Gregarius » BetaNews.Com » février 29, 2016

BetaNews.Com (20 non lus)

More than half of UK businesses will embrace flexible and remote working in 2017

Publié: février 29, 2016, 9:08pm CET par Sead Fadilpašić

Next year will be the tipping point for flexible and remote working in the UK, with more than 50 percent of businesses adopting it by the end of next year. That number will grow even more, to 70 percent, by the time we get to 2020.

Those are the results of a new survey produced by Lancaster University’s Work Foundation, and commissioned by Citrix. The survey, entitled Working anywhere: A winning formula for good work?, asked 500 employees at a managerial level about the pros and cons of flexible working.

So what are the pros? The study highlights four reasons why companies should implement flexible working: increased productivity, improved employee wellbeing, talent attraction and retention and reduction in accommodation costs.

So why is flexible working, if it’s so good, not yet already at 90 percent, at least? The report says there are cultural barriers that need addressing: 37 percent of managers believe this means longer hours, while 22 percent say they feel disconnected from the team. An additional 28 percent felt it blocked them from overseeing other people’s work. A quarter (24 percent) also said all work is carried out in company premises.

That’s not all, though -- 75 percent believe this will put more strain on the HR department, 84 percent say it will require changes to performance management, and 82 percent think this will require changes to employment terms and conditions.

The study says implementing flexible working requires three key commitments: careful planning, leadership and a new approach.

The full report can be found on this link.

Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

Photo Credit: Shutterstock/Rawpixel
Apple takes its FBI fight to Congress -- read the company's powerful opening statement

Publié: février 29, 2016, 8:52pm CET par Wayne Williams

As you know, the FBI wants Apple to help unlock an iPhone linked to one of the San Bernardino shooters. Apple is resisting the request, and tomorrow will testify at a Congressional encryption hearing.

Apple’s General Counsel, Bruce Sewell, will make the company’s case before the house Judiciary Committee and his opening statement was sent to Apple employees earlier today. It’s an interesting read:

Thank you, Mr. Chairman. It's my pleasure to appear before you and the Committee today on behalf of Apple. We appreciate your invitation and the opportunity to be part of the discussion on this important issue which centers on the civil liberties at the foundation of our country.

I want to repeat something we have said since the beginning -- that the victims and families of the San Bernardino attacks have our deepest sympathies and we strongly agree that justice should be served. Apple has no sympathy for terrorists.

We have the utmost respect for law enforcement and share their goal of creating a safer world. We have a team of dedicated professionals that are on call 24 hours a day, seven days a week, 365 days a year to assist law enforcement. When the FBI came to us in the immediate aftermath of the San Bernardino attacks, we gave all the information we had related to their investigation. And we went beyond that by making Apple engineers available to advise them on a number of additional investigative options.

But we now find ourselves at the center of an extraordinary circumstance. The FBI has asked a Court to order us to give them something we don't have. To create an operating system that does not exist -- because it would be too dangerous. They are asking for a backdoor into the iPhone -- specifically to build a software tool that can break the encryption system which protects personal information on every iPhone.

As we have told them -- and as we have told the American public -- building that software tool would not affect just one iPhone. It would weaken the security for all of them. In fact, just last week Director Comey agreed that the FBI would likely use this precedent in other cases involving other phones. District Attorney Vance has also said he would absolutely plan to use this on over 175 phones. We can all agree this is not about access to just one iPhone.

The FBI is asking Apple to weaken the security of our products. Hackers and cyber criminals could use this to wreak havoc on our privacy and personal safety. It would set a dangerous precedent for government intrusion on the privacy and safety of its citizens.

Hundreds of millions of law-abiding people trust Apple's products with the most intimate details of their daily lives – photos, private conversations, health data, financial accounts, and information about the user's location as well as the location of their friends and families. Some of you might have an iPhone in your pocket right now, and if you think about it, there's probably more information stored on that iPhone than a thief could steal by breaking into your house. The only way we know to protect that data is through strong encryption.

Every day, over a trillion transactions occur safely over the Internet as a result of encrypted communications. These range from online banking and credit card transactions to the exchange of healthcare records, ideas that will change the world for the better, and communications between loved ones. The US government has spent tens of millions of dollars through the Open Technology Fund and other US government programs to fund strong encryption. The Review Group on Intelligence and Communications Technology, convened by President Obama, urged the US government to fully support and not in any way subvert, undermine, weaken, or make vulnerable generally available commercial software.

Encryption is a good thing, a necessary thing. We have been using it in our products for over a decade. As attacks on our customers' data become increasingly sophisticated, the tools we use to defend against them must get stronger too. Weakening encryption will only hurt consumers and other well-meaning users who rely on companies like Apple to protect their personal information.

Today's hearing is titled Balancing Americans' Security and Privacy. We believe we can, and we must, have both. Protecting our data with encryption and other methods preserves our privacy and it keeps people safe.

The American people deserve an honest conversation around the important questions stemming from the FBI's current demand:

Do we want to put a limit on the technology that protects our data, and therefore our privacy and our safety, in the face of increasingly sophisticated cyber attacks? Should the FBI be allowed to stop Apple, or any company, from offering the American people the safest and most secure product it can make?

