Yes, I said, how’s your insurance?

It’s been twelve years since I’ve been a property and casualty insurance agent but when a client contacted me about replacing or repairing a damaged newly purchased laptop I found that my insurance cap still fit. In short, off site a staff person had somehow damaged the screen on a three week old laptop and my initial response was to contact the manufacturer and see if they would assess the damage and repair or replace the machine. Second, I suggested that she should see what her insurance company would cover for the damage.

I have no intention of going back into the insurance business but this incident got me thinking, my client with this latest purchase now has approximately 20 laptops assigned to various staff persons who work not only from home but also numerous other official and unofficial locations and the fact the only two machines have been damaged in the last 4 years is a miracle. Whether your company has 50 staff members or one, with the large number of laptops and mobile phones in circulation the possibility of damage, loss, or theft is inevitable. Beyond the loss of data and security risks from missing devises is the cost of replacing which is always a financial hit. For large companies this is the cost of doing business but for small companies the replacement of computers, time lost while recovering data and the loss of critical information can be devastating. An insurance policy that replaces the laptop or telephone can help easy that blow.

Not only for laptops, but as a business person when was the last time you reviewed your insurance policies, I’ve made a list of several areas that you should review for the New Year:

  • Warranties: I always purchase at least 3 year warranties and support packages on all servers I install; the primary issue for me is down time. I may be able to fix a certain computer issue but if I can save time then I’m also saving my client money with less aggravation. Personally, since my laptops are my business I initially purchase 3 year warranties as I buy new equipment it reduces the headaches.
  • Business Personal Property: Many of us now work from home either as consultants, Solopreneur, or just telecommuters. What’s covered by your home owners’ policy? Do you need a separate business policy? Not just your laptop but what about printers, furniture, etc. Although some things will be covered by your home owners’ policy, I suggest that you make a list of your business assets and talk with your homeowners/renter policy Insurance agent.
  • Business Liability: Are potential clients coming to your home or office (I’ve deliberately excluded coffee shops!). If they slip and fall are you liable? Is your homeowners/renters’ policy going cover a liability issue for a business meeting? Also, if you work on client property in your home or office, “care, custody, and control”, what is the extent of your responsibility and how you are covered?
  • Errors and Omissions: Whether you are installing networks, creating and maintaining web sites, organizing someone’s office or giving financial advice please check regarding you vulnerability when working with clients whose expectation about the completed project may differ from yours.
  • Loss of Use/loss of wages: This could be a big issue in the event of a major natural disaster or local catastrophe, if you have expectations for FEMA or some governmental agency rescuing you in this scenario, I think this is another item to discuss with your insurance broker. If you are truly doing disaster planning this should be incorporated in how fast you can recover and return to business.

As I said from the beginning, the New Year is a good time to look at how you will do business for the future and disaster planning is more than is your data backed up. Here’s wishing you a happy and prosperous New Year!

Is your wireless naked? Last Post.

You can never be too serious about network security whether it is a wired or wireless network. Brian Posey makes a case in his last wireless security article that wired networks can be more vulnerable than secured wireless networks unless some form of network access control is employed.

On a wired network anyone who plugs into a network jack can have access not only to the internet but also open access to your network. With the ready availability of mobile storage devices (flash drives and pocket hard drives) not only is the copying of sensitive data easy but malware can also be introduced into your system. Initially, this seems like a digression regarding our discussion about wireless security but this is really only a different side of the same coin.

The question is what are you doing to secure your wireless networks? I generally discourage businesses that have high visitor traffic from setting up wireless network or, if visitors need to have wireless access, I set up a separate non-domain (separate addressing scheme and DHCP server) router/access point. On the other hand the accountant or compliance auditor expects to plug into your network as a mere sign of courtesy.

In his final post regarding general wireless network security, Brian Posey outlines some basic concerns regarding wired versus wireless security: http://www.windowsnetworking.com/articles_tutorials/Securing-Wireless-Network-Traffic-Part5.html?printversion.

