On May 9, Senator Richard Blumenthal (D-CT), Representative Martin Heinrich (D-NM), and several others filed the Password Protection Act of 2012 (PPA) in the Senate and House. The bill is meant to prevent employers from demanding employees and job applicants into sharing information from their personal social networking accounts.

The Password Protection states:

The Password Protection Act would make it illegal for an employer to compel or coerce access to any online information stored anywhere on the Internet if that information is secured against general public access by the user.

This is accomplished by prohibiting employers from compelling or coercing access to, and subsequently retrieving information from, the online servers where private user information is stored. (These servers are referred to as “protected computers” in the legislation.). This broad approach mirrors the approach of the existing federal anti-hacking statutes and has several key benefits:

1. Builds on Existing Law. The Password Protection Act’s focus on where information is stored, rather than how it is accessed, reflects the approach of the Computer Fraud and Abuse Act, the federal government’s primary anti-hacking tool. This tool has been used for years by federal prosecutors and private individuals and companies to protect the integrity of internet systems against hackers, including protecting online email accounts and Facebook accounts against the stealing of passwords.

2. Technology-Neutral. By focusing on the servers where information is ultimately stored, the Password Protection Act avoids the tricky business of identifying and defining particular types of internet services (e.g., social networking websites, email accounts, networked gaming services, cloud computing services, online storage lockers, etc.).

3. Designed to Adapt to New Internet Innovations. The Internet is constantly changing and evolving, challenging our ability to create privacy protections that can grow alongside the Internet itself. Fortunately, every innovative website, social networking, storage, or communication technology is still ultimately supported by physical computer servers. By focusing on where a person’s private information is stored, instead of how it is accessed, the Password Protection Act ensures that personal, private online information will be protected the eyes of prying employers even as new online technologies emerge.

4. Protects Employer Systems, NOT Employer Actions. The Password Protection Act preserves the rights of employers to control access to their own hardware, as well as any internet software operated on behalf of the employer for work purposes (e.g., third-party sales data software or websites that facilitate collaborative work online). However, the Password Protection Act does not allow employers to access private employee data under any circumstances, even if the employer uses its own computers to access that data.

The Password Protection Act is broad in scope. It doesn’t just apply to Facebook or social networks, but rather to any situation when an employer coerces an employee into providing access to information held on any computer that isn’t owned or controlled by the employer. Even if the employee is looking at a social network on his work computer, the employer still can’t force that employee to disclose a password or grant access, because that would allow the employer to access another computer (that of the social network). This protection extends to email accounts, photo sharing sites, and any location where an employee stores data privately and it is limited to public access.

If you would like, we provide a Free Technical Assessment, this can be beneficial to new and startup companies that are not sure where to start. You can always find our cloud and hosted services in the right column of this page or by simply going to our website at Raven Cloud Computing

I guess Facebook does not have as many friends as it thought. With dismal stock prices from the start, Facebook’s initial stock offering started at $38.00 per share and closed its inaugural day of trading at a disappointing $38.23. Only up 23 cents for the day. Investors and technology industry watchers are closely tracking the Menlo Park, Calif.-based company’s shares. The world’s largest online social network was one of the most anticipated initial public stock offerings ever.

Over the past several months you probably have been hearing it more and more. I am referring to the term BYOD. Have you been wondering what this new technology this is?

Sure looks like a hostile take-over to me. I am referring to all the shenanigans at Yahoo. Fred Amoroso, Yahoo’s new board chairman released a statement saying they are confident that these changes will server the best interest of their shareholders.

As our technology evolves, some things are beginning to take on a life of their own. We already know the Internet population has doubled in the last 5 years to 2.27 billion. Just 5 years ago it stood solid at 1.15  billion. Already 11% of adults own a tablet of some sort, and 77% of them use them daily. Almost half of us (47%) now own a smart phone and 80% of us own a mobile phone. There are 91.4 million smartphones in the USA alone. Android has the highest market share with 46.9% – iPhone has 28.7%.

Last week I spent several hours on the phone with a product vendor discussing a problem with a client’s network and some possible causes and cures. It became abundantly clear during our marathon conversations that the vendor was not well versed at troubleshooting issues on a production environment (a network in use by users). The vendors analysis was limited and they wanted to just start trying different strategies to try to fix the problem, even if that fix broke other things on the network.

