Salesforce.com mobile app developers gain security tools

Good Technology has integrated its Dynamics Secure Mobility Platform with Salesforce.com's Mobile SDK to help developers build mobile applications that are more secure and easily managed.

The growing popularity of smartphones and tablets combined with the BYOD (bring-your-own-device) trend presents several challenges to IT departments, including developing mobile applications and then efficiently managing and protecting them. Salesforce.com's Mobile SDK (software development kit) helps with the former and Good's Secure Mobility Platform offers the latter.

The goal with the integration is to make it easier for Salesforce.com developers to build apps compatible with Good's containerization technology, which offers features such as app-level encryption as well as compliance and jailbreak detection. Enterprises can also put in place data loss prevention and automated actions that lock and wipe applications without impacting a user's device or personal data, according to Good.

The Mobile SDK, which is available for Android and iOS, is a key part of Salesforce.com's accelerating mobile push. It lets developers choose between building applications directly for Apple and Google's OSes, web applications or so-called hydrid applications -- which make it possible to embed HTML5 apps inside a native container.

Recently, Salesforce.com announced version 2.0 of the SDK, which added the SmartSync data framework allowing developers to create applications that work with data both off and online.

Good isn't the only mobile management tool vendor that's working with Salesforce. On Tuesday, competitor MobileIron announced Anyware. The hosted enterprise mobility management service lets administrators distribute mobile apps to employees as well as manage their devices from the Salesforce administration console, MobileIron said.

Top 10 Android security tips

There is no question the Android mobile operating system (OS) is a dominant force in the world of smartphones. But it is also the most susceptible to malware, the least secure fresh out of the box and the most fragmented.

If you want to use the OS on tablets or mobiles for business, security will have to be your number one priority. Follow these 10 security tips and Android will become a much more secure and reliable mobile operating system.

1. Disable app downloads from unknown sources

The easiest way to get infected with malware on an Android phone or tablet is to start installing apps from outside the official Google Play app store. In the Settings menu of any standard Android device is a check box that enables and disables installing ‘unofficial’ apps. An Android that keeps itself legit is far safer.

2. Upgrade to Android 3.0 or above

The first version of Android to incorporate file system encryption was Android 3.0, almost three years into the system’s life. Devices that do not use any kind of data encryption are all the more susceptible to damaging data loss.

3. Download an anti-malware app

Now that Android malware and viruses are a widely-recognised part of the smartphone world, there are many solutions to combat them. Most of the big antivirus (AV) companies have their own Android anti-malware apps, including Kaspersky, AVG, Avast and Norton. Recommended free Android AV apps include Lookout (where there is also a premium version available) and TrustGo.

4. Do not connect to unsecured, unknown Wi-Fi networks

An unsecured Wi-FI network can seem like a cheeky goldmine of free internet, but if you’re using an outdated version of Android in particular, it could prove dangerous. Imposter Wi-Fi networks can be used to stage a ‘middleman’ attack, where any inputted data can be intercepted by a third party – including passwords and personal details, such as credit card numbers.

5. Install a remote wipe/lock app

If an Android device is lost or stolen, it is sensible to have a way to wipe or lock it. There are apps available from Google Play that will do just that, reacting to either a command from a web interface or via text. Popular remote wipe and lock apps include Cerberus and Avast Mobile Security.

6. Keep all sensitive data behind an extra encryption layer


Keeping sensitive information logged in a generic note on a phone or tablet is a bad idea. There are plenty of apps that will store information behind a double wall of password protection and encryption. Top picks include mSecure and File Hide Expert.

7. Be aware of SMS threats

Premium SMS threats are partly responsible for the surge in Android malware. The Obad threat, which was brought to light earlier this year, can send premium rate SMS texts, install other malicious apps and execute other code. If there is mysterious activity on a phone bill, check it is not down to this type of attack.

8. Use the Chrome browser

Since Android 4.1 was introduced, phones and tablets have come with the stock Android browser as well as Chrome installed as standard. Chrome is marginally more secure than the stock version, having been subject to fewer publicised insecurities in recent months. It is also likely that Chrome for Android is being more keenly worked on, its pre-installed status marking it out as the future default browser for Android.

9. Put a lock on your lock screen

Simple but necessary, anyone with a concern about Android security should put some lock screen protection on their phone. Virtually all Androids come with optional security measures pre-installed, accessed in the security submenu of settings.

10. Stolen phone? Check out Plan B

Many have done it – had a phone lost or stolen just before planning to buy phone insurance or install a phone tracker. There is one last point of call. Try to install Plan B to the phone from the Google Play website and, if successful, it will automatically send the location of the device to the Gmail account linked to it.

Labels: Purchase Structured Settlements,Mesothelioma Lawyers San Diego,Secured Loan Calculator,Structured Settlement Investments,Endowment Selling,Mesothelioma Patients,Mesothelioma attorney san diego,Austin Texas dwi lawyers,New York Mesothelioma Lawyers,Phoenix dui lawyers

Browser privacy tools still lack bite, security analysts say

Browser vendors continue to implement privacy in a halfhearted way, with Internet Explorer's default use of cookie "do not track" technology being the best of a weak job, a new assessment by NSS Labs has argued.

Currently, the latest versions of all four leading browsers—IE, Firefox, Chrome, and Safari—implement Do not track - but only Internet Explorer 10 installs it switched on by default, NSS Labs' latest Comparative Analysis found.

The cookie-tracking setting can be enabled in the other three, but only by locating an option in a menu setting. The authors are especially critical of Chrome, which requires users to find and expand a nested Advanced Settings tab to enable the feature.

Even Microsoft treats the do not track as a design afterthought, burying the settings where only the most curious non-expert users might chance upon it.