Is your wireless still naked? #2

In my last wireless post I mentioned that Brian Posey was writing a series on wireless security and rather than duplicate effort I direct you to his latest blog postings on wireless security. Brian reiterates what we discussed in our article about simple security, i.e., most wireless appliances are configured through your web browser and the default user name and passwords are well known and used by everyone. Changing the default password is a simple security step which many techs either don’t configure or forget to configure. The excuses that access to the access point is infrequent and over time passwords may be forgotten only means that the network hasn’t been documented. As to default passwords, as Brian covers in his article,  the following chart is a case in point.

Common Wireless Device Browser Access Defaults
Device

Access Address

User-name

Password

Linksys

http://192.168.1.1/

“blank” or admin

admin

Netgear

http://192.168.0.1 or http://192.168.1

admin

password or 1234

Trendnet

http://192.168.1.1

admin

admin

DLink

http://192.168.0.1

admin

“blank” or admin

Now before you get upset that I’ve given up the farm, just think are you using the default passwords with your wireless access points; are you using the default IP address; did you know that this information is readily available from the manufacturers support site? Take a little time, read Brian’s article, and think about it. Are you going to make any changes?

Is your wireless naked?

Over the years I have always been reluctant to endorse or install wireless networks for clients, but who am I fooling as I set in my neighborhood coffee shop and begin this post? Wireless networking is fact of life for all of us, so let’s be clear that the primary issue with wireless networks is always security. Wireless network security has two major points of vulnerability: 1. Laptop vulnerability in open networks and 2. Securing wireless access points (wireless routers).

Whether your workstation is wired or wireless it can always be a target for hackers or malicious malware (viruses, Trojans, worms, etc.). All networks should have a physical/hardware firewall separating the network computers from the Internet. Depending on the level of sophistication, the firewall can not only provide separate private addresses for the local network, thus separating the local network from internet, but more sophisticated firewalls can also control or limit the type of inbound and outbound traffic. In many coffee shops and open networks there is no access control except network address translation (NAT) to provide private addresses for multiple machines which allows them to access the internet using one internet connection. This is done to accommodate all wireless users that may come in wanting to use the wireless internet.  Some “hot spots” require a web interface logon which may require an additional paid access or some kind of acknowledgment (room number or agreement) which may mean that remote access is better controlled with increased security. In addition, some of these locations may limit remote access Virtual Private Networking (VPN) or remote desktop access (RDP) allowing only web based email or Remote Web Workplace connections. In that case, however, the security is increased.

On the other hand, you are at the local neighborhood coffee shop and what do you do?

Install a personal firewall! The following links provide a list of current personal firewalls including several that are free: http://www.firewallguide.com/software.htm#Top_Picks and http://personal-firewall-software-review.toptenreviews.com/. I don’t make any recommendations because other than intrusion defense the various models work differently. Some are configured automatically (my favorite) while others are more technical; if you don’t know what SMB or ICMP means, work with the more easily managed applications.

As stated earlier, I believe all sites whether office or home should always have a physical firewall in place and wireless routers can also serve that purpose. Note that the range can be varied both in function and cost; recently one of the professional magazines to which I subscribe gave a list of 5 quality WLAN (Wireless Local Access Network) adapters: http://www.channelpro-digital.com/channelpro/201009?folio=20#pg22. Take time to do a little research about the appliance you want to buy; besides being rated for bandwidth speed, I recommend that the appliance have a web interface that you can understand and if you are using virtual private networking to access a site make sure that its firewall can be configurable and that it allows VPN pass through. When I encounter a router that I’m not familiar with, I go to the manufacturer site and look at the user manual and view not only technical specs but also how to configure the router for my clients.

Finding the right wireless adapter/access point is only part of the issue when setting up a wireless network. Almost all of the consumer grade products come ready to go, just plug it in and you can reach the internet. Although this can make life simple, an open network is an invitation to trouble; therefore the next step, configure encrypted wireless access. Did you look at how to configure wireless security when you reviewed the user manual? Use WPA (Wi-Fi Protected Access) encrypted security. We aren’t a how to site but take a look at Brian Posey’s evolving discussion regarding Wi-Fi vulnerabilities and how to secure your home or office network: http://www.windowsnetworking.com/articles_tutorials/Securing-Wireless-Network-Traffic-Part1.html. Wireless networks are a fact of all of our lives but there are risks; please play heads up ball.

