156.0 of AxCrypt. Updates are available from Axantum’s website. Google Chrome: Google has released version 32.0.1700.76 of Chrome for Windows, Mac, Linux and Chrome Frame. Updates are available through the program. Google Chrome for Android: Google has released version 32.0.1700.99 of Chrome for Android. Updates are available through the program. Microsoft Patch Tuesday: Microsoft released several updates addressing at least 6 security vulnerabilities, some of which are highly critical, in Microsoft Office, Word 2013, SharePoint, Windows 7, Server 2008, and more. Updates are available via Windows Update or from Automatic Update. Oracle Java: Oracle has released Java SE 7 Update 51. The update is available through Windows Control Panel or Java’s website. [See Citadel’s recommendation below] Current Software Versions Adobe Flash 12.0.0.38 [Windows 7: IE] Adobe Flash 12.0.0.43 [Windows 7: Firefox, Mozilla] Adobe Flash 12.0.0.38 [Windows 8: IE] Adobe Flash 12.0.0.38 [Macintosh OS X: Firefox, Opera, Safari] Adobe Reader 11.0.06 Dropbox 2.4.11 [Citadel warns against relying on Dropbox security. We recommend files containing sensitive information be independently encrypted with a program like Axcrypt; encryption keys be at least 15 characters long; and the Dropbox password be at least 15 characters long and different from other passwords.] Firefox 26 Google Chrome 32.0.1700.76 Internet Explorer 11.0.9600.16476 [Windows 7: IE] Internet Explorer 11.0.9600.16384 [Windows 8: IE] Java SE 7 Update 51 [Citadel recommends removing or disabling Java from your browser. Java is a major source of cyber criminal exploits. It is not needed for most internet browsing. If you have a particular web site that requires Java, Citadel recommends using a two-browser approach to minimize risk. If you normally browse the Web with Firefox, for example, disable the Java plugin in Firefox and use an alternative browser — such as Chrome, IE9, Safari, etc — with Java enabled to browse only the sites that require it.] QuickTime 7.7.4 Safari 5.1.7 Safari 7.0.1 [Mac OS X] Skype 6.11.0.102 Newly Announced Unpatched Vulnerabilities Netgear DGN2000: Secunia reports an undocumented security issue of Telnet service listening on TCP port 32764 in Netgear’s DGN2000 Wireless Router. No official solution is currently available. For an updated list of previously announced Unpatched Vulnerabilities, please see the resources section of Citadel’s website. For Your IT Department BlackBerry OS: Secunia reports that BlackBerry has released updates to fix 4 highly critical vulnerabilities in BlackBerry 10 OS and BlackBerry PlayBook OS, due to a bundled version of Adobe Flash Player. Update to a fixed version. Cisco Multiple Products: Secunia reports that Cisco has released many updates for multiple products, including Cisco WebEx Meetings, Identity Services Engine (ISE), Secure Access Control System (ACS), Cisco Jabber for Windows, and others. McAfee Vulnerability Manager: Secunia reports that McAfee has re released updates for its Vulnerability Manager to fix vulnerabilities in versions 7.5.5 and prior. Apply hotfix or update to version 7.5.6 when available. Oracle Multiple Products: Secunia reports that Oracle has released many updates for multiple products, including Oracles’s PeopleSoft Enterprise Services Procurement, PeopleSoft Enterprise PeopleTools, PeopleSoft Enterprise HRMS, Demantra Demand Management, AutoVue, Agile PLM for Process, E-Business Suite, iPlanet Web Proxy Server, Hyperion, WebCenter Sites, Hyperion Strategic Finance, Solaris, Solaris Samba, WebCenter Portal and others. VMware ESXi / ESX: Secunia reports that VMware has released updates for ESXi / ESX to fix two Denial of Service Weaknesses. Apply patches. If you are responsible for the security of your computer, Citadel’s Weekend Vulnerability and Patch Report is for you. We strongly urge you to take action to keep your workstation patched and updated. If someone else is responsible for the security of your computer, forward our Weekend Vulnerability and Patch Report to them and follow up to make sure your computer has been patched and updated. Vulnerability management is a key element of cyber security management. Cyber criminals take over user computers by writing computer programs that “exploit” vulnerabilities in operating systems (Windows, Apple OS, etc) and application programs (Adobe Acrobat, Office, Flash, Java, etc). When software companies find a vulnerability, they usually issue an update patch to fix the code running in their customer’s computers.
Citadel Information Group publishes our Weekend Vulnerability and Patch Report to alert readers to some of the week’s important updates and vulnerabilities. Our focus is on software typically found in the small or home office (SOHO) or that users are likely to have on their home computer. The report is not intended to be a thorough listing of updates and vulnerabilities. Citadel Information Group … Delivering Information Peace of Mind ® to Business and the Not-for-Profit Community The IT Summit would like to thank Citadel Information Group for allowing us to provide this information to you. by Fred F. Farkel, Monday, January 20th, 2014
Guest editorial by Stan Stahl, Ph.D. I publish 6 or so essays a year in honor of the Fourth of July, Memorial Day, Thanksgiving, etc. My objective is to write in ways that bring us together around the ideals of America, rather than in ways that separate us. I am proud that readers often tell me they find my essays inspiring, for it means that I have captured that inspiration which is America. My website The Agnostic Patriot provides a platform for my essays, which, as my readers know, are about America’s search for common ground as we the people continually co-create America’s more perfect union. Why the name The Agnostic Patriot? My sole axiom is the Declaration’s self-evident assertion that we are all created equal. On all other matters, I strive to be politically agnostic. America to me is not about “winning;” it is in steering that course of liberty between the tyranny of the King and the tyranny of the mob. Like my essays, The Agnostic Patriot is a work in progress. In addition to holding all of my essays since 2005. I continue to populate a “Favorites” page, containing various writings and links that I find particularly meaningful. I also have a “News & Commentary” page which contain my “Let Freedom Ring” Twitter feeds broken into categories ranging from politics to philosophy. I have recently added a page to hold the writings of my son, Jonathan, as he thanks the veterans of the vietnamese war, one soldier to another. His is a reminder that freedom is never free. This essay begins my 13th year of writing these freedom essays. I wrote my first essay on the Thanksgiving after 9/11, giving thanks to the the fundamental principles of the American dream: freedom, liberty and a civil body politic. I hope you find this essay of interest. If you do, I encourage you to forward this email to your friends and colleagues. If you don’t, please don’t hesitate to unsubscribe. (A link for doing so is located at the bottom of this email.) Cheers – Stan If you want the truth to stand clear before you, never be for or against. – Sent ts’an, c. 700 C. E. _________________________ Martin Luther King Day, 2014
|
| Home | Denver Luncheon, CO 2016 | Seattle, WA 2016 | Los Angeles, CA 2016 | Contact | About | The IT Blog | |||
| Like us on Facebook | Follow us on Twitter | +1 us on Google+ | Connect with us on Linkedin | ||
| The IT Summit | 3300 NW 185th, Suite 77, Portland, OR 97229 | Contact Us | Phone: 503/828-0294 Copyright © 2004-2016 “The IT Summit” / TheITSummit.com – All Rights Reserved. |
|||||