NSS Labs interprets this lack of enthusiasm for the setting as revealing each vendor's "philosophical views on consumer privacy," while accepting that do not track remains ineffective as a privacy control while advertisers remain free to ignore it as they please.

browsers
"Until legislation is passed that will mandate compliance with the user intent of Do not track, the feature will remain a polite request that will be ignored by the advertising industry," write authors Randy Abrams and Jayendra Pathak.

With third-party cookies, Safari and IE are given the thumbs up, with the former blocking all by default, and IE implementing a partial block. Although Firefox and Chrome don't activate this setting by default, Firefox in particular offers granular control over a setting that is vital to automate access to many commonly used sites.

Other privacy features—the ability to control geolocation, private browsing, and tracking protection lists—all fall down to some extent.

Controlling geolocation (the ability for a site to detect a user's country location), all four browsers prompt as required, but in order to disable the setting completely Firefox forces users to access the technically demanding about:config page.

Uniquely, IE9/10 allows Tracking Protection lists from third-party vendors, essentially lists of sites for IE to block third-party cookies automatically unless the setting is overridden by the user.

Overall, then, IE comes out on top for privacy thanks to the relative simplicity of its slider controls and privacy templates, but none of the four are given a ringing endorsement.

It remains unclear to what extent browser privacy and features such as do not track are valued or even understood by users. A YouGov poll from late last year found that consumers valued ease of use more highly than the ability to block cookies, although the same survey admitted that many disliked targeted ads which follow users even when they have left sites.

Do not track has certainly upset some advertisers, with the Digital Advertising Alliance (DAA) recently lobbying a W3C discussion on how to standardize the way that not track should work.

SANS: Is the help desk the forgotten part of enterprise security defense?

A survey of 900 information technology professionals found almost half of enterprise help desks have gaps in security controls and training that could help ward off attacks like social-engineering assaults.

The SANS 2013 Help Desk Security and Privacy Survey published this week indicated the main jobs of help desk agents were to field requests from employees and others related to computer incidents, password-reset requests or personal information. Helpdesk agents "are trained to be friendly and get as many calls completed, resolved or transferred as possible," the survey notes. But a third of the IT professionals responding in the survey acknowledged they had "weak" risk management and security awareness training for their help desk staff, while 5% had "none" and 6.0 "didn't know."

Seventy percent of the survey respondents acknowledged "social engineering" attacks in which someone tries to get sensitive information or passwords from helpdesk agents as a significant risk. Helpdesk agents, who may have access to sensitive corporate resources, tend to be rated on productivity and speed metrics, the survey said, often meaning help desk agents are under pressure to work quickly. And help desks are often understaffed.

"As a result, an agent may ignore or work around compliance or quality requirements by trying too hard to meet the goals for quantity and timeliness," the SANS report states. The report also notes that entry-level-position helpdesk agents aren't particularly well-paid and there's a lot of "churn" in job changes, with annual turnover rates of 30% to 40% being common.

The SANS report said IT professionals related several types of problems they see in their help desk operations, such as personal health information inadvertently ending up in help desk system databases because a customer and help desk agents were e-mailing it back and forth.

In terms of budgeting for security, help desk operations are simply often overlooked, the SANS report said. Almost half did have some kind of training provided directly by managers and supervisors and much less often, automated help desk staff training, whether via internal tools or service providers.

Automation of help desk operations in general remains fairly low. Less than half also said they use some kind of automated user-authentication tools and authorisation tools. The help desk remains "far from the most critical line item on the corporate budget," the SANS report notes. About a quarter of the IT professionals responding to the SANS survey said they took into consideration what it might cost to have a security incident occurring -- such as a user password being compromised -- when establishing the help desk budget, but the majority did not.


"Effective help desks operations are as much a security problem as they are anything else, but it's a problem that falls through many cracks because the risks are hard to quantify and resolve," the SANS survey report concludes.

Security company to release testing tool for SAP mobile access

As SAP invests heavily in mobile, a security testing company will release a tool next month to ensure mobile-accessible SAP systems are not vulnerable to hackers.

Boston-based Onapsis will release a new module for its X1 security suite, a product that performs automated security assessments, penetration testing and compliance audits for SAP’s ERP (enterprise resource planning) software, said Mariano Nunez, Onapsis’ CEO.

The module will focus in part on the SAP Mobile Platform, formerly known as the Sybase Unwired Platform Developer Center, which helps developers build SAP mobile applications for different devices and platforms. It also looks at the NetWeaver Gateway, an SAP server that links devices to back-end systems, Nunez said.

Exposing those back-end systems is complicated, and companies can face a risk of hacking if the systems are misconfigured or do not have up-to-date patches.

“We see that companies may not be paying enough attention to that and forgetting the devices,” Nunez said. “Our empirical experience shows those systems are usually left insecure because of people not applying the latest patches or not following SAP’s best security practices.”

SAP is focused on mobile access, device management and security as more companies embrace bring-your-own-device policies. SAP supports iPhone, Android, and Blackberry devices.

Sanjay Poonen, head of SAP’s mobile division, said at the Sapphire Now conference in May that the company has more than 1,000 people working on mobile-related projects in areas such as retail, banking and consumer package goods.

Last year, SAP reported more than €222 million ($293 million) in license revenue from its mobile-related business, a revenue stream that didn’t exist two and half years prior, Poonen said.

“We think this market is really poised for an even bigger opportunity if you go even beyond devices,” Poonen said. “This world is going to require us to think of mobile security in a whole new way.”
Nunez said companies faces risks if, for example, a CRM (customer relationship management) system is incorrectly configured for access by mobile devices, opening a door for hackers using attack tools for Web services.

X1’s mobile security module looks at what functions and processes are exposed in the back-end systems and not on the mobile application itself, Nunez said. It alerts users to security vulnerabilities and tells users how to fix the issues. The module is scheduled to be released next month, and will be free to X1 subscribers.

Onapsis is also scheduled to present two SAP security workshops at the Black Hat security conference in Las Vegas, which kicks off on July 27. The workshops, which are not product focused, will look at SAP security from an academic perspective, Nunez said. 

