Wednesday 31 December 2014

Alleged tech support scammers come up with all kinds of alibis to counter complaints

Better Business Bureau records show companies blamed scammers, customers' Internet connections and new software for consumer grievances

Companies sued by the Federal Trade Commission (FTC) and Microsoft for allegedly defrauding consumers with worthless Windows technical support have spun tales involving flakey Internet connections, it's-not-us-it's-scammers, new management software and unanswered emails to counter hundreds of consumer complaints this year, Better Business Bureau (BBB) records showed.

The four companies sued by the FTC in November and by Microsoft this month were reported to the BBB at least 318 times in the last 12 months, according to the organization's website.

Two of those companies accounted for the majority of the complaints: Customer Focus Services, a California company that operates a number of sites, including omnitechsupport.com; and Inbound Call Experts, a Florida company that ran advancedtechsupport.com and others. The BBB closed 124 complaints against Omni Tech Support in 2014, and 158 against Inbound Call Experts. The number of actual complaints filed may have been considerably larger, as the BBB only reports cases it considers resolved.

Consumer Focus Service was one of two technical support firms Microsoft sued in federal court earlier this month -- the other was Anytime Techies of Florida. Microsoft accused the two of infringing numerous Microsoft trademarks and practicing false advertising as they tricked consumers into paying for bogus help.

Inbound Call Experts, along with Vast Tech Support, both of Florida, were shuttered by a federal judge in November after the FTC filed complaints claiming they bilked Americans of more than $120 million.

All four allegedly operated telemarketing scams where consumers were told that their Windows PCs were infected with malware or needed to be optimized to work properly. Some consumers had contacted the companies themselves after seeing their websites or search result ads, while others had been cold-called by the firms.

The "help" provided was largely worthless, and in some cases the companies' representatives planted malware on the victims' PCs, the FTC and Microsoft charged. Customers were charged hundreds for the calls or fast-talked into expensive multi-year service contracts.

Such scams have become almost routine because the practice is extremely lucrative: Microsoft estimated that losses to U.S. consumers run $1.5 billion annually, and that a third of those contacted by scammers fall for the ploys.

While accounts of victims are easy to find -- Computerworld receives scores of emails each week about scams that readers fell for or narrowly avoided -- the alleged scammers' side is not. But their replies to customer complaints on the BBB website -- some, like Customer Focus's Omni Tech Support are actually members of the business trade group -- were illuminating, to say the least.

"The defense given by Omni over, and over and over again (it was given to me at least 12 times during my 6 1/2 hour 'chat' with them, as I was trying to set up services with them and had already paid their fee) ... is 'unstable Internet connection' or 'fluid Internet Connection,'" wrote Jane D. in a Nov. 30 complaint.

By Jane D.'s account, when she asked questions about Omni's extended service, the company representative balked at answering, instead telling her, "Just sign the contract." After she pressed for answers, Omni dropped the connection.

"It is my strong opinion that they use this 'poor Internet connection/fluid Internet connection' excuse as a way to wear you down, tire you out, and get your money," Jane D. said, referring to the numerous times she connected to the company's chat service and the several technicians she had to speak with.

Computerworld found several instances in Omni Tech Support's replies to the BBB complaints where it blamed customers' Internet connections for its inability to provide the services those people had already paid for. "Her Internet connectivity was weak and the chat session were getting disconnected, it was taking a longer time than expected," Omni said in response to a different complaint filed on Feb. 10.

InBound Call Experts, one of the two companies whose assets were frozen last month after the FTC lodged complaints, told a different story.

In a long reply to the BBB, which in February had asked Inbound for their "voluntary cooperation" in resolving complaints, Inbound threw its new computer software under the bus.

"The new [software] interface had new buttons that [representatives] were not used to and certain parts of the CRM [customer relationship management software] were in different locations," Inbound told the BBB. "With that said, our average handle time went from 19 minutes per call to 25 minutes per call. Because of this, our phone lines got backed up as we were not able to answer as many phone calls and many customers were calling back over and over because they were unable to reach us."

Inbound also claimed that its automated tools had a bug and so technicians had to "manually do some of the work that our automated tool normally did."

