Awareness training: How much is too much?

Security experts agree that humans are the weakest link in the security chain. Virtually all of them agree that security awareness training can strengthen many of those weaknesses.But how best to do that can generate some debate.Lysa Myers, a security researcher at ESET, summarized in a recent post what she said was a collective message from several presentations at the recent Black Hat conference: While it is possible to train employees to be "hyper-vigilant, it can create more problems than it solves.To read this article in full or to leave a comment, please click here

The best messaging apps with end-to-end encryption

There is a growing consciousness about the desire to keep one’s messages private. Some are concerned about hackers, or worry about the government spying on them, but most people just agree with the general principle that what you say in your chat conversations ought to stay between you and the people you chat with.It’s not a pleasant idea to think that your messages could be archived for perpetuity on a large company’s server or analyzed by some algorithm. The quest for privacy has birthed a whole generation of apps that promise to give you exactly that. Services like Telegram and Signal have turned the phrase “end-to-end encryption” into a popular discussion. We're here to help you figure out what this is all about and which apps to try.To read this article in full or to leave a comment, please click here

Sophos rolls out Intercept X for endpoint protection

Sophos is coming out with Intercept X, its new name for endpoint protection that’s based on technology acquired when it bought SurfRight last year to broaden its endpoint strategy.The product uses behavior-based screening to detect malicious behavior on endpoints rather than signature-based protection that requires constant updating and can lag behind attackers’ efforts to create new versions.The software looks at the behavior of processes, specifically watching for 24 techniques that malware uses as part of attacks, says Dan Schiappa, senior vice president of the Enduser Security Group at Sophos. That boosts the chances of finding zero-day attacks that use a common set of techniques.To read this article in full or to leave a comment, please click here

Sophos rolls out Intercept X for endpoint protection

Sophos is coming out with Intercept X, its new name for endpoint protection that’s based on technology acquired when it bought SurfRight last year to broaden its endpoint strategy.The product uses behavior-based screening to detect malicious behavior on endpoints rather than signature-based protection that requires constant updating and can lag behind attackers’ efforts to create new versions.The software looks at the behavior of processes, specifically watching for 24 techniques that malware uses as part of attacks, says Dan Schiappa, senior vice president of the Enduser Security Group at Sophos. That boosts the chances of finding zero-day attacks that use a common set of techniques.To read this article in full or to leave a comment, please click here

SD-WAN: The MSP Connection

The best messaging apps with end-to-end encryption

There is a growing consciousness about the desire to keep one’s messages private. Some are concerned about hackers, or worry about the government spying on them, but most people just agree with the general principle that what you say in your chat conversations ought to stay between you and the people you chat with.It’s not a pleasant idea to think that your messages could be archived for perpetuity on a large company’s server or analyzed by some algorithm. The quest for privacy has birthed a whole generation of apps that promise to give you exactly that. Services like Telegram and Signal have turned the phrase “end-to-end encryption” into a popular discussion. We're here to help you figure out what this is all about and which apps to try.To read this article in full or to leave a comment, please click here

What the rise of permissive open source licenses means

"If you use any open source software, you have to make the rest of your software open source." That's what former Microsoft CEO Steve Ballmer said back in 2001, and while his statement was never true, it must have spread some FUD (fear, uncertainty and doubt) about free software. Probably that was the intention.This FUD about open source software is mainly about open source licensing. There are many different licenses, some more restrictive (some people use the term "protective") than others. Restrictive licenses such as the GNU General Public License (GPL) use the concept of copyleft, which grants people the right to freely distribute copies and modified versions of a piece of software as long as the same rights are preserved in derivative works. The GPL (v3) is used by open source projects such as bash and GIMP. There's also the Affero GPL, which provides copyleft to software that is offered over a network (for example as a web service.)To read this article in full or to leave a comment, please click here