Should the FBI have the right to compel a company to produce a product it doesn't already make, to the FBI's exact specifications and for the FBI's use?

We believe that each of these questions deserves a healthy discussion, and any decision should be made after a thoughtful and honest consideration of the facts.

Most importantly, the decisions should be made by you and your colleagues as representatives of the people, rather than through a warrant request based on a 220 year- old-statute.

At Apple, we are ready to have this conversation. The feedback and support we're hearing indicate to us that the American people are ready, too.

We feel strongly that our customers, their families, their friends and their neighbors will be better protected from thieves and terrorists if we can offer the very best protections for their data. And at the same time, the freedoms and liberties we all cherish will be more secure.

Thank you for your time. I look forward to answering your questions.

The tl;dr version: encryption is a necessary thing, the FBI is asking Apple to weaken the security of its products and that will set a dangerous precedent for government intrusion on the privacy and safety of its citizens.

Photo credit: TK Kurikawa / Shutterstock
Ransomware is the biggest threat to Android users in UK

Publié: février 29, 2016, 8:36pm CET par Sead Fadilpašić

Ransomware was the biggest threat to Android users in the UK last year, a new report by security company Bitdefender says.

Even though it’s not as dangerous or prolific as its Windows counterpart, ransomware still played a major role in the overall mobile security landscape for last year.

Here are the numbers: In Q3 2015, ransomware on Android accounted for 28 percent of all malware. For Q4, that number was at 19 percent. Compared to other types of malware, ransomware was 14 percent more frequent in Q3 and seven percent in Q4.

Android.Trojan.Slocker accounted for 22 percent of Android malware threats in the UK in the latter half of the year, the report says, topping the charts in the UK, Germany and Australia.

"Due to the popularity of Android devices, malware developers will continue to write code specifically targeting them. Android malware is not only a lucrative business for hackers but also a gateway for other malicious actions", states Catalin Cosoi, chief security strategist at Bitdefender.

"Users must avoid installing applications from unofficial vendors, instead only using those found on trusted marketplaces. Non-reputable apps have a high chance of containing malware such as ransomware or data-stealing Trojans, resulting in significant financial or data loss".

Looking at the global scale, ransomware is not that big of a threat on Android -- it’s much more dangerous on Windows. On Android, it accounts for four percent of all malware reported in the second half of the year.

Bitdefender suggests that the UK is a big target as ransomware seems to have a high success rate on the Island -- 44 percent have apparently paid to get their devices unlocked.

The report doesn’t say how much money victims have to pay, but previous reports on ransomware suggest it’s anywhere between $12 and $300, usually paid in Bitcoin.

Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

Photo credit: Ton Snoei / Shutterstock
Kill the password! Yahoo Account Key rolls out to more apps

Publié: février 29, 2016, 7:54pm CET par Mark Wilson

There have been a lot of attempts to kill the password and replace it with something more secure and easier to use. Biometric measures such as fingerprint and iris readers are increasingly common, but Yahoo is on a mission of its own with Yahoo Account Key.

Recognizing that "passwords suck", Yahoo launched the product back in October and since then there have been a few changes and additions. It's a simple system that uses your mobile as your access key and it's now available in more apps than ever.

Yahoo Account Key came about in response to the fact that passwords are not only all too easily hacked, but also very easily forgotten. It builds on the idea of 2FA and reduces the sign-in process to a simple tap in an app. Yahoo says that Yahoo Account Key is now available on more than 50 million devices. There are a couple of key improvements to Yahoo Account Key that the company highlights today:

Available Anywhere: You can use Account Key in a majority of Yahoo apps, including Yahoo Finance, Fantasy, Mail, Messenger, and Sports for iOS and Android.

Do Not Disturb: We've launched a dashboard where you can control the devices or apps that receive Account Key push notifications. For example, if you have an iPad on the kitchen table, you can turn off sign-in notifications on that device so your kids aren’t disturbed while doing their homework.

This is not the end of Yahoo's battle against the password. We're promised that there are more developments and changes on the horizon.

Photo credit: April909 / Shutterstock
Amazon unveils Wi-Fi-enabled Brita Infinity Smart Water Pitcher with Dash Replenishment

Publié: février 29, 2016, 6:00pm CET par Brian Fagioli

For many people, walking around with a water bottle all day is a way of life. Not only is it reassuring that your thirst can always be quenched, but it is very healthy too. Once you get away from all of the sugar-filled drinks, and even worse, the artificially sweetened beverages, you may feel much healthier.

Unfortunately, water bottles can be very bad for the environment. While some can be recycled, a good amount of them can end up in landfills. Not to mention, the process of making the plastic can have a large carbon footprint. A good solution is opting for an in-home water filter and carrying reusable bottles. Today, Amazon announces a very high-tech filtration pitcher -- the Wi-Fi-enabled Brita Infinity. Yes, it connects to the Internet. Why? To re-order filters through Amazon Dash, of course!

