Tag: Business & Finance

If your Point Of Sale Uses Oracle, Update Now

Oracle is currently the third-largest provider of POS (Point of Sale) software on the market today, which means that there’s a fairly good chance you’re using an Oracle POS system.  If you are, there’s trouble ahead.  A recently discovered security flaw could put your system at risk.

Oracle has already identified and patched the security flaw, but there’s a problem.  Since POS systems are deemed “mission critical” by most businesses, System Administrators rarely schedule maintenance for them on fears that an unstable patch or update could cause undue downtime for the company.  Because of that, it will likely be a month or more before the new update finds its way to all 300,000 of the at-risk systems.

As security flaws go, this one is fairly nasty, too, as it allows a hacker to collect configuration files from any vulnerable Micros POS system.  This data can then be used to grant the hacker full, unrestricted access to the POS system,  as well as the database and server it feeds information to.

Most hackers attacking a POS would be content with simply collecting credit card details for resale on the Dark Web However, with this exploit, any sort of malware could be installed to use against the company later.

Even worse, a hacker need not be in close proximity to the device in question.  A carefully crafted HTTP request could trigger the security flaw and open the door.  Of course, if a hacker is in close proximity to the system, then there are many easier ways to infect it.  One only needs to distract the sales clerk long enough to attach a simple Raspberry Pi board equipped to run the exploit code and the damage is done.

The bottom line is, if you use an Oracle POS, make installing the latest security patch a priority.  You’ll be vulnerable until you do.

Ransomware Affected Over 50 Percent Of Surveyed Companies

Sophos has released the results of their annual “State of Endpoint Security Today”, and it doesn’t paint a pretty picture. A full 54% of companies surveyed reported having been hit by a ransomware attack in 2017. Another 31% reported that they expect to be on the receiving end of such an attack in the near future.

If the headline statistic wasn’t bad enough, it only gets worse from there.  According to the data collected, the average cost of a ransomware attack (including network costs, manpower, downtime, and device replacement cost) was $133,000. Five percent of respondents reported total costs between $1.3 million and $6 million, before factoring in the cost of any ransom paid.

As bad as those figures are, what makes them even more painful is the frequency. On average, survey respondents report having been struck an average of twice in the past year.

Dan Schiappa, the Senior VP and General Manage of Products at Sophos explains: “Ransomware is not a lightning strike – it can happen again and again to the same organization.  We’re aware of cyber criminals unleashing four different ransomware families in half-hour increments to ensure at least one evades security and completes the attack.

If IT managers are unable to thoroughly clean ransomware and other threats from their systems after attacks, they could be vulnerable to reinfection.  No one can afford to be complacent.  Cybercriminals are deploying multiple attack methods to succeed, whether using a mix of ransomware in a single campaign, taking advantage of a remote access opportunity, infecting a server, or disabling security software.”

In light of this relentless attack methodology, and in spite of the headlines all last year warning of the dangers, Schiappa warns that most companies are starting 2018 woefully unprepared for a ransomware attack. With all that said if you haven’t done so already, it’s well past time to review the state of your network security.

Google Will Get Tougher On Websites Not Using HTTPS

Google is poised to make an important change to its Chrome browser beginning in July 2018.

Here’s the summary from Emily Schechter, the Google Chrome Security Product Manager:

“For the past several years, we’ve moved toward a more secure web by strongly advocating that sites adopt HTTPS encryption, and within the last year, we’ve also helped users understand that HTTP sites are not secure by gradually marking a larger subset of HTTP pages as ‘not secure.’  Beginning in July 2018 with the release of Chrome 68, Chrome will mark all HTTP sites as ‘not secure.'”

All the major browsers already have plug-ins that alert users anytime they’re visiting a non-secure (HTTP) website, but Google’s planned move will likely prompt them to incorporate the notification into their core product as well.

According to Google’s statistics, 81 of the top 100 sites (as ranked by traffic volume) already use HTTPS.  In addition to that, Google reports that 68 percent of Chrome users are finding HTTPS when using Android and Windows, and 78 percent of the time when using Mac OS X, iOS, and Chrome OS.  Those figures are markedly higher than they were in 2010, when an estimated 40 percent of websites were using the secure socket layer.