Podcast: Key steps to big data security in hospitality

Hospitality is a sector that lends itself to big data analytics. Organisations can draw on multiple sources of customer information from many sources and on many subjects, ranging from room preferences to car hire and restaurant information.

At the same time, organisations may also provide access to systems to external partners, such as suppliers, but will also be required to hold credit card details securely, so big data security is a major concern also.
In this podcast, ComputerWeekly.com storage editor Antony Adshead talks with Vigitrust CEO Mathieu Gorge about big data security in hospitality and the key steps towards achieving it, including how data is classified and secured, as well as important steps to legal and regulatory compliance such as the PCI-DSS regulation.

Gorge: First of all, we should look at the specific challenges the hospitality sector might have with regards to data, and data that it might acquire; not just about its own employees and staff, but about customers and suppliers.

So, looking at customers first, a client of a hotel or restaurant or whatever, there are different types of data that you might acquire. There will be identity information, a passport or identity card, something that will allow a person to identify themselves as having booked a room, for example.

The confidentiality and integrity of the data must be maintained at all times Mathieu Gorge, Vigitrust

Then there’s going to be payment information, and there could be specific types of health information – dietary information or accessibility requirements, for example. You can see that this type of data has a value with regard to security, so the confidentiality and integrity of the data must be maintained at all times.
Then a hospitality organisation might be using a range of suppliers, some of which will need to access specific data. So you have to consider how to manage information that suppliers may gain access to.
Finally, most of the hospitality industry, especially hotels, will use a property management system that might be linked to additional services that the hotel might offer, such as access to wireless internet that might be free if you are a customer with a loyalty card.

So, you can see that the amount and different type of data that a typical hotel will actually deal with is, by nature, big data, so how they collect and classify that data is something that all security people, IT people and compliance people need to be aware of.

Gorge: The hospitality industry, given the nature of the services that it offers, needs to make sure that it classifies the information and data it holds about its customers in such a way that the lines of business that need to have access to it can do so securely and at the right time.

So, let me put that in perspective. In a hotel you will have additional services, like the rooms that people stay in, but also a bar, spa, restaurant, car valet service, car parking, and so each line of business may need access to payment information, but also to where the customer might be from or whether they are part of a loyalty scheme.

So, in terms of how that data is classified and secured, for hotels in particular as well as large chains of restaurants, there are specific challenges in how big data is structured. That’s why we talk about big data in hospitality; it’s all about managing unstructured data, making sure the right lines of business have access to it at the right time.

It’s always the same issue of striking the balance between operational improvements and security Mathieu Gorge, Vigitrust

One of the key challenges with storage for the hospitality industry has to deal with compliance with the Data Protection Act, and particularly compliance with the likes of PCI-DSS. That’s because most of the business relies on the fact that customers will be using credit cards to book in advance and pay when they leave the hotel, but also use that as an identification system when they move from one line of business within the hotel to another.

So, it’s very important that any type of payment data that needs to be stored is stored in compliance with PCI-DSS and that at if any given time the hospitality [organisation] needs to get some identification, like a passport or identity card, this is kept according to the requirements of the Data Protection Act.

Unfortunately, given the current economic climate, some hotels are not dedicating enough time or people to look after making sure that data is stored properly and access restricted on a need-to-know basis.

So, it’s always the same issue [of striking] the balance between operational improvements and security.

Having said that, the specific challenges with regard to data storage and data security in the hospitality
industry shouldn’t be underestimated. There is some good guidance from the Hospitality Networking Group, for example, and a number of LinkedIn groups for the hospitality sector. I’d highly recommend people joined those groups so they can educate themselves to make sure their data is stored properly.

Ransomware targets smaller businesses, security CEO warns

Trending cyber attacks such as ransomware may be typically overlooked by small and midsize businesses, but the CEO of security firm Lumension warns that they are actually in the line of fire.

Pat Clawson
Around the world, ransomware has been proved to be effective in midsized business environments and below, mainly due to the lack of tools available to deal with the attack, said Pat Clawson, chairman and CEO of Lumension, which is based in Scottsdale, Arizona.

"Most corporations have the means to deal with that outright from a technology and people perspective," he said. "However, if it is a ten person business environment, it is going to cost them a lot of money to get the issue resolved."

Clawson admits that it is not uncommon for these smaller businesses to even consider paying the ransom with the hope all of the stolen data returns.

"For that reason, ransomware is more effective when it targets SMBs that do not have the ability to fight it by themselves with technology or people," he said.

The benefit that bigger companies have is access to the necessary tools and manpower to take care of the problem, as well as prevent it from happening in the first place.

"The guys who create the ransomware are also smart enough to know where the money is to be made," Clawson said. "Instead of corporations, they tend to target SMBs and individual people that may fall prey to the attack."

In addition to having the necessary tools to combat ransomware, Clawson said corporations have a culture where staff are more aware of the pitfalls of ransomware, if it manages to get through at all.

"Their technology is already catching the ransomware at the gateway," he said. "However, if something does get through, their ability to undo the ransomware is significantly easier than for a private business or single user on their own."

Microsoft to pay first IE 11 Preview bug bounty to BlueHat security contest finalist

Microsoft has already received several vulnerability reports that qualify for monetary rewards as part of the company’s bug bounty program launched in June for the preview version of Internet Explorer 11.

The recipient of the first IE 11 bounty will be Ivan Fratric, a security researcher who earned second place and $50,000 last year in Microsoft’s BlueHat Prize contest for the development of defensive technologies. Fratric’s entry into the contest was a system called ROPGuard, which can detect and prevent return-oriented programming (ROP) attacks.

According to his LinkedIn profile, Fratric worked as a researcher at the University of Zagreb’s Faculty of Electrical Engineering and Computing until October 2012, when he joined Google as an information security engineer.