"The new Wi-Fi-enabled Brita Infinity pitcher is equipped with a built-in counter that tracks the amount of water that passes through the pitcher’s filter. The pitcher itself will automatically order a new filter through Amazon Dash Replenishment when the old filter nears its capacity. This new connected pitcher with Amazon Dash Replenishment gives Brita owners exactly what they want -- a new Brita filter on their doorstep at the time they need it", says Amazon.

The online retailer further says, "when people buy the new Brita Infinity pitcher, they simply need to register on Brita.com/infinity, connect the pitcher to their home network and sign up for Amazon Dash Replenishment using their Amazon account. Then, the pitcher connects with the service to ensure automatic replacement filter orders are made when the filter nears its capacity -- roughly 40 gallons of water. While the service is automatic, the person stays in control and can easily manage their orders and deliveries online at any time".

While some people will decry the use of a "smart" water pitcher being yet another connected device to spy on consumers, this is actually quite cool and convenient. By empowering the consumer to enable automatic filter deliveries, they can be assured of always having clean drinking water. It is one less thing for consumers to worry about.

This BPA-free pitcher is surprisingly affordable too, at a very competitive $45. You can purchase this neat product here. Even the cost of replacement filters -- rated for 40 gallons or 2 months -- is affordable, at $5.99 each.

Will you buy this super-cool water filtration pitcher from Brita? Tell me in the comments.
Most consumers don't like to be tracked, but few are doing something about it

Publié: février 29, 2016, 5:07pm CET par Sead Fadilpašić
Most users know their online activity is being tracked. They’re not OK with it, yet most of them do nothing about it. Those are the general conclusions of a new quiz entitled Are you cyber savvy?, made by Kaspersky Lab.

The security firm says consumers don’t know how to protect their privacy online.

The majority of users (79 percent) don’t like being tracked, but 41 percent do nothing about it. Nine percent didn’t even know they were being tracked.

Twenty-seven percent use their browser’s privacy mode, and 11 percent use a special plug in, Kaspersky Lab says, before giving tips on how to stay safe online:
- Disable auto add-on installation. Block suspicious websites and pop-ups, make SSL certificate checks compulsory and block third party cookies.
- A lot of software (especially freeware) come bundled with other software. That other software is sometimes called bloatware and basically installs toolbars, plugins and extensions that often collect user data.
- Use HTTPS sites whenever you can. Dedicate a specific browser for primary online services.
- Use VPN traffic encryption
- Use private features offered in various security programs and browsers.
David Emm, principal security researcher at Kaspersky Lab says, "Consumers are uncomfortable with the fact that their online activities are being tracked. And who can blame them? With tracking data, it’s possible for advertisers, or even malicious third parties, to peer into the life of a person -- from where they go, to the sites they browse. However, the crux of the problem is that many users simply aren’t cyber-savvy enough when it comes to protecting themselves from online tracking. They may be concerned, but do nothing about it. Even worse, they may not understand that they are putting their privacy at risk at all".

Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

Photo credit: Roobcio / Shutterstock
Microsoft announces HoloLens Development Edition, available for pre-order now

Publié: février 29, 2016, 4:05pm CET par Wayne Williams

HoloLens is unquestionably one of the most exciting pieces of hardware being developed by Microsoft at the moment. The augmented reality system, or "untethered holographic computer" as the software giant refers to it, was first announced a year ago, but since then there’s been no word on when we can actually expect to see it.

Today, however, Microsoft announces a Development Edition which is now open for pre-orders, with shipping starting on March 30. This is the first step towards a consumer version.

The Windows 10 powered device is fully self-contained, and, Microsoft says, is "the only device that enables holographic computing natively with no markers, no external cameras, no wires, no phone required, and no connection to a PC needed".

Developers who purchase HoloLens will have access to hundreds of UWP apps through the Windows Store and also to a showcase of holographic app experiences designed to demonstrate what the device can do.

Alex Kipman, Technical Fellow -- Operating System Group at Microsoft, says

HoloLens is an amazing Windows 10 device, and the APIs responsible for holographic computing are already available in Windows 10. Starting today, developers will have access to documentation, and to the developer community, that will help them create amazing experiences. Developers should go to dev.windows.com/holographic for guides and detailed tutorials. Additional development tools that include Visual Studio projects and a HoloLens emulator will be released when HoloLens devices start shipping to customers on March 30. The emulator will allow developers to test holographic apps on their PC without a physical HoloLens and comes with a HoloLens development toolset -- to help developers who haven’t yet received their devices get started right away.

For now the HoloLens Development Edition will only be available to developers in the US and Canada. If you're interested in pre-ordering one, it will set you back $3000.
Developers earn more on Windows Phone than Android or iOS

Publié: février 29, 2016, 3:48pm CET par Mihăiță Bamburic

Windows Phone is nowhere near as popular as Android or iOS, having a market share of just over one percent, but it appears to be far more lucrative for developers than either of the two major platforms. In fact, developers who publish apps in Windows Store can expect to earn twice as much compared to those who create Android titles.

On average, a Windows Phone developer earns $11,400 per month, which equates to $136,800 per year. In contrast, an iOS developer has to make do with $8,100 per month, or $97,200 per year, while an Android developer makes $4,900 per month, or $58,800 per year.