Flash vs. HTML5: The last stand

Believe it or not, Flash still has an ardent fan club. The once-ubiquitous media player for browsers has taken its lumps, thanks in large part to security issues. However, diehards remain in Flash’s corner in its battle with HTML5, despite the sense that Flash may be on the ropes, as HTML5 continues to close any functionality gaps it might have had with its proprietary predecessor.Occupy HTML5, a Facebook page that pitches itself as “The movement to rid the world of HTML purism,” is one such outlet taking up Flash’s mantle. The page stresses it “is not an anti-HTML5 movement, but rather an opposition to purism, biased supremacy, and corporate bullying.” Flash, Occupy HTML5 says, is mature. “It's supported by all major desktop browsers. It's stable when used properly. If not, it crashes a lot, just like every other technology.” The page, which has more than 700 Likes, was created by ardent Flash advocate Stephane Beladaci, who said recently he has been planning to relaunch the site.To read this article in full or to leave a comment, please click here

Safety of Tesla Autopilot under scrutiny again, this time in China

Tesla Motors is once again facing controversy over the safety of its Autopilot technology for assisting car drivers, this time in connection with the death of the driver in a Model S crash in China.The father of the deceased filed a lawsuit in a Beijing court in July against the car dealer who sold him the car, alleging that his son had turned on the Autopilot feature before he crashed into a vehicle in January in the northeastern province of Hebei, according to reports citing Chinese state broadcaster CCTV.Tesla has said it is unable to determine whether or not Autopilot was engaged at the time of the crash. As a result of the damage caused by the collision, the car was physically incapable of transmitting log data to Tesla servers, wrote spokeswoman Keely Sulprizio late Wednesday.To read this article in full or to leave a comment, please click here

Building a Raspberry Pi-powered Barkometer, Part 3

In the last two parts of the Barkometer, which is my IoT project to prove that my dog is not a barkoholic, I discussed the hardware and my problems with getting a clean recording. It turns out, much to my irritation, that the Sabrent USB 2.0 External 2.1 Surround Sound Adapter was the problem all along. But before I discuss the hardware problems, let me explain how to record sound on a Raspberry Pi …The subsystem of Raspbian that deals with sound is called the Advanced Linux Sound Architecture (ALSA). ALSA is a huge, complex project with support for an incredible number of sound cards and is basically death by features. It handles everything from single channel recording (what I’m trying to do) to generating tones, white noise, and all sorts of test signals, to playback of multi-channel audio. Truly a massive engineering feat.To read this article in full or to leave a comment, please click here

Gmail outage for business users lasted over 12 hours

Gmail service for users of the Google for Work cloud-based productivity suite was down for over 12 hours on Wednesday, apparently affecting users in a number of countries including the U.S. Google reported early Thursday that the problem was resolved for the vast majority of affected customers, and it would be working individually with the rest of them. It said it would provide a more detailed analysis of the incident to customers once its internal investigation is completed. The company first acknowledged the problem on its Apps Status Dashboard at 8:16 a.m. Pacific Time on Wednesday, stating that it is investigating reports of an issue with Gmail. “Based on reports, it affects only Google for Work Gmail users," Google said. Affected users were redirected to a page with 'Service not available, contact your administrator.'To read this article in full or to leave a comment, please click here

Whitebox Switching at LinkedIn with Russ White on Software Gone Wild

When LinkedIn announced their Project Falco I knew exactly what one of my future Software Gone Wild podcasts would be: a chat with Russ White (Mr. CCDE, now network architect @ LinkedIn).

It took us a long while (and then the summer break intervened) but I finally got it published: Episode 62 is waiting for you.

Should I Use L2VPN+MACSEC or L3VPN+GETVPN?

Here are the outlines of an interesting ExpertExpress discussion:

• A global organization wanted to connect data centers across the globe with a new transport backbone.
• All the traffic has to be encrypted.

Should they buy L2VPN and use MACsec on it or L3VPN and use GETVPN on it (considering they already have large DMVPN deployments in each region)?