“The security community has responded enthusiastically to our new bounty programs, submitting over a dozen issues for us to investigate in just the first two weeks since the programs opened,” said Katie Moussouris, a senior security strategist with Microsoft’s Security Response Center, Wednesday in a blog post. “I personally notified the very first bounty recipient via email today that his submission for the Internet Explorer 11 Preview Bug Bounty is confirmed and validated,” she said, adding that this means “he’s getting paid.”

Moussouris did not disclose the identity of the first bounty recipient in the blog post, but she confirmed Thursday that it’s Fratric in a Twitter message congratulating him.

Other researchers qualified for IE 11 bounties as well and they will be notified soon, Moussouris said in the blog post. Microsoft will create an acknowledgement page to list the researchers who wish to be publicly recognized, she said.

Microsoft announced the IE 11 Preview bug bounty program on June 19, after years of being reluctant to the idea of paying security researchers for reporting vulnerabilities in its products. In the past, the company preferred to encourage the development of active defenses like anti-exploitation techniques that can block entire classes of exploits. The BlueHat Prize contest in 2012, with a prize pool of over $250,000, was intended to promote the development of such defensive technology.

The IE 11 Preview bug bounty program, meanwhile, kicked off on June 26 and will run for 30 days, until July 26. The reported vulnerabilities can qualify for bounties between $500 and $11,000, or even more in particular cases, depending on the gravity of the vulnerability and the quality of the report.

“It’s not about offering the most money, but rather about putting attractive bounties out at times where there are few buyers (if any),” Moussouris said. “For our products, that tends to be during the preview (or beta) period.”

At the end of June, Fratric said on Twitter that he reported a potential memory corruption issue in IE 11 Preview to Microsoft, but it’s not clear if that’s the bug that won him the program’s first bounty.

In addition to the IE 11 Preview bounty program, Microsoft also launched two other programs, one that will reward researchers for finding novel exploitation techniques to circumvent Windows 8.1’s exploit mitigation defenses and the other for developing new ways to block known exploitation techniques.

Researchers warn of “huge” Android security flaw

Security researchers say they have discovered a vulnerability in Android’s security model that could allow attackers to take full control of smartphones running Google's mobile operating system (OS).

The vulnerability allows hackers to modify an app without breaking its cryptographic signature, according to Jeff Forristal, chief technology officer (CTO) at mobile security firm Bluebox.

Android uses cryptographic signatures to determine if the app is legitimate and to verify that the app has not been tampered with or modified.

The ability to bypass this means that hackers could turn any legitimate application into a malicious Trojan, unnoticed by the app store, the phone, or the end user, Forristal wrote in a blog post.

Researchers at Bluebox Labs, who discovered the vulnerability, believe the flaw was introduced with the release of Android 1.6 and could affect up to 900 million devices.

Depending on the type of application, they say a hacker could exploit the vulnerability for anything from data theft to creation of a mobile botnet.

The risk to the enterprise is great, said Forristal, and this risk is compounded by applications developed by the device manufacturers because they are granted special elevated privileges in Android.

“Installation of a Trojan application from the device manufacturer can grant the application full access to Android system and all applications (and their data) currently installed,” he wrote.

This means the application has the ability to read application data on the device such as email, SMS messages and documents, and retrieve all stored account and service passwords.

“It can essentially take over the normal functioning of the phone and control any function thereof,” said Forristal.

The most unsettling concern, he said, is the potential for a hacker to take advantage of the always-on, always-connected, and always-moving nature of these “zombie” mobile devices to create a botnet.

Bluebox disclosed the Android flaw to Google in February, but said it is up to device manufacturers to release firmware updates for mobile devices and up to users to install them.

Bluebox recommends that:

¦ Device owners use extra caution identifying the publisher of the app they want to download.

¦ Enterprises with BYOD implementations should prompt all users to update their devices and highlight the importance of keeping their devices updated.

¦ IT should see this vulnerability as another driver to move beyond just device management to focus on deep device integrity checking and securing corporate data.

Paying bug bounties is a better investment than hiring a security team, study claims

Paying rewards to independent security researchers for finding software problems is a vastly better investment than hiring employees to do the same work, according to researchers from the University of California Berkeley.

Their study looked at vulnerability reward programs (VRPs) run by Google and Mozilla for the Chrome and Firefox web browsers.

Over the last three years, Google has paid $580,000 in rewards, and Mozilla has paid $570,000. In the course of those programs, hundreds of vulnerabilities have been fixed in the widely used products.

The programs are very cost effective. Since a North American developer’s salary will cost a company about $100,000 with a 50 percent overhead, “we see that the cost of either of these VRPs is comparable to the cost of just one member of the browser security team,” the researchers wrote.

Additionally, more eyes on the code meant the VRPs uncovered many more software flaws than just one hired developer could find.

The study provides a sound foundation for reward programs, which are not embraced by all vendors. Adobe Systems and Oracle do not pay for vulnerability information.

Microsoft has traditionally not paid bounties, but did implement a one-off program last month. Through July 26, Microsoft will pay up to $11,000 for bugs in its Internet Explorer 11 browser.

Bug bounties have other advantages, such as by reducing the number of vulnerabilities that are sold to malicious actors who would use the information for criminal activity. The programs also make it harder for hackers to find vulnerabilities, the researchers wrote.

But a key difference between Google’s and Mozilla’s programs may affect their effectiveness.

Mozilla pays a flat $3,000 reward for a vulnerability. Google pays on a sliding scale, which ranges from $500 to $10,000. Google judges vulnerabilities and exploits on factors such as difficulty and impact.

Google’s average payout is just $1,000, but the chance of obtaining a much higher reward appears to provide an incentive for more people to participate in its program, the researchers wrote.

Google’s program, while costing about the same as Mozilla’s, “has identified more than three times as many bugs, is more popular and shows similar participation from repeat and first-time participants.”