The figures certainly make Windows Phone look much more appealing than developers lead us to believe. The smartphone operating system does not always get the same treatment as Android and iOS when it comes to new app releases, or the same level of support for existing titles. In fact, there is quite a large gap between it and Android and iOS, and it seems like it will never truly go away until the platform gains more ground in the consumer market.

Particularly interesting is that nearly half -- 49 percent, to be exact -- of Windows Phone developers take home at least $10,000 per month, or $120,000 per year. This means that there is no small group of developers that earn most of the revenue generated on the platform, which indicates that the average developer has a good chance at earning a decent living from Windows Phone app development.

Europe is actually the region where Windows Phone development is most popular, with 34 percent of developers on the old continent writing apps for the platform, compared to half as many in US and APAC. And, 28 percent of developers are considering an increase in their Windows Phone development efforts as opposed to 16 percent who expect the opposite.

The figures come from an InMobi survey, which polled over 1,000 developers. Over half of them are based in the APAC (Asia-Pacific) region, so the findings may not accurately reflect the state of affairs in US or Europe. Nearly half of developers -- 47 percent -- are working alone.

Are These Figures too Good to be True?

I have talked to a few Windows Phone developers over the years, including some high-profile ones that are responsible for very popular titles like Nextgen Reader. While revenue questions have not always received a straight answer, it is implied that earnings are generally not as high as on Android or iOS.

Of course, the developers that I have talked to likely do not represent the entire Windows Phone developer scene, but I also have serious doubts over whether InMobi's findings are accurate. After all, if revenue is this high, there would be more developers interested in the platform. Also, InMobi is an ad network, so its findings may be skewed towards its own developer customers.

Another problem is that, unlike with Android and iOS, there are few other surveys or reports that include Windows Phone into the mix, and none that is recent. Google and Apple also frequently share updates on developer revenue, while Microsoft prefers to keep such things private.

Nonetheless, even if revenue from Windows Phone apps turns out to be less in reality, a more accurate figure would still make the platform look good in the eyes of developers. Not to mention that competition on the platform is nowhere near as heated as on Android and iOS.

Image Credit: nopporn / Shutterstock
How to activate Windows Defender Offline in Windows 10

Publié: février 29, 2016, 3:20pm CET par Wayne Williams
Windows Defender, Windows 10’s built in antivirus tool, will keep your PC safe from numerous threats, but it’s not on a par with dedicated third-party anti-malware solutions.

Microsoft is working to make it more useful however, including adding offline capabilities that will allow you to run a system scan at bootup, and without an internet connection. That will make the tool much better at detecting and removing malicious software. Windows Defender Offline is not available to all at the moment, but you can still try it out.

Windows Defender Offline was originally introduced in 2011, and last updated in 2012, but Microsoft has added it to Windows 10 Insider Preview Build 14271 for Fast ring insiders.

If you’re running the latest build you can activate Windows Defender Offline by following these steps:
- Save your work and close any open applications.
- Click Start and launch Settings.
- Go to Update and security and click Windows Defender.
- Scroll down until you see Windows Defender Offline.
- Click the Scan Offline button.
After a countdown (which you can’t stop), your system will restart and Windows Defender will run a scan upon reboot. Microsoft says the process will take around 15 minutes to complete.

While I still wouldn't entirely trust my PC security to Windows Defender, an offline scanning mode is definitely a very welcome addition.

You can also download a version of Windows Defender Offline from here.

Photo Credit: Vladru/Shutterstock
IT security executives tell boards what they want to hear

Publié: février 29, 2016, 3:20pm CET par Ian Barker

A new report reveals that just four out of 10 IT and security executives feel the information they provide to the board of directors is actionable and that they often tell them what they want to hear.

The report from threat intelligence company Bay Dynamics also shows that only 39 percent believe they are getting the help they need from the board to address cyber security threats.

Based on a study conducted by Osterman Research among IT and security executives in 136 US companies, the report shows manual reporting methods still dominate. Manually compiled spreadsheets are used to report data to the board by 81 percent, a process which can lead to incorrect reporting and oversight of important data, whether due to intentional manipulation or to human error.

Boards have a strong preference for qualitative information, according to 53 percent of respondents, with 38 percent saying their boards prefer quantitative information.

"The report reveals that both the board and security professionals are not doing their jobs when it comes to security reporting," says Feris Rifai, co-founder and CEO at Bay Dynamics. "The board isn't holding IT and security executives accountable for providing accurate, traceable and actionable information and security executives are failing to report information that is accurate, traceable and actionable. Both parties must do better if they want to make the right decisions that minimize their cyber risk".

Among other findings are that the most common type of information reported about cyber security issues is known vulnerabilities within the organizational systems, followed by recommendations on cyber security program improvements and specific details on data loss incidents. Information about the cost of cyber security programs and details about expenditures on specific projects or controls are not as commonly reported.

The most common criteria used to determine which type of intrusion to report is the type of data affected -- cited by 84 percent of respondents. This includes whether the data breached or attacked was sensitive or confidential, such as customers’ financial data or personal information, or corporate financial data.