Hackers are shaping U.S. election coverage with data leaks

Hackers are becoming a major source of political leaks in this year’s presidential race.Case in point: On Tuesday, stolen emails from former secretary of state Colin Powell became headline news after a mysterious site with possible ties to Russian cyber spies gave them to the press. Since then, media outlets have been pointing out juicy details found in the emails. For example, Powell called Clinton “greedy” and her rival Donald Trump a “national disgrace.”The incident has security experts worried that hackers are manipulating U.S. media outlets to influence this year’s election.To read this article in full or to leave a comment, please click here

Hackers are shaping US election coverage with data leaks

Hackers are becoming a major source of political leaks in this year’s presidential race.Case in point: On Tuesday, stolen emails from former secretary of state Colin Powell became headline news after a mysterious site with possible ties to Russian cyber spies gave them to the press. Since then, media outlets have been pointing out juicy details found in the emails. For example, Powell called Clinton “greedy” and her rival Donald Trump a “national disgrace.”The incident has security experts worried that hackers are manipulating U.S. media outlets to influence this year’s election.To read this article in full or to leave a comment, please click here

Hackers are shaping US election coverage with data leaks

Hackers are becoming a major source of political leaks in this year’s presidential race.Case in point: On Tuesday, stolen emails from former secretary of state Colin Powell became headline news after a mysterious site with possible ties to Russian cyber spies gave them to the press. Since then, media outlets have been pointing out juicy details found in the emails. For example, Powell called Clinton “greedy” and her rival Donald Trump a “national disgrace.”The incident has security experts worried that hackers are manipulating U.S. media outlets to influence this year’s election.To read this article in full or to leave a comment, please click here

Self-driving cars won’t make us more productive

Self-driving cars are raising hopes that we’ll get a lot done when we don’t have to drive anymore. According to a University of Michigan study, that’s about as likely as a parent finishing two memos and a big presentation while taking a teen-age learner out to drive.The average U.S. driver spends an hour a day in their car, but the study concluded that for 62 percent of Americans, freeing up that driving time won’t make them any more productive. And the findings suggest riding in a self-driving car may be a white-knuckle nightmare of nerves, car sickness, unsafe seats and flying gadgets.To read this article in full or to leave a comment, please click here

Extreme Networks Snags Zebra’s WLAN Business

How to connect the Dots with cool new smartphone-friendly beacons

A Kickstarter project for glowing Bluetooth beacons designed to make your smartphone more useful has blown past its $20K goal with about a week to go.Iota Labs is building physical Bluetooth 4.0-enabled Dots that use location tracking to put your smartphone notifications into context. For example, stick one in the kitchen to prompt you to check food expiration dates or in your car to automatically open up Waze. Put one in the hallway to let you know -- via its LED color as it senses you being in the area -- if a roommate is home and might need a bit of discretion on your part. Or if you want to stretch this initially consumer-oriented product into a business tool, have one alert you to unread emails from your boss as you step into your office. (See Iota's video pitch below.)To read this article in full or to leave a comment, please click here

Slack. Less Bad Than The Rest.

A topic I complain about with some regularity is my inability to keep up with incoming messages. I’m too busy creating something for someone else to consume to bother trying to keep up. That’s the way of things. If I successfully keep up with all the input, I never achieve useful output.

In this world of message misery, Slack is my friend. I find that Slack is better at managing input than most other forms of communication.

As Slack groups form (I’m in 8 now), it allows me to interact with people in a private or semi-private manner in a way that’s less intrusive than Google Hangouts or an iMessages chat room.

Slack groups are far better for me than e-mail. I have a passionate dislike for e-mail, although I’ve gotten better at managing it with process and tools. E-mail remains useful to me because it’s the lowest common denominator of communications. If nothing else works, then I can probably send the person an e-mail.

At the moment, Slack is the “least worst” way to manage communication for me.

• I can mute as well as tune notifications. I often mute entire channels that do not require real-time interaction. I can also set do not disturb times. I can also Continue reading