Friday, October 29, 2010

Nothing is Private on Open Wi-Fi

It’s a familiar enough scene. You’re in a coffee house, at the airport, or in the library – places where everyone connects without thinking twice. But, if you’re using an unencrypted connection to check a client, read an email or do any Web activity that requires a login, you might as well have spotlights and a camera on you.

Well … you ask, what if I’m just surfing competitor sites? Nothing to lose, right? Wrong! Some simple wireless packet analyzer software nearby could glean competitive intelligence based solely on the sites that you visit and any instant messaging, along with personal e-mail. A stranger could be reading your messages before you are, and you may never know it.

Add to that, there is a new Firefox extension called Firesheep that claims you can highjack a persons Amazon, Facebook, Twitter or Windows Live account over an open Wi-Fi connection. The extension is also customizable, allowing a hacker to target other Websites not listed by Firesheep.

What’s a business to do?

It’s imperative that you keep your information safe. Try using a Virtual Private Network (VPN) client to create a secure means of communicating to your office. It will prevent Firesheep from stealing any data passing between your computer and the router since all communications will be encrypted.

A VPN is a secure method of accessing company resources (Intranet, e-mail, databases). The VPN connection is made between the mobile computer and the company’s office. This connection is encrypted not just over the wireless, but over the whole Internet. Some VPNs may seem slow, but security makes it worthwhile. Also, VPN bypasses Internet restrictions imposed by some countries – a boon to business travelers in China or Egypt.

Many websites will use encryption, similar to a VPN. When browsing the web you will sometimes see https (note the “s,” it stands for “secure”) in the website’s address -- this means that what you are seeing from the site, and sending to the site, is encrypted. This is done to prevent anyone that is listening in on your wireless or internet traffic from reading the data, and getting your information.

Call Brian at Dataccount (212.595.1044, x 105) to discuss VPN, or other methods of protecting your valuable information while working on the road.

For more information on Firesheep: http://en.wikipedia.org/wiki/Firesheep

Labels: , , , , , , ,


posted by Dataccount Inc. @ 2:10 PM   25 Comments




Tuesday, July 20, 2010

Data Recovery: What? How? And Why!

Last month we discussed some of the more common causes of disaster and spoke briefly about disaster recovery. If and when an IT disaster occurs it can be one of the most crippling experiences a business can go through. Not only will the down time cost your company money every second the IT infrastructure is not up and running, but you may have lost irreplaceable data.

Data is not an abstraction. It is actually the nuts and bolts of any business operation. This can include, but is not limited to: inventory, payroll, tax and accounting information, project management, Human Resources databases, sales and orders, deliveries and a variety of client information. Can you afford to lose any of this vital information in the current economic climate?

There are numerous causes to an IT disaster and subsequent data loss/recovery: excessive heat, physical damage, wear-and-tear on moving parts, system errors, power loss, corrupt file systems, overwritten data, software crash, vendor bankruptcy, natural disaster, theft, hacking, sabotage , worm, and viruses. But where and how the threat appears doesn’t matter. What does matter is how can you turn a major disaster into a small speed bump on the path to business growth?

Disaster Recovery Planning has roughly seven tiers of solutions for data recovery. Some of these tiers are not mutually exclusive and can be used in conjunction with capabilities from higher and lower tiers to produce the right solution for a company depending on time, budget, and importance of electronic data in day-to-day operations.

All these solutions focus on the two most critical factors for a business: recovery point and recovery time. This is to say, the maximum acceptable level of down time allowable, and the amount of information at risk that has not been backed up yet.

Tiers 0-4: These are basic solutions that tend to be cost effective for many businesses but do not provide the quickest or most complete solutions.

The first tier (Tier Zero) is very simple-- you have no business continuity plan. And this is the last place you want to be if your business relies on any type of stored data (which nearly all businesses do). There is no information backed up elsewhere, no back up hardware in place and no contingency plan.

Tier 1: Data backup with no hot site. This is a hard copy backup physically taken off site. This is time consuming without proper training and experience to create backups daily, but it can easily be stepped up to Tier 2. Recovery is only as good as the last system backup. You will lose both time and data.

Tier 2: Data backup with a hot site. This is essentially the same thing as Tier 1 but with hardware at an alternative location to continue running the same amount of data loss as Tier 1, but quicker time to back to normal.