Are you really ready for the cloud? (Part 1)

With all of the hype about new tech devices, iPhone, iPad, Android, Kindle, etc; cloud computing hype; social media sites; and the liberal sprinkling of new tech sounding terms, i.e., bandwidth, html, “Are you Tweeting?”-we all wonder where we really fit into the grand scheme of things. As a business person we know that technology is our future and if you don’t have a website you’re not even in the game. On the most simple level, with a computer and high speed internet, and as long as we have email, word processing software (no, they don’t make word processors any more), and maybe a spread sheet, we can compete.

Too often, businesses will make the change to browser-based applications to save money and as an infrastructure focused business we will always support saving our clients’ money. Low costs should not be the guiding principle for making the change to cloud-based solutions if the result is an increased staff learning curve or loss of functionality.

Recently I had a conversation with a colleague about our respective client making decisions about moving to the cloud. Although my colleague views the movement to online services as “faddish”, we agreed that before making the move to any level of cloud services businesses should review why they are making the move and make their expectations clear. The assumption that all problems will be solved with movement to the cloud is absurd but often when displeased with spam, changing backup tapes, or server replacement many business owners make snap decisions.

From my point of view there are two approaches for businesses reviewing whether you are ready for assessing cloud readiness:

  1. Are you an early adopter?
  2. What questions should you ask before you consider a cloud solution?

When we talk to companies about online solutions for collaboration, quite often we meet with resistance because of the unknown.

  1. Fear money and time will be lost trying new solutions that may not work.
  2. Fear of time lost trying to learn new software.
  3. Fear of trying something different.

The resistance to change is natural; and besides “if it ain’t broke don’t fix it”. I understand this attitude but it is also important to realize that technology is not stagnant, nor is your business. When I first start talking to clients about their computer networks, my initial focus is fixing problems, stabilizing and securing the network, and documenting the network physical infrastructure. My next question is “do you need a server?” or “do you need to upgrade your server?” The question is not about technology but about how to solve network, collaboration, or communication problems; how to become more efficient; and how to accommodate business growth. With the current glitter/glimmer about cloud/browser based computing this issue becomes opaque and the choice is not just whether it’s Google or Microsoft Business Productivity Suite (BPOS).

“Do you need a server”? Over the last five years, I’ve provided periodic support to a small consulting company which has grown from the two principles to a staff of 4 with periodic additional consultancy and clerical support. Last November, they called thinking that it was time that they added a server to centralize document sharing, backup, calendar sharing, and increase security. During my network analysis I discovered that they were running several different versions of Microsoft workstation operating systems which would have to be replaced to facilitate a server/client network. The Dell server they were contemplating, when optimized to meet their needs, would cost closer to $2500 rather than the $400 base price advertised on the website plus the cost of my services to set up and configure the new network. After some discussion, they began to explore Microsoft Business Productivity Suite (BPOS) which included hosted Exchange for email and calendar sharing, hosted SharePoint for document storage and versioning, and Office Live Meeting, a bonus for a consulting company, to produce online seminars (Webinars) without staff leaving their office.

“Do you need to upgrade your server? A non-profit client which has numerous sites with 5-10 staff persons at each site was set up with an ill-conceived centralized server to manage their network, antivirus, time keeping software, organizational documents, and three databases. The centralized server was never an adequate solution because of the need for all network traffic to access the centralized server (latency/network traffic slowness). After exploring numerous options and an aborted technology plan, today they are testing Google apps as a solution for email and shared documents. In addition, we began talking about online time keeping; hosted SharePoint or Google for document management, and a hosted SQL (Structured Query Language) database. Although, this process isn’t complete, my client realized that they are in an untenable situation, made more difficult as the warranty is running out for their server and they also have to contemplating replacing 30 workstations. To date their solution has been to move all clients to Google Apps for email which solved their email inconsistency problem. They’ve switched to QuickBooks online to solve the latency (slow) response time for the accounting staff. They are still using the time keeping system on the server although the option to move to an online version is still an option. They still need to resolve the client database issue, but reducing most of the staff issues to web based applications not only allows staff to access email from any computer but reduces the need to currently consider replacing 30 workstations. My suggestion will be to extend the warranty until they resolve the database issue.