Vast Tech Support, the other company closed in the FTC-initiated action, blamed email when a customer said she had not received a promised refund earlier this year. "We have been communicating through email," said Katie M., a supervisor at Vast Tech Support, in a reply to an August BBB complaint. "The customer has not responded to my last email."

Not true, the customer countered. "I replied to each response this woman sent. I told her in our last email that I would update status [of the BBB complaint] upon receipt of refund."

But the most cynical defense by the alleged scammers was that they had not called people and pressured them into buying software and services. Who had? Well, other scammers.

In a familiar-to-victims account, one consumer wrote, "I do not use Omni Tech Support, terminated support more than 1 yr year ago. [But] for 4 months I have received multiple calls alleging that my computer is infected by virus. I have asked numerous times for supervisor to cease any calls because I am not interested in their product. These calls occur 2 and 3 times a day, including evening hours."

Omni Tech said it wasn't them. "It was a scam call. It was not us. We simply don't call people and tell them they have a virus," the company replied.

The it's-not-us-it's-them comeback was used by several of the firms in their responses to complaints registered with the BBB.

One grievance filed with the BBB said that the consumer had contacted Inbound Experts for technical support, which was provided. But just six hours later, the customer was called by someone claiming to work for Microsoft, who said that the Redmond, Wash. firm knew the user's PC was in trouble. In other words, a classic scam call.

"Obviously, since [Inbound Experts] knew when my computers were worked on, my name and phone number, this appears to be [an] inside issue," the complaint read. During a conversation with an Inbound Experts supervisor, the complaintant continued, "He said he was sorry about this and that many other customers have complained about this also, and supposedly the FBI was working on it. He was quick to end the phone call which made me even more suspicious. When I told him that this appeared to be an inside problem, he said it was possible."

Inbound's official response? "I can assure you that Advanced Tech Support [one of the names that Inbound used, the FTC said last month] is not a scam."

Neither Omni Tech Support's parent company or Anytime Techies have replied to Computerworld emails asking for comment about the Microsoft allegations. The two companies have until Jan. 8 to respond to Microsoft's lawsuit.

Omni Tech is a member of the BBB, but the organization did not give the company a grade-style "A" through "F" ranking. Anytime Techies is not accredited by the BBB, but has been given a "C" rating. Both Inbound Call Experts and Vast Tech Support were graded "F," and their BBB accreditation was revoked Nov. 26, a week after the FTC announced that they'd been closed by court order.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com


Monday 22 December 2014

20 great productivity apps for Android, iOS, and the Web

These 20 essential apps work on all three platforms, helping you stay productive no matter what device you or your co-workers use

Android, iOS, and Web: 20 multiplatform apps for maximum productivity

Man, the days of "Mac or PC" sure were simple.

It wasn't long ago that the only question you had to consider with compatibility was whether something would run on those two types of computers. These days, most of us interact with a multitude of devices and platforms, either on our own or as a result of our colleagues' choices, and finding productivity tools that work across them all isn't always easy.

When you stop and think about it, it's nothing short of a miracle that any service can provide a consistent experience on an iPhone, an Android phone, an iPad, an Android tablet, and any computer with a modern Web browser. Amazingly enough, though, such tools do exist.

We've tracked down 20 useful options to help you stay productive and in sync from one device to the next. Install them on your various computers and gadgets -- and get your co-workers to do the same -- and you'll be living in multiplatform harmony.

(Quick tip: If you don't have time to read all of this right now, skip to the 16th slide. You're welcome.)

Google Docs
Google's free cloud-based office suite has come into its own over the past several months, with the recent addition of offline access across all platforms along with the ability to edit standard Word documents in their native format. Editing from the mobile apps is also now fairly full-featured, thanks to Google's integration of Quickoffice, a former third-party app the company acquired. Functions like find and replace, undo, and table creation are all available, as are a range of font, paragraph, and table formatting tools. Docs may not be the most robust standalone word processor on any given platform -- you won't find a way to measure word count on the mobile apps, for instance -- but if you’re juggling devices, it’s a solid option for getting the basics done.