Tier 3: Electronic Vaulting takes advantage of cloud computing and high-speed communications. Instead of physically removing hard drives and data, it is securely transmitted over the internet. This brings recovery time down to hours rather than days. Also, data loss is minimized. Back Up My Info! Specializes in this type of data backup and is one of the most secure, reliable and cost effective ways for a business to protect their business-critical information. This is the lowest tier solution that does not require continuous physical removal of back up tapes and drives.

Tier 4: Point-in-time copies is a full picture at a given point in time of your server. This provides data recovery of all the underlying information systems and applications at given points in time the snapshot is taken. Combining an electronic vaulting solution with point in time copies of your full system are usually meet the needs of many small-to-medium sized businesses. Paragon Software provides top of the line service for point-in-time copies to Dataccount clients. Paragon’s solution is excellent for getting the onsite server up and running as quickly as possible.

Tiers: 5-7: These are advanced tiers for companies with large amounts of mission-critical business processes tied to IT. For these tiers the cost of back up must be closely examined versus the cost of possibly going down for a few hours or days.

Tier 5: Transaction integrity: Systems that keep transaction integrity intact are vital to businesses with large order-taking and processing functions. Transaction integrity requires an off-site machine running a live parallel connection recording each change to the system entered. With a parallel server set up minimal data loss occurs, and time to recovery is usually shortened to under a day. The parallel system goes live when the primary fails.

Tier 6: Zero/near-zero Data loss:. On this top tier of data recovery systems, recovery point and recovery time are very close to the time of the disaster. A near-zero data loss solution will normally incorporate disk mirroring hardware, based on RAID or via network to remote location providing instantaneous recovery while allowing for emergency restart at off-site. One of the major benefits of this type of solution is that it is automated with little-or-no human intervention required.

Tier 7: This tier is very close in concept to Tier 6, instantaneous recovery, with zero down time, fully automated and customized. While this is the most protected form of back up, it is extremely expensive to maintain and the cost needs to be justified as an integral part of your business and business continuity. Example: Google

A business continuity plan addressing how to deal with a disaster is a must if your business depends on any type of electronically stored information. The best way to determine the level of protection your business needs is by analyzing the difference between time down (recovery point and recovery time) and the expenditures while the data and infrastructure is recovered.

Cost: what is the cost of the recovery point and the recovery time? What is the value of the data and amount of time that resorting the data worth? Consider the costs of: continuing operations without the data (which may not be possible), recreating the data, and notifying users in the event of a compromise. Remember, every second that data loss is preventing your business from running is time and money spent while losing revenue.

Dataccount works closely with some outstanding vendors to manage our clients’ potential for disaster and to make sure that operations are up and running as quickly as desired for our clients. We recommend BUMI- Back Up My Info! for data protection and Paragon for system restore.

If you are in the bottom tiers of planning for data recovery to save money, the real costs may come later when it has to be recovered. Planning ahead is the best defense for catastrophic business loss.

Labels: , , , , , , , , , ,


posted by Dataccount Inc. @ 10:02 AM   51 Comments




Thursday, June 10, 2010

Disaster: "When Bad Things Happen to Good Information Technology"

We all see what happens when people and organizations are not prepared for disaster. Whether the disaster is natural (hurricanes) or man-made (oil spills) there is one disaster we will all experience to some degree in our own lifetime: massive technology failure. It can be as simple as your smart phone and personal computer acting up or breaking down on the same day or as extensive as a company’s entire systems and infrastructure critically failing.

The chance of a disaster on any given day is miniscule, but over time the individual chances continue to mount. Without a plan in place, things can quickly evolve into a true nightmare. Disasters can, and do, happen, so it doesn’t pay to be unprepared. Too often organizations that believe "this is too costly and can wait for a better time to be addressed" find that the real costs lie in disaster recovery, and not prevention.

Since disaster can come from all angles, what can we do to prevent it and keep business operating as usual? What would be the Business Impact if any (or all) parts of your IT infrastructure experienced a disaster?

While a disaster can never be predicted as to when it will happen, there are several warning signs that indicate you are at risk.