If your company’s website hasn’t already made the switch, the time to do so is now.  The writing is clearly on the wall, and it’s not hard to imagine that after Google begins “shaming” non-secure sites with the notification, they’ll also start implementing penalties that will hurt their position on search results pages.  Even if they don’t, the persistent non-secure warnings will be enough to keep many users away, so it doesn’t matter how well optimized or SEO-friendly your site is, an increasing percentage of users may simply opt out if it’s not secure.

Traditional Hard Drive Technology Is Evolving

Rumors of the death of HDD technology have been greatly exaggerated.  The advancement of solid state technology and its increasing rate of adoption has been largely responsible for this, but don’t count old school HDDs out just yet.  They still have many important advantages, and recent breakthroughs should add further to the longevity of the tech.

Right now, the biggest advantage that HDDs have over their solid-state counterparts is sheer size.  While it would be prohibitively expensive to purchase 20+ Terabytes of solid-state storage, getting that amount (or more) of HDD storage is a trivial undertaking, a fact that it’s impossible to discount.

Even more exciting though, consider the recent breakthrough in 3D nano-magnets.  These were invented at the University of Cambridge, and stand to completely change the game. They allow data to be stored and processed in three-dimensional space, which will not only increase HDD storage space exponentially, but should see similar gains in terms of speed of access.

Another exciting recent breakthrough is a new magnetic system that turns heat into motion, which could be used to power miniaturized IoT sensors and actuators.  Such a system could also be applied to HDD technology by using the heat to power lasers, which would write data using the heat from the system itself, leading to an incredible boost in operating efficiency.

Finally, consider the invention coming out of the Imperial College of London.  Researchers there have figured out a way to write magnetic patterns onto nano-wires, which the research team claims could mimic the function of the human brain.  While this technology is still in its infancy, imagine the possibilities of having a computer, or even parts of a computer (like your HDD) powered by something that mimics the function of the human brain, and the dazzling possibilities that open up.

All that to say, while HDD tech might be a little long in the tooth, it’s not dead yet.  Not by a longshot.

40 Percent Of All Login Attempts Are From Bots

Here’s a statistic that is as disturbing as it is frustrating.  According to the latest “State of the Internet/Security” report for the fourth quarter of 2017, as published by Akamai, bot-traffic accounts for a staggering 43 percent of all login attempts.  As bad as that figure is on its face, it’s far worse for companies in the hospitality industry, where the figure is an almost unbelievable 82 percent.

The reason?  Hackers are increasingly using bots to perform “credential stuffing” attacks.

Although human traffic still dominates the web, bot traffic is rapidly catching up.  According to Akamai’s estimates, not counting streaming video, bot traffic accounts for 30 percent of the total, and that figure increases every year.  In fact, even though bot traffic is still a minority in absolute terms, some industries already see more bot traffic than human traffic.

TicketMaster is a great example of this.  The web’s premier site for purchasing concert tickets online is almost unusable by humans these days, because virtually all of their traffic is bot-driven, with bots often being used to buy every available ticket the moment they become available, so they can be resold later at a hefty premium.

Akamai’s Martin McKeay had this to say about the report: “Increased automation and data mining have caused a massive flood of bot traffic to impact websites and internet services.  Although most of that traffic is useful for internet businesses, cyber-criminals are looking to manipulate the powerful volume of bots for nefarious gains. Enterprises need to watch who is accessing their sites to differentiate actual humans from both legitimate and malicious bots.  Not all web traffic and not all bots are created equal.”

These are wise words, and it bears some consideration.  How much of the traffic coming to your business website on any given day is human?

Apple Releases Major iPhone and iOS Device Update 11.3

There’s a lot to talk about in Apple’s latest update to iOS.  Version 11.3 boasts some significant changes and is well worth getting.  We’ll go over the highlights below.