"Security is now everyone's problem -- from the IT team to the C-suite and the boardroom. As a result, reporting the right type of information with the right context, in addition to making it actionable, has never been more critical," says Michael Osterman, Principal Analyst at Osterman Research. "It is imperative that security executives reconsider how they’re getting their information, the type of information they're reporting, and how they’re reporting it, so that the board can effectively take action to make smart security decisions".

The full report is available to download from the Bay Dynamics website.

Photo Credit: EmiliaUngur/Shutterstock
Documents reveal details of EU-US Privacy Shield data sharing deal

Publié: février 29, 2016, 3:16pm CET par Mark Wilson

Details of the data sharing arrangements agreed between the US and EU earlier in the month have been revealed in newly published documents. The EU-US Privacy Shield transatlantic data transfer agreement is set to replace the Safe Harbor that had previously been in place.

The European Commission has released the full legal texts that will form the backbone of the data transfer framework. One of the aims is to "restore trust in transatlantic data flows since the 2013 surveillance revelations", and while privacy groups still take issue with the mechanism that will be in place, the agreement is widely expecting to be ratified by members of the EU.

The publication of the full text of the EU-US Privacy Shield agreement will give privacy advocates as well as regular internet users the chance to scrutinize the legislation that will control data sharing between Europe and the US. U.S. Secretary of Commerce Penny Pritzker accompanied the publication with a statement:

The EU-U.S. Privacy Shield is a tremendous victory for privacy, individuals, and businesses on both sides of the Atlantic. We have spent more than two years constructing a modernized and comprehensive framework that addresses the concerns of the European Court of Justice and protects privacy.

Our U.S. and EU negotiators worked around the clock to develop a new framework that underpins $260 billion in digital services trade across the Atlantic. The new EU-U.S. Privacy Shield provides certainty that will help grow the digital economy by ensuring that thousands of European and American businesses and millions of individuals can continue to access services online.

The new rules will apply to all companies that provide services within the EU and would regulate the flow of data to the US. Written commitments by the US government will ensure that the rules are enforced in a transparent way and will place limits on how data can be used by intelligence agencies.

EC vice president Andrus Asnip said:

Now we start turning the EU-U.S. Privacy Shield into reality. Both sides of the Atlantic work to ensure that the personal data of citizens will be fully protected and that we are fit for the opportunities of the digital age. Businesses are the ones that will implement the framework; we are now in contact on a daily basis to ensure the preparation is done in the best possible way. We will continue our efforts, within the EU and on the global stage, to strengthen confidence in the online world. Trust is a must, it is what will drive our digital future.

Next on the agenda is further fine-tuning of the wording of the agreement from the EU side, while in the US steps will be taken to put the new framework in place and appoint an ombudsman to oversee the proper implementation of the agreed mechanisms.

Photo credit: JMiks / Shutterstock
Malware spreading through cloud apps

Publié: février 29, 2016, 3:00pm CET par Sead Fadilpašić

There’s a good chance the cloud apps you use at work are laced with malware. Those are the findings of the latest report by cloud access security broker Netskope. In its February 2016 Netskope Cloud Report, the company says the usage of cloud apps in enterprises has never been this high -- ever.

In Q4 of 2015, employees used on average 769 different cloud apps, representing a 26.5 percent increase from the previous report. But (there’s always a but) -- 4.1 percent of enterprises have sanctioned malware-infected cloud apps.

"Considering that unsanctioned apps represent the majority of an enterprise’s total cloud app footprint (at 95 percent), report findings indicate IT may have an even larger scope of cloud app-based malware in enterprises than initially realized", it says in the report.

Employees can spread malware through sync and share mechanisms, without actually knowing. As many people use different cloud apps to collaborate and work, malware can rapidly spread throughout an organization.

"Employees are adopting cloud apps at an unprecedented rate, and organizations must prepare for the increasing security risks and challenges associated with the changing workplace", said Sanjay Beri, co-founder and CEO, Netskope. "Now more than ever, it’s imperative that organizations have complete visibility into and real-time actionable control over their cloud app usage to better monitor and understand trends and vulnerabilities. It’s only with this knowledge that IT can begin to protect against threats lurking in cloud apps, such as malware".

The report also suggests that Microsoft’s cloud apps are eclipsing those of Google, as well as that enterprise cloud apps aren’t prepared for the EU GDPR (general data protection regulation), something we’ve covered before.

Published under license from ITProPortal.com, a Net Communities Ltd Publication. All rights reserved.

Photo Credit: Blue Island/Shutterstock
82 percent of company boards are concerned about cyber security

Publié: février 29, 2016, 2:01pm CET par Ian Barker

According to a new study, data security is now on the agenda in most boardrooms. Yet only 14 percent of information security chiefs report to the CEO.

The report by the Information Systems audit and Control Association (ISACA) and the RSA Conference also reveals that 74 percent of security professionals expect a cyberattack in 2016 and 30 percent experience phishing attacks every day.