“I don’t have time to test new stuff” or “I’ll wait until ‘so and so’ tries it then I’ll see if it will work for me”. Time is an issue for all of us but the question is not if you are going to learn to use new tools but when. If you are moving from Office 2000/2003 to 2007/2010 you will have to consider whether your current computers are compatible as well as needing to learn new ways of working with the software. Business productivity software quite often has the same functions but new ways of implementing or presenting such a function. Learning new tools could be driven by your desire to be “up to date” but better yet consider staff training before any new software is implemented.

These examples were not designed to assuage your fears about change but to suggest that you begin reviewing your business needs and identify pain points which you know you will need to change in the future to be more efficient and reduce costs. It is imperative that you define your specific business needs in terms of your business process, not in the terms of technology. So far we have been talking about online services as an infrastructure solution. There are other considerations, such as, operating expenses must be compared to capital expenses, i.e., customization of specific off the self-applications or databases to meet your specific needs. Online computing may not be for everyone but the changes are coming; where you are in the process?

The Excitement of Uninterrupted Power Supplies: UPS

Summer is a time for lots of construction and road maintenance and my neighborhood is no exception. We were notified that there would be occasional power outages during the times they work on our street and initially, I blew this notice off and quipped, “No problem as long as they give advanced notice of specified times.”

Later a client called and wanted to know what to do when the power in their building was shut off briefly during a construction phase. My answer:  Shut down the server, computers, and other related devices during the power outage. I also noted that if this was to be for an extended period time it is a good idea to inform regular clients of the situation. Last weekend I received UPS, or uninterrupted power supply, failure notices via alerting software from a client with a notice that the server was to be shut down; the server stayed down the rest of the weekend. I informed my client and he went in early Monday morning and restarted the server with no problem and we continued business with no further incidents. Power outages and surges can play havoc with your server, computers and other office devices. This is why I always insist on a UPS (uninterrupted power supply) to provide surge protection and an orderly shutdown of the machine if needed.

Power outages, buildings with inadequate wiring, and lightning can result in significant power surges which can not only damage machines but can cause loss of data. Some people assume that a surge protector with a lot of Joules will suffice. There could be a discussion of how many Joules is adequate but the true advantage of surge protectors is that they are inexpensive. A UPS not only provides surge protection but in the event of a power loss  it also shuts down the computer in an orderly fashion, preventing damage not only to the machine but also the operating system. Many people forget to install the UPS software and connect the UPS to the computer, which doesn’t allow the UPS to perform its alerting or shutdown functions. The significance is to use the UPS for more than just surge protection.

APC, Tripp-Lite and Belkin (surge protection wizard) are major manufacturers of UPS batteries and surge protectors with a variety of 800+ Joules surge protectors for less than $50+. APC also offers a UPS selection tool to assist in determining the right backup battery for your office. APC will also take used batteries as a trade-in toward the purchase of a new battery or UPS.

I know talking about surge protectors and backup batteries is not as exciting as your new 4G smart phone but your computer/server should last longer than your smart phone.

Has your antivirus subscription expired?

Security for computer networks comes in many forms.Often the most troublesome and frequently encountered are malware infections (viruses, worms, Trojans, spyware, etc.). Unfortunately, during my initial meetings with prospective clients I still find workstations with expired antivirus software or no protection at all. Malware, like hard drive failures, can make workstations inoperable but all data can also be lost. Many techs will only work so long on resolving infections before they suggest reformatting the hard drive and reinstalling the operating system. Maybe they are just giving up but if you are being paid by the hour, it is the better part of valor to start from scratch rather than keep charging your customer for a server when you don’t have or know the solution. On the other hand, there are technology firms that focus solely on virus eradication (at all costs) and data recovery, but be prepared to pay the price if you absolutely need your workstation and data intact. This might be a time to lecture about hard drive backups or imaging but that is not a good method for establishing a good working relationship.