Aging Equipment: When equipment starts to become outdated (either due to age or the advent of more advanced hardware) it will be more prone to a variety of issues occurring with the worst end of the spectrum being dead equipment. Aging equipment also incurs more expenses by needing increased servicing. In cases of extremely old equipment, your technology may have aged into a legacy category. Think about your IT hardware like a car but with a shorter life span. If it is properly maintained the life can be extended but once it has reached a certain age (4-to-6 years) the costs of continually servicing the machine will start to out strip the benefit of keeping it.

Type and Frequency of Backup: There are roughly 7 tiers of back up types, ranging from absolutely nothing in place to pricy automated recovery. Depending on how mission-critical time and data recovery is to your business, you can determine which tier is most appropriate. So – ask yourself if your back up a disk image? Disk mirroring? Parallel server(s)? And act accordingly.

Insufficient Resources: If you are running low on memory for your servers or do not have back up servers, either on-site, off-site or virtually, your risk of a crash and longer recovery time is exponentially higher. Having a Business Continuity Plan and a Disaster Recovery Plan for your company will save you time and money in the long run!

Wrong User Permissions: This is one of the most easily avoidable and one of the most dangerous mistakes out there. An employee with unlimited permissions can inadvertently or maliciously access and change critical settings. This can also lead to improper data editing and deletion. Consider what would happen if every employee had access and was able to edit payroll and accounting information? It is the type of disaster that has ruined many small businesses.
Improper Maintenance: Just like anything man-made, your IT infrastructure needs to be regularly serviced to maintain optimal performance. Minor problems that do not shut down business operations and go unnoticed or ignored can quickly snowball into a major disaster. Every so often you have a car tuned-up to increase its lifespan; computer hardware is exactly the same.

Security: This contains two main components: Firewall & Anti-Virus. Many products exist that will fill the majority of needs for the average business. Choosing the proper one should be aligned specifically to organizational needs and risks. Nearly everyone has antivirus software, but is it updated and is it protecting what you think it is protecting? Who and what is your firewall letting in? If you don’t know the answer to these questions, you probably need a security upgrade.

Plan:

Do you have a DRP (Disaster Recovery Plan) in place? Does it cover all applications, data, hardware, communications/networking, and other IT infrastructure?
If not, one can be created after having a Business Continuity Plan Asset Assessment. This will detail what is most critical for your company and the best approach to protect assets between necessity and cost.

Most plans will have several steps involved mitigation measures including: preventive, detective, and corrective measures and monitoring at all phases. Many organizations wait until costly and time consuming corrective measures need to be taken.

After creating a plan, it needs to be maintained and updated as new hardware and software become integrated to the company.

But the best way to face a possible disaster is to follow the old Boy Scout motto: “Always be prepared”





.

Labels: , , , , , , , , ,


posted by Dataccount Inc. @ 4:35 PM   10 Comments




Thursday, January 28, 2010

Dataccount: Technology as a Competitive Advantage for Business Value

Dataccount leverages technology to better support our core mission: meeting client's business needs. Recently we identified a hi-tech tool that has come down in cost due to improvements in the technology behind it. Dataccount recently installed a new Digital Signal 1 line (DS1), commonly known as a T1 line, for our office. This new dynamic T1 line adds business value to assist in completing our mission. We determined this in the same fashion (ROI) we use to determine what technology may better serve your own core mission. All the positive and negative effects including cost are considered in this calculation to determine when the technology will pay for its’ self. The numbers fit, and we went ahead and acquired this new T1 for ourselves.

What does this mean to you our clients?

First and foremost, we are increasing our direct connection to you. Dataccount has implemented Direct Inward Dial (DID). Callers will no longer have to dial the main office number, followed by an extension, to reach individuals at Dataccount. Each person and department now has a unique number. (We can still be contacted via the main line, phone tree, and extensions.) Additionally, out bound calls from Dataccount will accurately reflect our ID.

For those interested in the technical details: our prior system consisted of two separate DSL internet connections and 6 analogue telephone lines. We replaced POTS telephone lines (analogue) and a static partial T1 data line with a Dynamic DS1(Dynamic T1 line) multiple DID lines, larger bandwidth and more control over the phone system (PBX). The new line integrates with our current CRM and accounting software. We expect these upgrades to pay for themselves through greater efficiencies and improved customer service.

There is a lot of different technology out there. What technology will bring value to your business?

Labels: , , , , ,


posted by Dataccount Inc. @ 4:10 PM   5 Comments