Battery management is the biggest and most significant change.  Last year, the company found itself in hot water when they began quietly throttling older phones and slowing down their performance because older phones have batteries that begin to degrade.  In the absence of throttling, it’s entirely possible that a user’s phone will simply shut down when it attempts to run a process that requires more power than the aging battery can provide.

Despite the company’s good intentions, their decision to throttle older phones met with serious backlash from their normally adoring customer base, and the company has changed their approach in 11.3.  Now, throttling is optional and under user control if you have an iPhone 6, 6S/6S Plus, 7, or 7 Plus SE. However, all users, regardless of model now have access to a new battery health screen so they can keep tabs on the condition of their battery and make good decisions about if and when to replace.

Another significant change is the addition of a new Health Records section, which allows users to get easy access to their medical records if their doctor also utilizes the app.

On the business side, the 11.3 update comes with Business Chat, which allows select businesses to communicate with customers directly in the iMessage app, rather than via social media or email.  While there aren’t a lot of companies taking advantage of this feature yet, you can bet that in coming weeks, you’ll see a slew of big names signing up to take advantage of the service.

There is a raft of other, smaller features in 11.3, but even if there weren’t, the “Big Three” mentioned here would make the update well worth getting.  Kudos to Apple!

Biometric Authentication Seeing Wide Adoption In Businesses

According to a new report published by Spiceworks, nearly 90 percent of businesses will use some type of biometric technology for authentication by the year 2020.  In fact, some 62 percent of companies already use biometrics in some form, with another 24 percent stating their intention to do so within the next two years.

The particulars break down like this:

  • 57 percent of companies using biometric authentication use fingerprint scanners
  • 14 percent use facial recognition
  • Five percent make use of hand geometry recognition
  • Three percent use iris scanners
  • Two percent use voice recognition
  • Two percent use palm-vein recognition

There are only a handful of companies that provide biometric solutions. Of those, Apple dominates the space, providing 34 percent of fingerprint scanning solutions and 14 percent of facial recognition solutions.

The rest of the market breaks out as follows:

  • Lenovo Fingerprint Manager is used by 13 percent of companies that utilize biometrics
  • Samsung fingerprint readers are used by 13 percent
  • Microsoft’s Windows Hello (face login) is used by 13 percent
  • Android’s Face Unlock is used by seven percent

As widespread as biometric adoption has been, only 10 percent of CIOs felt that biometric solutions were secure enough to be the sole means of authentication.  IT security professionals have reached largely the same conclusion, with just 23 percent of them thinking that biometrics could replace traditional text-based passwords within the next two years.

The two biggest hurdles they see are the relative lack of transparency provided by biometric solutions providers about flaws and vulnerabilities discovered in their systems, and the lack of transparency around the biometric data collected by vendors.

Peter Tsai, a senior technology analyst at Spiceworks had this to say about the report: “Many IT professionals aren’t convinced biometrics can serve as a secure and reliable replacement for the standard username and password combo.  Unless technology vendors can address the security issues and privacy concerns associated with biometrics, the technology will likely be used side-by-side in the workplace with traditional passwords or as a secondary authentication factor for the foreseeable future.”

SSD Drive Makers Adding Features To Reduce Duplicate Data

Big changes are in the works in the SSD-based storage ecosystem. It includes three different vendors all making similar announcements regarding designs to help companies that rely on SSD-based storage systems to reduce duplication and control data creep.

It’s not hard to see why they’re scrambling.  Although the price of SSD-based storage systems are coming down, it’s a slow process.  Currently, a gigabyte’s worth of SSD storage costs about forty cents, versus about five cents per gigabyte of HDD storage.  Less data duplication means less data to store, making the SSD drives utilizing the new technology more efficient.