“This makes sense with an understanding of incentives in lotteries: the larger the potential prize amount, the more willing participants are to accept a lower expected return, which, for VRPs, means the program can expect more participants,” according to the paper.

Also, browser penetration contests such as “Pwnium” run by Google with rewards up to $150,000 sparks more interest among researchers.

“We believe this sort of ‘gamification’ leads to a higher profile for the Chrome VRP, which may help encourage participation, particularly from researchers interested in wider recognition,” the paper said.

“Accordingly, we recommend Mozilla change their reward structure to a tiered system like that of Chrome,” it said.

Switch to Mac: Security basics

When it comes to your security, the latest versions of Windows and OS X are comparable, but you still have a few key differences and settings to become familiar with.

First, to put your mind at ease: OS X 10.8 is very secure overall. It includes many of the same inherent protections as Windows 8 does, despite being attacked far less frequently. Antiexploitation technologies, firewalls, sandboxing, and other tools are built in, with mostly sensible default settings. Some tools, such as encryption, are easier to run. Apple also includes interesting security features that take advantage of the Mac App Store to further reduce your security risk, depending on how you like to buy your software.

Your biggest switching decision is whether to use antivirus software. Unlike with Windows, antivirus software isn’t a necessity on a Mac, but it may be useful depending on your habits.

Without further ado, here’s a basic guide to your Mac’s built-in security features.

The core principles for safe Internet computing remain the same, whether you use a PC or a Mac. Keep your system up-to-date, be careful what you click on, and be careful about what software you install. While you have many ways to fiddle with the security preferences on your Mac, we’re going to focus on the most important ones and highlight key differences from Windows.

Here are the three panes inside System Preferences for managing most of the security settings.
System Preferences: You manage most security settings through the System Preferences application, located in the Applications folder. (You can also find a shortcut to System Preferences in the Apple menu and, by default, in the Dock.) A quick note: To change security settings, you may need to first click the lock icon in the lower-left corner of the window and enter your password.

Keep current: To stay safe and avoid nasty security problems, we recommend keeping your application software and system software up-to-date. You can choose whether the computer should automatically check for and download such updates in the background by going to System Preferences > Software Update.

All your system software updates come through the Mac App Store. Your Mac prompts you with a system notification when new updates are ready; clicking the notification launches the Mac App Store. You can also see what updates are available at any time by going to the Apple menu and choosing Software Update.

The Mac App Store also offers updates for any Mac apps you may have bought through the store. For third-party apps purchased outside the store, you might have to go to the company’s website to grab updates—many apps, however, will prompt you about available updates when you launch them.

Manage your user accounts: Managing user accounts is similar in the Mac OS and Windows; OS X just has a slightly different organization strategy. Some settings are in the Users & Groups system preference pane, while others are in Security & Privacy.

OS X includes a guest account login by default.
By default, your Mac includes a default guest account; it allows friends and guests to work on your Mac in an empty user account. When your friend is finished and logs out, the account is wiped. You can manage this feature in Users & Groups; to control when passwords are required, however, you have to go to Security & Privacy > General.

You can also enter the Parental Controls preference pane to add specific restrictions to the Guest User account or any other account on your machine.

Add firewall protection: Your Mac’s built-in firewall isn’t quite as robust as the Windows one, as it won’t automatically adjust itself based on the network you are on. This limitation is okay, though, since network attacks aren’t nearly as common as they used to be.

Go to System Preferences > Security & Privacy > Firewall to turn on the firewall; it works similarly to the Windows Firewall by default, blocking incoming connections on a per-application basis. If you want, you can also block all connections under ‘Firewall Options’.

Unlike Windows, your Mac doesn’t include an outbound firewall, but you can always add one if you wish by installing a third-party program such as Objective Development’s Little Snitch.

Built-in antivirus support: Your Mac includes a (very) basic antivirus feature (called XProtect or File Quarantine) that operates in the background to keep you from running into trouble while you’re browsing the Web. It’s similar to—though not as powerful as—Microsoft’s Security Essentials.

Safari, Apple’s built-in Web browser, doesn’t have all the same protections found in the latest version of Internet Explorer, but it still offers several great security options, such as the ability to allow Java—an oft-hacked technology available as a plug-in—only on specific sites. By default, Java isn’t even installed on your Mac, so you can eschew using the plug-in altogether if you prefer.

OS X includes two powerful security features that aren’t available on consumer versions of Windows.

Full hard-drive encryption: Encrypt your entire hard drive (and external hard drives) with FileVault. You can find it by going to System Preferences > Security & Privacy > FileVault. It’s similar to Microsoft’s BitLocker—but that utility is available only in the Windows Enterprise and Ultimate editions, whereas FileVault is available for all OS X users.

FileVault is reliable, and generally it doesn’t affect system performance. It’s ideal for laptops, and it even includes a recovery option that you can use in case you forget your password.

Meet your Gatekeeper: The Gatekeeper feature (go to System Preferences > Security & Privacy > General and look under‘Allow applications downloaded from’) restricts what kind of software you can install on your Mac. By default, you can download and launch software only from the Mac App Store (all of which Apple has prescreened and approved) and from websites of registered third-party developers. You can change these settings to allow downloading and launching software from the Mac App Store and nowhere else, or open up your Mac to software from any location.

Gatekeeper can limit your app installations to just those downloaded from registered developers and the Mac App Store.
Your Mac’s default settings largely reduce the chances that a bad guy will trick you into installing malware. You may be tempted to allow all apps, but we suggest leaving the default setting as is and opening any app that doesn’t qualify (but you know you want to install) by Control-clicking it and choosing Open. By doing so, you tell Gatekeeper that you purposefully want to bypass its security controls when opening this specific app.

The biggest security question we get from people who first switch to a Mac is: “Should I install antivirus?” The answer, for most users, is no—with a few caveats.