App: Google Docs
Developer: Google
Category: Word Processing
Availability: Android | iOS | Web

Microsoft Office 365/Office Mobile
For those who still rely on the traditional Microsoft Office ecosystem, the company's Office 365 service provides cloud-based access to documents on the Web and via its Office Mobile Android and iOS apps. The mobile apps are significantly less full-featured than Google's, and they're rather restricted, with no offline access unless you opt to pay a $7- to $10-per-month subscription fee. Access to the iPad app requires a subscription as well, and there is no app for Android tablets as of now. All in all, it's not the greatest suite of services, but it's at least something for folks stuck under Microsoft's umbrella.

App: Microsoft Office 365 / Office Mobile
Developer: Microsoft
Category: Word Processing
Availability: Android | iOS | Web

Google Drive
Google's cloud-storage service comes with 15GB of free space (shared with Gmail and Google+ Photos) and the option to upgrade to various higher tiers -- anywhere from 100GB to 30TB -- for $2 to $300 a month. Drive offers seamless integration with Google Docs, as you'd expect. It also excels in search, allowing you to search for objects shown in stored images and text present in scanned documents. Beyond that, Drive is able to display numerous file types -- even Photoshop and Illustrator files, if you're using Android or the Web -- and it provides offline access to your files via both its Web and mobile apps.

App: Google Drive
Developer: Google
Category: Storage
Availability: Android | iOS | Web

Microsoft OneDrive
Microsoft's storage offering comes with 15GB of free space and the option to various higher tiers -- 100GB, 200GB, or 1TB -- for $2 to $4 a month (with the 1TB plan requiring a one-year commitment). OneDrive is unique in its tight integration with both Microsoft's Office suite and Windows itself: You can store and access files in OneDrive from the various Office applications, and you can share files to OneDrive directly from Windows File Explorer.

App: OneDrive
Developer: Microsoft
Category: Storage
Availability: Android | iOS | Web

Dropbox
Dropbox gives you 2GB of free cloud storage, and you can bump that up to 1TB for $10 a month. While its starting level may be lower than what Google and Microsoft offer, Dropbox provides a wide range of features, including shared folders synced across multiple users and devices, nicely formatted photo galleries that are simple to share, the option to automatically back up photos as they're taken on mobile devices, and the option to remotely wipe a lost device (available only to paying customers). Dropbox’s powerful API has also made it a popular storage integration choice for many mobile apps.

App: Dropbox
Developer: Dropbox
Category: Storage
Availability: Android | iOS | Web

Box
Box provides 10GB of free space with the option to upgrade to 100GB for $10 a month; unlimited storage plans are also available for businesswide accounts with at least three users for $15 per user per month. Box is working hard to set itself apart with enterprise-targeted features like an integrated file-commenting system and granular controls over permissions, allowing you to control what people can do with a file once you share it. Box also offers a powerful API that enables developers to use Box as an integrated file system for their mobile apps.

App: Box
Developer: Box
Category: Storage
Availability: Android | iOS | Web

Google Hangouts
Google's free Hangouts service makes it easy to have one-on-one or group conversations as well as individual and group voice calls and video calls from whichever platform you prefer. The quality is typically quite good, so long as you're on a reliable and reasonably fast Internet connection. Video calls between Google users are free and unlimited, and voice calls to regular phone numbers within the United States and Canada are free. (You can call outside of those countries, too, but you'll have to pay a per-minute fee for the talk-time.)

App: Google Hangouts
Developer: Google
Category: Communication
Availability: Android | iOS | Web

Skype
Skype may not be as robust or user-friendly as Hangouts, but it's still a popular communication platform that can't be ignored. It provides free voice and video calls between users, but voice calls to regular phone numbers require either a monthly subscription or a per-minute fee. While there's (rather astonishingly) still no stand-alone Web app for the service, you can get to it from a desktop computer by signing into Microsoft's Outlook.com.

App: Skype
Developer: Skype Communications
Category: Communication
Availability: Android | iOS | Web

Trello
Whether you're working alone or as part of a team, Trello offers an easy yet powerful way to organize tasks, lists, and projects. No matter which platform you access it from, your data remains synced and looks the same to every user who sees it. Trello uses an intuitive whiteboard and notecard interface for task management, offering checklists, commenting, labels, attachments, notifications, and activity logs, as well as the ability to assign tasks to team members.