"While there are signs that C-level executives increasingly understand the importance of cybersecurity, there are still opportunities for improvement," says Jennifer Lawinski, Editor-in-Chief, RSA Conference. "The majority of CISOs still report to CIOs, which shows cybersecurity is viewed as a technical rather than business issue. This survey highlights the discrepancy to provide an opportunity for growth for the infosec community in the future".

The study also identifies a 12-point decline in the percentage of security professionals who are confident in their team's ability to detect and respond to incidents, dropping from 87 percent in 2014 to 75 percent in 2015. Among that 75 percent, six out of 10 don't believe their staff can handle anything beyond simple security incidents. In addition, the number who say that fewer than half of job candidates were considered 'qualified upon hire' has risen from 50 percent to 59 percent in a year. Also 27 percent say they need six months to fill a cybersecurity position, up three points from 2014.

"The lack of confidence in current cybersecurity skill levels shows that conventional approaches to training are lacking," says Ron Hale, Chief Knowledge Officer of ISACA. "Hands-on, skills-based training is critical to closing the cybersecurity skills gap and effectively developing a strong cyber workforce".

The study also examined emerging trends towards artificial intelligence and the Internet of Things. Rather than the accepted view of AI as an aid to detecting threats, it found that respondents believe that AI will increase risk in both the short (42 percent) and long (62 percent) term. Less surprising is that more than half (53 percent) of respondents are concerned or very concerned that the Internet of Things will expand attack surfaces further and exacerbate cyber risk.

The full State of Cybersecurity study is available to download from the ISACA website.

Image Credit: Manczurov / Shutterstock
Microsoft is wrong to pester insiders for Windows 10 feedback

Publié: février 29, 2016, 1:02pm CET par Mark Wilson

Windows 10 has enjoyed the largest beta testing program of any version of Windows. In opening up the Windows Insider program to anyone who wants to sign up for it, Microsoft has been able to gather valuable feedback from more people than ever. But not enough people it seems.

Users of Windows 10 preview builds have been asked to provide feedback using either the feedback app, or by responding to occasional popup notifications that appear. Up until now these notifications have been optional but in the latest Redstone build there is no way to disable them. Of course the first argument to be put forward is that gaining feedback is the very point of running the insider program. But is it that simple? Could mandated feedback actually be counterproductive?

There is no requirement for anyone to actually provide feedback when prompted to do so -- the notification can just be dismissed or ignored -- but the change sees Microsoft trying to second guess its customers. Placed in Microsoft's control, alerts to provide feedback appear 'automatically', meaning that they could well pop up at inopportune moments.

The change was introduced as part of Windows 10 Build 14271 which was released last week. At the time, Gabe Aul said:

Getting feedback is an integral part of the Windows Insider Program. After each build upgrade or after certain activities, Windows will often ask for feedback. The answers to these questions is used by our engineering teams to understand how Windows Insiders feel about a particular experience or a particular build. Starting with Build 14271 and newer, the frequency in which Windows will ask for your feedback will be locked to "Automatically (Recommended)" in the Settings app and managed by the Windows Insider Program. If having the ability to change this setting is important to you – you can roll back to the Windows 10 November Update (the latest build or future builds in our Current Branch) and disable Windows 10 Insider Preview builds on that device. You will then be able to change this setting. While we don’t require Windows Insiders to answer these questions, we do hope they take the time to answer them so that we can better improve Windows for our customers.

Boiled down, the advice from Gabe is to suck it up or don’t upgrade to this build.

Of course, Microsoft is completely within its rights to make whatever demands of Windows Insiders it wants, but it's not necessarily a good idea. Naturally, the company is looking for feedback, but it's not clear that the change actually makes sense.

I would argue that the most valuable feedback is that which is provided voluntarily at a time that suits the user. You may notice a quirk or stumble across an issue that you feel Microsoft should know about, and it makes sense to feed this back in a timely fashion while it's on your mind. This is user-driven feedback.

The approach that Microsoft is now using is rather more like a customer satisfaction survey. At the end of a week-long visit to a hotel you need to think back over the course of last seven days and provide an opinion about what you thought was good, and which areas need improvement. The problem is, our memories fail us. When something goes wrong the immediate, natural response is to try to address the issue, not (necessarily) provide feedback. At the end of the week, a problem with the hotel that irks you on Monday may well have been forgotten by Friday.

It's the same with Windows 10's feedback notifications. Feedback that is proactively provided by users when they encounter an issue or think of something is far more useful than Microsoft squeezing users every now and then. If an alert pops up asking you what you think of, for example, how File Explorer works, you're more likely to want to continue with what you were doing rather than breaking off and taking the time to think back to the good and bad things you have experienced.

On the flip side, users who encounter a problem will (probably) want to do two things -- firstly, address the problem by way of workaround if necessary, and secondly let Microsoft know about the issue so it can be addressed. There's no need to think back far to remember the specifics of what you have encountered, you can feedback while it's still fresh in your mind.

Sure, Microsoft may end up getting less feedback if it was left as being entirely optional, but it would certainly get more valuable feedback.