If you use Gatekeeper, keep Java disabled, and use an email service—such as Gmail or iCloud—that filters out known malware, the odds of your Mac ever getting infected with malware are minuscule. Switch to Google Chrome, and you further reduce those odds.

Why can you get away with no antivirus software on a Mac? Some antivirus firms say they see 65,000 new Windows malware variants every day, while Macs get a handful or two every year. The numbers are in your favor.

If you still insist on buying antivirus software, however, or if your company requires your computer to run such a utility, you can find a few reputable applications for the Mac, such as Sophos’s free Anti-Virus tool.

Overall, while it may not have as many bells and whistles as you’re used to, your Mac’s security requires much less active effort on your part to maintain than a Windows system does. As a switcher, you can go to bed at night knowing that you just moved to a safer—even if it’s not perfect—neighborhood.

Follow me on Twitter @sajilpl

Cisco fixes serious vulnerabilities in email, Web and content security appliances

Cisco Systems released security patches for its email, Web and content security appliances in order to address vulnerabilities that could allow attackers to execute commands on the underlying OS or disrupt critical processes.

 

The vulnerabilities affect different versions of the Cisco IronPort AsyncOS operating system that's used in the Cisco Content Security Management Appliance, the Cisco Email Security Appliance and the Cisco Web Security Appliance.

 

Releases 7.1 and prior, 7.3, 7.5 and 7.6 of the software in the Cisco Email Security Appliance are affected by three vulnerabilities, one that allows remote attackers to inject and execute commands with elevated privileges through the Web interface and two that could be used to crash the management graphical user interface (GUI) or the IronPort Spam Quarantine service and cause other critical processes to become unresponsive.

 

Exploiting the command injection vulnerability requires authentication via the Web interface with at least a low privilege account, but the denial-of-service vulnerabilities can be exploited remotely without authentication.

 

Users of the 7.1 branch should upgrade to version 7.1.5-016 or later, users of the 7.3 branch should upgrade to version 8.0.0-671 and users of the 7.5 and 7.6 branches should upgrade to 7.6.3-019 or later, Cisco said in a security advisory published Wednesday. Releases in the 8.0 branch are not affected.

 

Branches 7.2 and prior, 7.7, 7.8, 7.9 and 8.0 of the Cisco Content Security Management Appliance software are affected by the same command injection and denial-of-service vulnerabilities as the Cisco Email Security Appliance software.

 

All of the vulnerabilities are patched in versions 7.9.1-102 and 8.0.0-404, Cisco said in a separate advisory. Users of 7.2 and prior, 7.7 and 7.8 branches are advised to upgrade to version 7.9.1-102 or later of the software. The 8.1 versions are not affected.

 

Releases 7.1 and prior, 7.5 and 7.7 of the Cisco Web Security Appliance software are vulnerable to two authenticated command injection vulnerabilities and one management GUI denial-of-service vulnerability. Some of the vulnerabilities are the same as those affecting the Cisco Email Security Appliance software.

 

The software releases that include fixes for all three Cisco Email Security Appliance vulnerabilities are 7.5.1-201 and 7.7.0-602. Users of the 7.1 and prior versions are advised to upgrade to 7.5.1-201 or later.

 

Follow me on Twitter @sajilpl

BlackBerry launches iPhone and Android security platform

Secure Work Space lets users toggle between personal and corporate modes on their devices.

Now a distant fourth (behind even Microsoft) and fading fast on the hardware side, BlackBerry is hoping its acclaimed security software might be its ticket to success -- even if it means supporting rivals' devices.

BlackBerry on Tuesday introduced a new service called "Secure Work Space," which allows enterprise iPhone and Android users to toggle between personal and corporate modes.

Secure Work Space is aimed at giving companies control over the data that flows over their networks, even on a user's personal phone. Corporate email, calendars, contacts and intranets are cordoned off, and IT departments can add or remove other apps from that corporate section without affecting any personal information.

That separation ensures, for example, that users can't copy a message from the corporate profile and paste it into the personal one. Just as crucially, malware infecting the personal side of the phone won't make its way into corporate data.

The setup is similar to BlackBerry Balance, which comes standard on BlackBerry 10 devices.

Related story: You're going to love the BlackBerry Q10 (or hate it)

BlackBerry will provide an update on sales of the Z10 and other BlackBerry 10 smartphones on Friday. Though some analysts are optimistic, no one expects the new line of devices will launch BlackBerry back to the smartphone forefront anytime soon -- or, truthfully, ever.

But if Secure Work Space takes off, it could help BlackBerry (BBRY) regain some of the corporate market that it lost so publicly and painfully.

"Conceptually, it does make sense -- BlackBerry did well securing email, and now they're securing a workspace," said Cowen & Co. analyst Matthew Hoffman.

But as BlackBerry has declined, competitors like Apple (AAPL, Fortune 500), Google (GOOG, Fortune 500) and Microsoft (MSFT, Fortune 500) have worked hard to improve their own security capabilities. Samsung launched its own "Knox" system for the new Galaxy S4, which works much like Secure Work Space.

Still, there's room in the market for a trusted multi-platform solution -- an Oracle (ORCL, Fortune 500) of mobile devices.

Hoffman isn't convinced that BlackBerry will be the only company in the field, but BlackBerry still has the chance to become that trusted solution. Despite all of its troubles on the hardware side, BlackBerry's reputation as a company dedicated to security endures, as CEO Thorsten Heins has made sure to play up the company's history in the space.

A full switch to software would be "messy," though, Hoffman said. "[BlackBerry would] be taking 95% of its revenue, hardware, and saying, that doesn't matter -- now we're going to focus on this 5%. It would be a pretty big corporate transition to become software-only."

BlackBerry dipped a toe into this field back in 2011, when the company launched an experimental product that allows corporate IT staffers to manage multiple mobile devices -- including iOS and Android -- through the same interface. At the time, the company insisted that it wasn't shifting its strategy away from hardware.