App: Trello
Developer: Fog Creek Software
Category: Project Management
Availability: Android | iOS | Web

Basecamp
When it comes to project management, Basecamp is one of the biggest names around. The service provides a centralized place for organizing and coordinating projects, allowing teams to create notes, lists, and schedules; upload files and plans; assign and manage tasks; and communicate with colleagues about progress on each individual element. With the company's multiplatform approach, you can view and edit anything you need from any device you have handy. (You'll need a Basecamp subscription, which is free for 60 days, then runs anywhere from $20 to $150 a month.)

App: Basecamp
Developer: Basecamp
Category: Project Management
Availability: Android | iOS | Web

Wunderlist
For simple lists, you want a simple app, and Wunderlist is one of the best around. Its clean and minimalist interface puts your tasks front and center, organized into topic-oriented lists, and it looks just as good whether you're on Android, iOS, or the Web. Wunderlist offers the ability to share lists, comment, delegate tasks, set reminders, and attach and share photos and files to your to-dos.

App: Wunderlist
Developer: 6 Wunderkinder
Category: Task Management
Availability: Android | iOS | Web

Any.do
Another excellent list-centric option, Any.do offers a solid all-around experience, and Android users get bonus features like the ability to turn a missed call directly into a reminder. Regardless of your platform, the service provides all the basic organizational tools you'd expect, including shared lists, folder-based organization, and calendar-like alerts for important tasks. It syncs with Google's Tasks system, too, so you can access it from Gmail as well as from Any.do's own Web interface.

App: Any.do
Developer: Any.do
Category: Task Management
Availability: Android | iOS | Web

Evernote
Evernote offers a robust notebook-like service that features regular to-do lists along with the ability to store and manage photos, handwritten notes, and articles from the Web. In addition to its standard free suite of services, the company has a business-focused platform designed for larger-scale company-wide collaboration. Evernote is also blessed with a rich ecosystem of integrated apps and services, thereby extending the power of an already powerful productivity tool.

App: Evernote
Developer: Evernote
Category: Notebook
Availability: Android | iOS | Web

OneNote
Microsoft's note-taking solution provides plenty of tools for keeping yourself and/or your team organized. You can create regular notes and lists, organize your stuff into notebooks or with tags, and add audio or video files into your notes. You can even take photos of receipts, memos, or whiteboards, then later search for the text shown in those images. OneNote also syncs with a stand-alone Windows app for those who prefer a more traditional desktop-based approach.

App: OneNote
Developer: Microsoft
Category: Notebook
Availability: Android | iOS | Web

Pocket
If you find yourself stumbling onto more interesting content than you have time to read, Pocket is exactly what you need. Pocket integrates into all the major platforms and allows you to save an article for later with a couple quick taps. Once it's been saved, you can get to it from any device and view it online or offline within the app's own excellent reading utility. Pocket also allows you to save videos and images for later viewing, share what you’ve saved with other Pocket users, and file away your Pocket favorites to Evernote.

App: Pocket
Developer: Read It Later
Category: Notebook
Availability: Android | iOS | Web

QuickBooks
QuickBooks is the de facto standard for small-business accounting for a reason: The service is jam-packed with functionality, and it works well regardless of what platform or type of device you're using. QuickBooks has all the accounting tools you'd expect, ranging from budget management to expense tracking and invoice creation and fulfillment. It all comes at a cost, though: The various apps require an active QuickBooks account, which runs $13 a month or $125 a year.

App: QuickBooks
Developer: Intuit
Category: Accounting
Availability: Android | iOS | Web

Expensify
If logging and managing expenses is all you need, a simple app like Expensify can get the job done without costing you a dime. From your Android or iOS device, Expensify makes it easy to snap photos of a receipt, which it then quickly analyzes in order to extract the relevant details and put them (along with an actual image of the receipt) into your records. It has other handy features, too, like the ability to track and log mileage using your phone's GPS, and the data is always available on any device you sign into as well as via its Web-based application.