In this day and age of growing security needs, the list of old and new malware removal companies is never ending so there is never a reason for a person to be without virus protection. Professionally, I don’t recommend free antivirus solutions (I don’t scold my mother-in-law for using AVG Free Edition) because most free versions of software offer no support or are only limited (restricted) versions. The most popular free antivirus programs are AVG Free Edition, Comodo Internet Security, and Avast Free AntiVirus. One exception to the premise, that free software provides no support or is a restricted version of the paid client, is Microsoft’s Security Essentials, http://www.microsoft.com/security_essentials/. Microsoft offers this antivirus client for standalone computers with support and the promise of offering a good stable product; if you are looking for an antivirus client this might be worth a try. If you are looking for these and other free or trial antivirus and other downloadable utilities, I suggest becoming familiar with CNET’s Download.com which offers a vast array of spyware free/trial utilities to try. In addition, CNET offers several good spyware removal tools including: Malwarebytes Anti-Malware, Spybot Search & Destroy, Ad-Aware Free Anti-Malware, and SuperAntispyware Free Edition.

Last note: Often, I’m asked to define the difference from viruses, spyware, Trojans, and other malware. I don’t always make a true distinction between the various types of malware other than, “Do I have a tool to remove it quickly to minimize client down time?” Sophos has published a paper, “A to Z of Computer Security Threats”, which gives a good definition of the various malware types which you may find interesting. For your convenience, we have posted the PDF file on our SkyDrive site for you to download. In addition, I’ve also included Trend Micro’s white paper on understanding and protecting against Fake (hoax) Antivirus infections.

Security: When was the last time you updated your software?

As SMB network system administrators we tend to focus on client “pain points”, i.e., “When did you realize that you needed help?” Was it when your hard drive failed and all data was lost? Did a workstation become infected with a virus or malware which prevented your staff from using the Internet? Or maybe you couldn’t get the computers in your office to talk to each other. We promote network maintenance because it is the best approach to avoid many common small business pain points. We try to seriously to talk business owners out of the “break fix” mode of thinking about their networks because in the long run it is more costly and is not an economical means for planning for the future. Besides, if I have to brow-beat clients about the most critical backbone of their business neither of us are winners. Trying to get by on the cheap is just another quick sale; which is not the basis for a lasting relationship. I want to be the trusted adviser for the technical issues related to your business network. For me trust is the first step in developing a secure computer network.

The next step for maintaining a secure network is keeping the operating system and all installed software up to date. Yes, even MACs need to get updated periodically. I know this sounds like a simple no brainer, especially since both Windows and MACs can update critical security patches automatically. Do you know how to manually update your operating system? I periodically manually update workstations (and always manually update servers) because there are always other types of updates available besides security updates; specifically, hardware drivers or additional product functionality can be included in basic system updates. Most of us have several other programs installed on our workstations, including web browsers (Firefox, Chrome, Safari, Opera, etc.); image/photo editing software (Photoshop, Fireworks, Gimp, Pixelmator, etc.); accounting  software (such as QuickBooks, Quicken, PeachTree, etc.); database software (FileMaker and Access); and customer/donor management software (Maximizer, ACT, Goldmine, and Microsoft CRM) and of course antivirus software (Norton, TrendMicro, McAfee, Sophos, Panda, etc.) that are useless if not weekly updated and renewed. Most of today’s software has some form of automated process for updates (either periodic updating or user notice to complete update); you should make yourself familiar with this process for all of your critical software. I was recently made aware of an Adobe Flash security flaw, http://news.cnet.com/8301-1009_3-20006893-83.html and http://www.adobe.com/support/security/advisories/apsa10-01.html: the primary issue about this update is that it affects all major operating systems, Windows, MAC, and Linux. How many times have you blown off that annoying Adobe Flash update notice? To me this drives home the point that we are all vulnerable to some degree. I don’t expect you to become a security expert but timely updating can help increase the security of your workstation and network.

Whose Network is it anyway? Notes for business owners.

It is a good practice for business owners to outsource technical support to keep their minds focused on their primary responsibilities. Outsourcing saves not only time and money but also provides valuable expertise not necessarily available in-house… so good technology support should be your trusted technology advisor.