Two years later, however, BlackBerry is still struggling on the device side and sorely needs a bright spot. If security software can be successful for BlackBerry, a bit of a strategic shift could be a smart move.

New Norton Mobile Security includes database of 4 million scanned Android apps

Somewhere deep inside Symantec, there’s a humming farm of virtual machines whose sole purpose is to crawl 200-plus Android app stores worldwide, download about 10,000 new apps every day, and scan each and every one. They’re looking not just for malware, but for other annoying, privacy-invading things an Android app could do—oh, like take your phone number and send it along to a third party, or grab your camera pictures or contacts.

SymantecThe Norton Mobile Insights database crawls 200 Android app stores worldwide and downloads about 10,000 new apps every day,

This database of four million scanned Android apps and counting is the foundation of Norton Mobile Insight, the biggest (but not the only) change to the new version of Norton Mobile Security (version 3.4 for iOS/3.5 for Android), announced Wednesday for iOS and Android devices.

 

If a Norton Mobile Security user downloads an app that’s been scanned and logged by the Norton Mobile Insight database, the database will send back information about the security and privacy risks for that app. “Even if the app isn’t malware, we try to shed some light on the apps themselves and report back to them whether the app is potentially annoying,” says Con Mallon, senior director of Norton Product Management at Symantec.

 

Symantec’s Mallon takes a measured view of what makes an Android app annoying. “There’s a lot of apps that do have advertising—not a bad thing in and of itself, but there are poor implementations where ads step over the mark,” says Mallon. “They may be putting start buttons in your home screen, or as you’re exiting an app, you may be served up a web page of advertising. These are annoying and unwanted behaviors.”

SymantecHow annoying and privacy-invading is this Android app? Norton Mobile Insight will tell you.

Norton Mobile Insight focuses on the following eight privacy risks—specifically, things an app might collect from your phone: phone number, personal account details, calendar or call log details, camera pictures, SMS messages, or contact details. “We’re trying to call out what we think is most important to the consumer—behaviors that are most egregious,” says Mallon.

 

Competitors like McAfee Mobile Security can scan apps on the fly and identify potential risks, but Norton Mobile Insight’s database is a feature unique to Norton Mobile Security. “Giving the consumer some more insight into what the apps are doing is where you’ll see us differentiate ourselves going forward,” says Mallon.

 

Symantec has added a few other notable features to the new version of Norton Mobile Security. The Chrome browser in Android will now enjoy the same protection against malicious Web sites as the native Android browser already has. In addition, the antitheft protection has been expanded beyond iOS devices connected to cellular networks to include Wi-Fi-connected iOS devices such as the iPod touch. You can also set up remote "scream" and remote call for your iOS device from the Norton Mobile Security Web portal, to help you locate the device if it's missing.

 

The new version of Norton Mobile Security is available for a $30 yearly subscription that covers up to 10 iOS or Android devices. Norton Mobile Security requires 15MB of storage space on the device. It works on Android phones (version 2.2 or later) that have Google Play Store installed, and iOS devices running version 5.0 or later.

 

 

Technophoria: Data Security Is a Classroom Worry, Too

Edmodo’s free software allows teachers to set up virtual classrooms where they can post homework assignments, give quizzes and use third-party apps to complement lessons. Students can create individual profiles, including their photograph and other details, within their teacher’s class and post comments to a communal class feed.

 

Mr. Porterfield, an engineer at Cisco Systems, examined Edmodo’s data security practices by registering himself on the site as a fictional home-school teacher. As he went about creating imaginary students — complete with cartoon avatars — for his fictitious class, however, he noticed that Edmodo did not encrypt user sessions using a standard encryption protocol called Secure Sockets Layer.

 

That cryptography system, called SSL for short and used by many online banking and e-commerce sites, protects people who log in to sites over an open Wi-Fi network — like the kind offered by many coffee shops — from strangers who might be using snooping software on the same network. (An “https” at the beginning of a URL indicates SSL encryption.)

 

Without that encryption, Mr. Porterfield says, he worried about the potential for a stranger to gain access to student information, and thus hypothetically be able to identify or even contact students.

 

To test this hypothesis, he used a computer on his home Wi-Fi network to log in as an imaginary student; then, using another computer, he installed free security auditing software, called Cookie Cadger, to spy on the student’s online activities. Though the risk of this happening with actual students seemed small — Edmodo and other companies say they have no evidence that this kind of breach has occurred — he contacted his school district about his concerns.

 

“There’s a lot of contextual information you could use to gain trust, to make yourself seem familiar to the child,” he says. “As a parent, that’s the scariest thing.”

 

In response to an inquiry from me last week, Sara Mandel, a spokeswoman for Edmodo, said the service provided “a safe alternative to open, consumer social networking sites” in that students could participate only in groups created by their teachers and because students cannot send private messages on the system.

 

She added that “any school that chooses” had been able to use a completely encrypted version of the site since 2011 and that the company “is working to ensure that all of our users are using an SSL-encrypted version.”

 

SCHOOL administrators and teachers said they liked these online learning systems because they could control the information that students might share.

 

“Kids can’t talk to each other. They can only speak to the group,” says Heather Peretz, a special-education teacher at Great Neck South Middle School in Great Neck, N.Y., who uses Edmodo in her English class. “It helps them learn to be good digital citizens so they are not making inappropriate posts.”

 

But as school districts rush to adopt learning-management systems, some privacy advocates warn that educators may be embracing the bells and whistles before mastering fundamentals like data security and privacy.

 

Although a federal law protecting children’s online privacy requires online services to take reasonable measures to secure personal information — like names and e-mail addresses — collected from children under 13, the law doesn’t specifically require SSL encryption. Yet school districts often issue only general notices about classroom technology, leaving many parents unaware of the practices of the online learning systems their children use. Moreover, schools often require online participation so students can gain access to course assignments or collaborate on projects.