Photo credit: Rawpixel.com / Shutterstock
New service helps organizations visualize and prioritize security threats

Publié: février 29, 2016, 12:57pm CET par Ian Barker

Active vulnerabilities can present a serious threat to organizations, which is why many are turning to intelligence solutions to spot and manage security issues.

Cloud-based security and compliance specialist Qualys is announcing a new service as part of its Cloud Platform. Called Qualys ThreatPROTECT, it provides customers with an interactive dashboard to help them understand security threats at-a-glance.

ThreatPROTECT's dashboard uses vulnerability scan data gathered via Qualys scanners or Cloud Agents in real-time and correlates this with Real-time Threat Indicators (RTI) from multiple industry sources. It then provides customers with an easy-to-understand display offering clear insights into what vulnerabilities to fix first based on the level of threat seen in the wild.

"In today’s rapidly changing threat landscape, the most effective way for companies to protect themselves is to accurately identify assets, identify vulnerabilities, and ensure that systems are properly configured," says Philippe Courtot, chairman and CEO for Qualys. "Our goal is to continuously expand and improve our cloud-based offerings so customers can raise the bar when securing their assets. Qualys ThreatPROTECT is another example the demonstrates the power and agility of our cloud platform to introduce new services that can help customers improve their overall security without the cost and complexity associated with deploying enterprise software".

Qualys is also announcing the extension of its Cloud Agent platform, with the availability of agents for Linux and Mac OS, adding to the platform's existing support for Windows. The Cloud Agent platform gives organizations the ability to conduct real-time asset inventory searches on a global scale, to effectively address the security and compliance of their IT assets.

Cloud Agent augments the company's Cloud Platform. It automatically collects vulnerability and configuration data and securely transfers it to the Qualys Cloud Platform, where it is analyzed and correlated to identify risks and eliminate vulnerabilities.

Courtot adds, "IT and security professionals have the daunting task of ensuring that all assets are up-to-date, compliant and secure. With the availability of the Cloud Agent on all major computing environments, companies can now inventory all their IT assets, get the visibility needed to secure them against cyber attacks on a continuous basis and take action with Qualys' new patching capabilities".

More information on these developments can be found on the Qualys website and they'll be on display at the company's RSA stand.
From battling Scientology to taking down Islamic State, hacker group Anonymous celebrates its top ten accomplishments

Publié: février 29, 2016, 12:46pm CET par Wayne Williams

Recently Anonymous has mostly been in the news for targeting Islamic State on the web, playing its part in helping to shut down thousands of ISIS-supporting accounts on Facebook and Twitter.

But the hacktivist collective, which has been active since 2003, has initiated a lot of campaigns over the years, targeting a variety of people and organizations, some more successfully than others. The group’s list of achievements is quite impressive -- ranging from getting an internet predator arrested, to taking on the Church of Scientology.

As part of a new weekly top ten series, Anonymous has released a video celebrating some of its many accomplishments, and it’s definitely worth a watch.

SEE ALSO: Anonymous aims to delete the Islamic State 'virus' from the web, and wants your help

Other targets to feel Anonymous’ wrath have included "American white nationalist and holocaust rejector" Hal Turner, the Iranian and Russian governments, and hidden child pornography website Lolita City.

Whatever your views on Anonymous, the collective does do some good work and will no doubt do plenty more in the future.
Snapchat gets compromised, but user data should be safe

Publié: février 29, 2016, 12:36pm CET par Alan Buckingham

There's no small amount of controversy that swirls around Snapchat, as people swear it's used for all sorts of bad things. In truth, it probably isn't, people just send messages and images, most of which aren't the least controversial. But now the company has another problem, though this one doesn't involve anything lurid.

Instead it's actually the company's employees who were compromised and the service is attempting to apologize for this breach.

Blame has been laid, though not by name, as Snapchat only claims it to be the responsibility of "one employee" who succumbed to a phishing scam.

Snapchat explains "Here’s what happened: Last Friday, Snapchat's payroll department was targeted by an isolated email phishing scam in which a scammer impersonated our Chief Executive Officer and asked for employee payroll information".

Red flags should have gone up at this point, but the employee in question complied. That resulted in the payroll information on both current and former employees being disclosed to an external location.

Snapchat claims it responded quickly when it found out about the breach -- four hours the company says. It also states that none of its customer data was compromised. It says it notified the FBI of the potential problem.

To its credit, Snapchat says "We began sorting through which employees -- current and past -- may have been affected. And we have since contacted the affected employees and have offered them two years of free identity-theft insurance and monitoring".

The service also says it will double-down on its employee training to try and make sure these things don't happen again in the future. Finally, it states that "Our hope is that we never have to write a blog post like this again".

Photo credit: 360b / Shutterstock.com
How reliable is your firewall? Atelier Web Firewall Tester finds out

Publié: février 29, 2016, 11:35am CET par Mike Williams

Just about every firewall claims to protect your personal data by checking for illicit web connections -- but do they really work?

Atelier Web Firewall Tester (32-bit and 64-bit) is a once commercial, now free Windows product which tries to find out.

The program interface is basic in the extreme. It’s mostly a toolbar with six buttons, one for each test, and a text box below to display the results.

Hovering your mouse cursor over each button displays a tooltip explaining what it’s going to do.