Every business owner should take the time to understand the fundamentals of his/her computer network; after all, whose network is it anyway?

1. Know your passwords: Passwords are the first line of defense against external and internal intrusion into your computers or network, and a lot has been written regarding the security aspects of using passwords.  Passwords to computers, servers, and network devices are the keys to your critical business information and the security of your network but if your office manager becomes sick or leaves, do you still have access to your QuickBooks database, client list, inventory list, pending projects, etc? Who knows this information?  Your office manager? Your tech support? Do you?  The time spent discovering the password to the accountant’s workstation or finding device information for a new technical support person is money wasted. You should make it your business to know all of the passwords to access critical information and devices on your network.

2.    How to properly start and restart your server: I received a call several weeks ago from a client requesting the password to restart a server that had shut down after the building lost power. I gave him the password but suggested that to turn on the server he needed only to push the button.  A lot of network administrators don’t like the idea of someone on site having administrative access to the server but they can’t be available all of the time, sometimes starting or restarting a server or workstation is the solution to a problem. Do you know how to safely shutdown, restart, or start your server?  This can save you time and money.

3. Add or disable a user: When that disgruntled employee walks off the job, how quickly can you disable that person’s user account and deny him/her access to your network?  If you have to call your tech support person to do this task, you are not only wasting money but you’re compromising the security of your network.  The same holds true for new employees.  Add them as you hire them to allow access to your network. Your tech support can make sure they have the correct security permissions after you make your call.

4. How to change a password: As that disgruntled worker walks out the door, how quickly can you change the password to your server?  Computer passwords should be changed frequently to increase the security of your network.  When was the last time you changed your password? Do you know how to change your password?

5. How to check to make sure your backup is running: You bought a new external hard drive and pushed the button to backup your computer and/or server.  Now you can rest.  How do you know that your backup is running properly?  Is there a backup log or report?  Are you checking that report daily to make sure that backups are running as scheduled? Is there a pattern of repeatedly missed backups?

6. How to restore a file from backup: OK, so now your backups are running daily but what happens if you need to restore a file?  Being able to quickly restore an accidentally deleted file or folder saves you time and money; plus ‘test restores’ should be a standard part of network maintenance to ensure that the backup is working beyond reviewing log files.

7. How to check if your antivirus is up to date: Not only should virus scans run on a regular schedule but business owners should know more than when the subscription is due. They should also know if the virus definitions are up to date.

8. How to run a virus scan: In addition, business owners and staff should know how to run a virus scan.  This is particularly true for laptops. Increased mobility also means increased responsibility.  If scans are scheduled to run at 3 am, it does no good if your laptop is shut down or asleep.  Worse still is only running a scan when you suspect a file might be infected.

9. Is your system security up to date? Are you only relying on MS updates?: Updates are at the core of the security for your system (computer); antivirus and other applications build on this core. At first, many complained about Windows needing update patches, so Microsoft automated the critical level of this process; then people assumed that this would take care of the process.  Although critical updates are automatically installed, there are other updates, including Office 2003/2007 application updates, driver updates, and other options that are not part of the critical update process. I have a policy of manually updating servers to control what and when updates are installed.

10. Could you start over again if you had to?:
Starting again is a little more than just having a plan; it is also an attitude.  There are at least three components in planning that help with this attitude:

  • Do you have up to date network documentation for your existing site?
  • Does your tech planning for the future and/or disasters include a budget?
  • Does your recovery plan include where to start first? Who to call?

As business owners, we are always working to maintain our foothold while looking for that next step up. I don’t expect small business owners to be technology mavens but I do think that they should have a good functional understanding of their network.

Outsourced IT support may be the solution for your continued maintenance and growth but the final decisions are yours.  With that in mind you should always keep your hand in maintaining a functional understanding of how your investment is protected.  Because, as we come full circle, whose network is it anyway?

Scamville – The Pitfalls of Social Networking

While Facebook can be an excellent tool for networking and expanding business, there’s also a dark side to the many applications offered via the social networking site. Michael Arrington of Tech Crunch explains the possible pitfalls while using applications via Facebook, and details some ways companies use the information garnered from games and quizzes to sell your information: Scamville.