Apple is at least a decade behind Microsoft when it comes to dealing with malware attacks and security, and the recent Flashback attack on Macs only highlights the problems facing the systems maker, according to the founder of security software vendor Kaspersky Lab.

In an interview with Computer Business Review at the Info Security 2012 show in London, Eugene Kaspersky, CEO and founder of his namesake company, said Apple will have to change how it responds to attacks like the Flashback malware–which Kaspersky researchers call Flashfake–which infected more than 600,000 Macs worldwide and may still be plaguing users several weeks later.

In addition, as Apple systems become more popular with consumers and businesses alike, Apple will draw more attention from cyber-criminals, and the attacks will become more sophisticated, as was seen with Flashback, he said.

“I think they are 10 years behind Microsoft in terms of security,” Kaspersky told the publication. “For many years, I’ve been saying that from a security point of view, there is no big difference between Mac and Windows. It’s always been possible to develop Mac malware, but this one Flashback was a bit different. For example, it was asking questions about being installed on the system and, using vulnerabilities, it was able to get to the user mode without any alarms.”

The problem facing Apple now is learning to be more responsive to threats, he said. The Flashback malware not only shook the theory of the Mac s invulnerability to malware, but also made Apple the target of harsh criticism for its slow response to the problem. The Flashback malware exploited a flaw in Java that Oracle had patched two months earlier. However, Apple–which doesn’t let third parties update software on Apple systems–didn’t issue its own patch until the first week of April, by which time the number of infected systems had exceeded 600,000.

Researchers at Kaspersky and other security experts strongly criticized Apple, pointing out the systems maker’s history of being months late with updates. With Apple products becoming an increasingly popular target for scammers, the company will have to change how it responds, Eugene Kaspersky said.

“Welcome to Microsoft’s world, Mac,” he said. “It’s full of malware. Apple is now entering the same world as Microsoft has been in for more than 10 years: updates, security patches and so on.”

It will mean Apple will have to be quicker in reacting to threats.

“They will understand very soon that they have the same problems Microsoft had 10 or 12 years ago. They will have to make changes in terms of the cycle of updates and so on and will be forced to invest more into their security audits for the software,” Kaspersky said. “That’s what Microsoft did in the past after so many incidents like Blaster and the more complicated worms that infected millions of computers in a short time. They had to do a lot of work to check the code to find mistakes and vulnerabilities. Now it’s time for Apple to do that .”

If you would like, we provide a Free Technical Assessment, this can be beneficial to new and startup companies that are not sure where to start.

Raven Cloud Computing offers: Cloud Computing | Online File Storage | Hosted Exchange | Cloud Desktops | Cloud Servers |  VOIP |  Support

If your company or business is like every other company in this economy, then your IT staff is thin, real thin. I work with several companies that use to employ five to ten IT staff members, but due to downsizing and reductions in force brought on by the slumping economy, slowing revenues, bad management or a variety of other circumstances, today only employ one of two IT staff members. In every case, the hardware, software and business requirements have not changed. The demand is even higher on these poor remaining staff members and things begin to slip.

As mention above you should make sure you perform hardware and software updates. Plus – your IT staff should regularly check with vendors for updates too. Just don’t rely on Microsoft to push out it’s weekly and monthly patches. Most times, Microsoft does not include many hardware updates, and does not include any third-party software updates in their update process.

So here is a list of the not-so-obvious security risk, when patched and resolved, coupled with the standard patches and updates should make you a much lower security prospect.

Your employees – your own employees are your biggest source of security risks. Sometimes, it is deliberate; often times it is not. Employees have the most access to your assets. We expend a lot of effort worrying about external threats, but all it takes is an employee bringing in a virus from a home PC on a USB drive to nullify all your measures. Disgruntled employees sometimes express their anger by hurting your computer systems. And of course, it is possible for a well-meaning employee to make a major mistake. Good governance, education, setting (and enforcing) policies, and knowing your employees are your best steps to closing the holes.

Common coding mistakes – certain mistakes in programming still get made despite years of warnings and education. Most common are SQL injection and cross-site scripting vulnerabilities. I still see these issues from time to time even in major software packages that you would think are trustworthy (WordPress is a good example). It’s hard to change software once you’ve installed it, so you need to keep these packages up to date even though it is quite a hassle.