Here’s a quick overview of the solutions offered by the three major vendors in this space:

  • Hitachi – Hitachi is working to upgrade all-flash F-Series and its hybrid flash/hard disk G-Series of drives, as well as its SVOS operating system. The improvements to the operating system include new AI-based container and operations support and introduced a new feature in the form of the “Hitachi Infrastructure Analytics Advisor.” This provides real-time analysis of your data center optimization across all storage devices, networks, servers and virtual machines in a bit to more efficiently predict data center needs and optimize/troubleshoot data storage.
  • HPE – The company has upgraded their “Nimble” storage line, which includes an array of all-flash products, a hybrid disk-flash product line and a secondary flash line. The big change here is that the company’s products now support inline, variable block size deduplication.  The company claims this change makes their products “the most efficient hybrid arrays in the industry by a wide margin.”
  • IBM – IBM has issued an upgrade to its Storwize arrays, the first in more than two years. The update improves cloud integration, overall disk performance and an array of enhanced deduplication tools, claiming as much as a 5:1 data reduction while retaining 100 percent data availability (provided you’re using IBM HyperSwap).

How big an impact these changes will have remains to be seen, but kudos to all three companies for taking decisive steps to bolster the performance of their storage devices.

Attacks on Health Organizations Increasing At Alarming Rate

It used to be the case that credit card companies and retail outlets were the primary targets of hackers around the world.  Make no mistake, they still get attacked with regularity, but the hackers have found a new and even more lucrative target:  Health Organizations.

According to a new report jointly produced by the Ponemon Institute and Merlin International, the medical/healthcare industry suffered nearly a quarter (23 percent) of all the data breaches that occurred in 2017.  It gets worse.  Those breaches exposed PHI and PII of more than five million individuals.

The reason for the shift away from credit card data to medical records comes down to profits.  PHI and PII can often be sold on the Dark Web for ten times the amount that credit card information will bring.  The hackers are simply obeying the laws of economics and going where the money is.

Brian Wells, the Director of Healthcare Strategy at Merlin International had this to say about the report:

“In an increasingly connected, digitally centric world, hackers have more opportunities and incentive than ever to target healthcare data, and the problem will only increase in scope over time.

Healthcare organizations must get even more serious about cyber security to protect themselves and their patients from losing access or control of the proprietary and personal information and systems the industry depends on to provide essential care.”

Worst of all, a shocking percentage of medical/healthcare companies don’t seem to be serious about cyber security at all.  Although the average cost of a medical data breach is approximately four million dollars, a staggering 49 percent of companies in the industry don’t have an incident response plan of any kind.  There’s no process in place to properly respond to an attack, or to mitigate the fallout if a breach occurs.  These companies are sitting ducks.

New Chips Support Increased Network Speeds To 400Gbps

Marvell Semiconductor has a new product out, and it’s a game changer.  Their new “Alaska” chip (the Alaska C 88×7120) is the first on the market to support the new 802.3 standard.  The 802.3cd is on tap to eventually replace current Ethernet ports running at 25Gbps to 100Gbps with ports that will run at 50Gbps, 200 Gbps, and 400 Gbps.

The future is now.

Granted, the Alaska chips aren’t for sale just yet, but they are sampling to customers (“Sampling” in the chip world is akin to beta testing in software).  The chip supports sixteen 50 Gbps ports, four 200 Gbps ports, and two 400 Gbps ports, which will quadruple network output.  Even better, the new chips support both copper and fiber-optic wiring, as well as SerDes (long-reach serialization/deserialization) on system and line side interfaces, allowing OEMs to use the chips for wide-area interfaces.

Also of interest, the new chips use PAM4 (pulse-amplitude modulation), which is a four-level signaling scheme that’s designed to replace NRZ (non-return to zero) binary modulation, and even better, the new PAM4 protocol will be backwards compatible with NRZ hardware.

The port density on the new chip has been optimized to enable both Quad Small Form Factor Pluggable – Double Density and Octal Small Form Factor Pluggable port types for 500 GbE, 200 GbE, and 400 GbE deployments.

If all of those technical details make your head spin, not to worry.  The short of it is that once these chips go mainstream, network output is going to increase dramatically, which means that network speeds are about to get even faster.

Unless you run or manage a huge data center, you’ll probably never have direct contact with these chips. However, as big data centers begin deploying them, you’ll absolutely see the benefits.