 

“What we are finding with this type of database is that parents are uninformed,” says Khaliah Barnes, a lawyer at the Electronic Privacy Information Center. “Most don’t understand how the technology works.”

 

Online security experts have long warned consumers about unencrypted Web sites that collect personal details. That is because on open Wi-Fi networks, hackers using simple software programs can see and copy the unique code, called a session cookie, that servers issue to authenticate a person who has logged into a Web site. By replicating that cookie, a hacker can acquire the same privileges, like the ability to edit a profile or grade a quiz, of the authenticated user for that session.

 

 

This article has been revised to reflect the following correction:

 

Correction: June 24, 2013

 

An earlier version of this article misstated students’ ability to send private messages under the Edmodo system. Students cannot sent private messages in any circumstance; it is not the case that they can send private messages only in the presence of their teacher.

 

 

Senate Adds Border Security Measure To Immigration Bill

The Senate has taken another step toward approving a sweeping immigration overhaul bill, as the legislation passed an essential test Monday evening. By a vote of 67-27, the chamber voted to include an amendment on border security to the final bill.

The margin of the vote means the measure cannot be the target of a filibuster. The Hill reports:

"Fifteen of the yes votes were Republicans, suggesting supporters could hit the 70-vote threshold they hope to reach in the final vote. It is thought a big, bipartisan vote could put pressure in the GOP-held House, where immigration reform faces dimmer prospects."

Senate records for the bill, titled the Border Security, Economic Opportunity, and Immigration Modernization Act (S.744), show that it has already attracted at least 150 proposed amendments.

Senate Majority Leader Harry Reid, D-Nev., has said he wants the chamber to finish its work on the bill before the July 4 recess.

Leading the votes against the legislation were Senate Minority Leader Mitch McConnell, R-Ky., his deputy, Sen. John Cornyn, R-Tex., along with Sen. Ted Cruz, R-Tex., and Sen. Rob Portman, R-Ohio, who introduced an amendment to the bill Monday aimed at strengthening an electronic verification system for potential employees.

Senate passage on Thursday or Friday would send the issue to the House, where conservative Republicans in the majority oppose citizenship for anyone living in the country illegally.

 

Anyone can master these top online security tips

Concerns about online privacy have reached new heights since reports revealed that the U.S. National Security Agency has been monitoring millions of phone logs and social media accounts as part of several top-secret programs. In light of the revelations, many people are wondering how they can protect themselves from snooping.
I had the opportunity to talk with Steve Santorelli, a security expert at research firm Team Cymru and a former Scotland Yard detective. I asked him to share his own measures for staying as safe as possible while using the Internet.
Several days later, he sent me his tips. First off, nothing will protect you from government surveillance if a service provider agrees to cooperate in the investigation, he said. Those providers could include your ISP or Google.
However, that doesn’t mean you should dismiss safety measures — cybercriminals are a real threat. He recommended a few simple measures to protect your privacy online.
Here are Santorelli’s top nine tips:
1. Software patches
Patch your OS and all your applications, especially your browser and plug-ins such as Java and Flash. “This one step will likely give you 90 percent protection, as infections, which lead to privacy compromise, often rely on exploiting known vulnerabilities in your operating system,” said Santorelli. Set up automatic updates whenever possible.
2. Two-factor authentication
Use two-factor authentication for as many accounts as you can. This means you must provide both a password and a second form of identification, such as a code that’s sent to your phone, to log in to an account. Most of the major free service providers, such as Twitter and Gmail, have enabled this capability.
3. Antivirus
Use antivirus software, and update it regularly. “While it’s only about 30 to 50 percent effective, it’s still well worth doing,” said Santorelli. Many ISPs will give you a license for free. And there are several free apps.
4. Web browsers
Santorelli said that you can stay safe using any of the modern browsers — Internet
Explorer, Safari, Chrome and Firefox — as long as you update them “rigorously.” You should remove plug-ins that can execute code, such as Adobe Flash and Java. This may not be practical in all cases, however. “Most people don’t do this because they find the Internet very boring without these plug-ins,” said Santorelli. You won’t miss much with Java turned off — the only widely used online applications that really need Java these days are Web-conferencing things like GoToMeeting. But many websites still use Flash for displaying video.
5. Scripts
Use a script-blocker plug-in for your browsers, such as the free No Script for Firefox or NotScripts for Chrome. These plug-ins will block many ads and many types of active content, such as pop-ups that occur when you hover over highlighted text and other elements based on JavaScript. This is a popular way for attacks to enter your computer.
6. Firewall
Use a software firewall on your system. Most modern operating systems, such as Windows and Mac OSX, include a built-in firewall, but you may have to enable it.
7. Password control
Do not use the same password for everything. Santorelli recommends using a password-management tool, such as RoboForm Everywhere, to generate different passwords for each of your accounts. At the very least, he said, have separate sets of passwords for different types of accounts: one for banking accounts, one for free email accounts, etc.
8. Mobile-app permissions
“Beware of mobile apps that ask for massive control over your device, far in excess of what could be justified for what the app apparently does,” said Santorelli. For example: Why would a game need access to your photos and contacts? “Remember, if the app is free, that sometimes means that (your information is) the product being sold,” he said.
9. Linked accounts
Beware of online accounts that link to other accounts. Many Twitter apps do this. Once you stop using these apps, they represent a forgotten route into your Twitter account, said Santorelli. “Do a quick check, and you might be surprised how many forgotten apps have access to some of your accounts,” he said. “Delete them.” To see the apps that access your Twitter account, visit twitter.com/settings/applications — the length of the list may astound you.
According to Santorelli, if you protect yourself from the traditional acquisitive criminals, who are using the same tools as folks with less traditional motives, you are going to be as safe as you can be online.
Ogden-based TopTenREVIEWS.com guides consumers by comparing products in the world of technology, including electronics, software and Web services. Have a question for TopTenREVIEWS? Email Leslie Meredith lesliemeredith@technewsdaily.com.