Unauthorized machines – I see this all the time, unauthorized computers, servers, switches even routers and firewalls. Someone decides to bring in an old PC and put it on the network to do something your existing infrastructure doesn’t allow them to do. They think that they are being helpful. The best way to keep these rogue machines in line is with rigorous IP address audits and policies and scanning the network to create a list of machines. If machines can’t get IP addresses, they can’t do much harm.

Old “rock solid” servers - we all have them — that server buried deep in the data room that “just won’t quit.” Most times, it’s running some software package that is impossible to migrate to another machine. Sadly, these machines are often major security risks because they typically are no longer getting patches or we fail to patch them out of fear of breaking them. In addition, those older versions of operating systems often come with inherent security holes that no patching can fix. You need to replace these servers one way or the other. The best first step is to visualize them. From there, it is a lot easier to try to update them.

Legacy applications – it’s not just the old servers that are big security risks; it is also the applications running on them, as well as other legacy applications you may have running. These applications would be a lot less problematic if they were current with their patches, but usually they aren’t. All too often, we miss a major version update because the upgrade is so difficult, and then we’re so far behind the ball that it’s impossible to catch up. Sometimes the applications are completely discontinued. It’s painful to say it, but the best thing you can do is find a migration path to a recent version or another package entirely.

Local admins – there are dangers of allowing users to run with escalated privileges. Occasionally businesses end up with users being granted local admin rights inappropriately. This often happens while troubleshooting a problem: We make the user a local admin to see if it fixes a problem and we forget to undo it. Regardless of how it occurs, it is a ticking time bomb for security. Use your central administration tools to make sure that the local admin list gets reset on a regular basis to the proper users and groups.

Incorrect share/file permissions - File permissions are tricky things, and most users are not even aware of how to set them. So what happens? Users create sensitive files in their usual networked location and those files get the default permissions, which are “collaboration friendly” to say the least. The next thing you know, everyone can read the documents, which are supposed to be confidential. Your best weapon is to pre-establish a share and file structure with the correct permissions. For example, give everyone a home directory for personal documents and create shares or directories around roles, projects, and teams with the appropriate permissions. The hard part is then educating them to use the correct locations — but that is much easier than trying to teach them permissions.

Hidden servers within applications – I have seen more and more applications lately that use a local Web server as an administration console. Sometimes, these applications are installed by users without permission. But occasionally, the IT department just does not realize what comes with an application. While these servers can be locked down so that they are not a risk (and with luck, they get installed like that), you need to verify that the applications are secured properly before allowing them to be installed on users’ machines.

VPN clients - some users figure out how to set up VPN access on their personal machines. For a power user, it isn’t too hard to do. But you have no control over that machine, and once it is on the VPN, problems with the unauthorized machine can easily spill over onto the VPN. One thing you can do is audit the VPN systems to see who is connecting from what PCs and compare it to your list of authorized systems. Also, you can put additional firewalls around VPN clients to quarantine them. Finally, there are various systems to ensure that the clients connecting are on a pre-approved list.

Disabled security software - security software often puts up roadblocks to getting work done, so the “logical response” from many users is to find a way to work around it. Power users (especially developers and system administrators) often know how to circumvent security tools. They may also be local administrators because of a technical need, which makes disabling software and changing settings even easier.

It is tough to stay in front of these items. Today’s security threats go way beyond what they use to. Every Acrobat file, for example, is a potential security risk. Start looking for unusual trends, like large amounts of consistent traffic to an IP address and use centralized tools to ensure that settings are at the right levels and are reset periodically. Also, take any unnecessary local administration rights and firewall entire groups onto their own network segment to limit damage if those groups have a legitimate need for lower security.

If you would like, we provide a Free Technical Assessment, this can be beneficial to new and startup companies that are not sure where to start.

Raven Cloud Computing offers: Cloud Computing | Online File Storage | Hosted Exchange | Cloud Desktops | Cloud Servers |  VOIP |  Support

So it Google at it again? Just two days into their launch of Google Drive, an online cloud storage solutions (that competes with our own product).  Google is already facing suspicion as it tries to persuade people to entrust their personal documents, photos and other digital content to the company’s new online storage service.