Test #1 "Attempts to load a copy of the default browser and patch it in memory before it executes", for instance, while Test #5 "Performs an heuristic search for proxies and other running software authorized to access the Internet, loads a copy and patches it in memory before execution from within a thread on Windows Explorer".

Clicking any of these buttons runs the appropriate test. Some tests ask for further input -- a process to hijack, maybe -- but after that you’ll either see a success or failure message.

A running score keeps you up-to-date with "Firewall Points" (tests your system has passed) and "AWFT Points" (tests your PC has failed).

A "Reset Points" button sets both scores to zero, giving you time to tweak your security settings and try again.

Interpreting your results requires some care. Our system failed 4/ 6 tests, but this doesn’t necessarily mean we should replace the firewall (detecting these techniques is more a task for a HIPS).

It doesn’t mean we’re particularly insecure, either. Our system allowed AWTF to run because it didn’t think it was dangerous. If it did the same with an unknown binary then we’d be more worried, but if malicious code is allowed to run on your system then you’ve got much bigger problems than whether it can access a web page.

For all that, Atelier Web Firewall Tester can be interesting for experienced users, and the program can now be installed and used by anyone, without restriction.

Atelier Web Firewall Tester (32-bit and 64-bit) is a free application for Windows XP -- 8. We ran it successfully on Windows 8.1, but it’s unsupported on Windows 10.
Is your 'Open with' option missing in Windows 10? Here's a fix

Publié: février 29, 2016, 10:12am CET par Alan Buckingham

Windows 10 has been out for a while now and, much different from the last version of the operating system, people don't seem to dislike it. That doesn't mean there aren't problems, there's been plenty of the them, and over time fixes have been found for many of those little issues.

One that has cropped up is the disappearing "Open with" option in the right-click menu for files. There's a fairly easy fix for it though. Just follow the these steps.

First open Notepad, that little piece of software you likely never use. You're going to have to create a .REG file, but it's a simple process. Just type:

Windows Registry Editor Version 5.00
[HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Openwith]@="{09799AFB-AD67-11d1-ABCD-00C04FC30936}"

Now you'll need to save the document. Just click File and the Save As option and choose AllFiles and type Openwith.reg and OK it.

You'll now need to search out your new Openwith.reg file from wherever you saved it. Double click it to add it to the registry.

Alternatively, you can change the registry manually, but that can be a scary process for many users and these simple steps eliminate the headache and nervousness involved.

If you're having this problem with Windows 10 then let us know how it worked for you.

Photo credit: charnsitr / Shutterstock
Raspberry Pi 3 launches! 10x faster, 64-bit Quad-Core CPU, built in Wi-Fi and Bluetooth

Publié: février 29, 2016, 8:59am CET par Wayne Williams
Four years ago today, on 29 February 2012, the Raspberry Pi Foundation launched the original Raspberry Pi. Conceived as an ultra-cheap way to encourage kids to code as they had back in the 1980s and 90s, the uncased credit card sized computer quickly found an appreciative audience outside of the education system, with over a million Pis sold in the first year alone. Since then the firm has released several new versions, including the Raspberry Pi 2 (launched a year ago), and most recently the ultra-elusive $5 Raspberry Pi Zero.

Today, to celebrate the Pi’s 4th birthday, a new member joins the family. The Raspberry Pi 3 Model B is significantly more powerful than its predecessors and yet is priced at just $35, the same price as the Raspberry Pi 2.

The new board is powered by a 1.2GHz 64-bit Quad-Core ARM Cortex-A53 processor, which makes it 10x faster than the first generation Raspberry Pi. It includes wireless LAN & Bluetooth connectivity too, making it perfect for powerful connected projects.

The full list of specs is as follows:
- Broadcom BCM2387 chipset
- 1.2GHz 64-bit Quad-Core ARM Cortex-A53
- 802.11 bgn Wireless LAN and Bluetooth 4.1 (Bluetooth Classic and LE)
- 1GB RAM
- 64 Bit CPU
- 4 x USB ports
- 4 pole Stereo output and Composite video port
- Full size HDMI
- 10/100 BaseT Ethernet socketbr
- CSI camera port for connecting the Raspberry Pi camera
- DSI display port for connecting the Raspberry Pi touch screen display
- Micro SD port for loading your operating system and storing data
- Micro USB power source
The Raspberry Pi Foundation recommends using a 2.5A adapter if you want to connect power-hungry USB devices to the new Pi, although the board can still be run from a 5V micro-USB power adapter.

SEE ALSO: How to find and buy the ever-elusive $5 Raspberry Pi Zero

The new board is available to buy from today from all of the usual Pi suppliers including element14 and RS Components. Hopefully, with its more expensive price tag (if you can call $35 expensive), the Raspberry Pi 3 will be easier to buy than the Pi Zero.

The Raspberry Pi Foundation will continue to make and sell the Raspberry Pi 1 Model B+ ($25) and Raspberry Pi 2 Model B ($35) alongside the new board, as well as the Model A+ ($20).

A Raspberry Pi 3 Model A will be launched later in the year.