App: Expensify
Developer: Expensify
Category: Accounting
Availability: Android | iOS | Web

Google Calendar
When it comes to maintaining a cross-platform calendar, Google Calendar stands in a league of its own. The free service provides a simple interface for managing meetings and personal appointments as well as sharing both individual events and full calendars with friends, family, and colleagues.

While Google doesn't yet offer its own official Calendar app for iOS, you can sync your Google Calendar data with Apple's native Calendar app or use third-party programs like Sunrise Calendar and Cal to tap into the info. On Android, meanwhile, an official Google app is available in addition to a variety of third-party contenders, allowing you to pick the setup that best suits your needs.

App: Google Calendar
Developer: Google
Category: Calendar
Availability: Android | iOS | Web

TripIt
TripIt is a must-have app for anyone who travels. Once you sign up for the free service, all you do is forward any travel-related emails -- airline confirmations, hotel reservations, even concert ticket receipts or dinner reservation confirmations -- to a special email address, and TripIt automatically organizes them into trip-based itineraries.

For $49 a year, you can upgrade to TripIt Pro and get advanced features like real-time flight monitoring and alerts and a one-tap way to find alternate flight plans from your phone midtrip. TripIt also has an enterprise-level plan for organizations that want to implement its services company-wide.

App: TripIt
Developer: Concur Technologies
Category: Travel Management
Availability: Android | iOS | Web

LastPass
We all have a billion passwords to keep track of these days -- and if you're using the same password for every website you sign into, well, you're doing it wrong. LastPass, which topped InfoWorld's recent review of the best password managers for PCs, Macs, and mobile devices, helps you create unique and strong passwords as you surf the Web, then keep track of them securely.

With AES 256-bit encryption, local-only decryption, and multifactor authentication, LastPass keeps your data under lock and key, giving you one fewer worry in your digital life.

The full version of the service, which you'll need for mobile-based access, costs $12 a year.

App: LastPass
Developer: Joseph Siegrist
Category: Password Management
Availability: Android | iOS | Web




Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Sunday 7 December 2014

Why January could be a big month for Windows 10

While people are banging away at the Windows 10 technical preview, Microsoft is preparing for a real big month come this January, including major updates and a wider release product.

Currently, Windows 10 Technical Preview is on build 9879, although there have been stories of build 9888 being out in the wild. This was described as an interim partner build of Windows 10, not meant for public consumption.

In that build, people noted that Microsoft changed the kernel version number from 6.4 to 10.0. A whole lot of fuss was kicked up over this change, but for the end user it means nothing.

Going forward, things will get interesting. Multiple sites report Microsoft plans to take the wraps off the "consumer preview" of Windows 10 in January 2015. A consumer preview would mean it's much more stable for casual users and much more feature-complete. This is how Microsoft has always done betas. It does the rougher beta for more technical-minded users who can provide adequate data feedback, then within a few months it comes out with a more stable release for the masses.

The more obvious time to release this preview would be the Consumer Electronics Show (CES), taking place in Las Vegas in early January. However, Microsoft CEO Satya Nadella isn't among the keynote speakers. The CEOs of Samsung and Intel are.

ZDNet's Mary Jo Foley says there will be a press and analysts event at the Redmond HQ on January 20-21, which is when the January Technical Preview, as it is called, will be shown off. One of the key new features is expected to be Continuum, a feature that helps switch the UI on 2-in-1 laptops, so you get a different interface when the display is detached and when it is connected.

Foley and other sites also say that the January preview will be the first to feature Cortana, the digital voice assistant that first appeared on Windows Phone and is a competitor of sorts to Apple's Siri. Bringing Cortana over to the PC is a logical move, and Microsoft has made no secret of its desire to see Cortana everywhere.

This doesn't even touch on Windows Phone 10, which is reportedly planned for next year as well. Given how much code is shared between the mobile and PC versions of the OS, a close release schedule makes sense, but at this point it's all conjecture.

Foley claims there will be a monthly build release, which jives with earlier reports that Microsoft wanted to keep testers up to date with the latest builds. This would be contrary to the Windows 7 and 8 beta cycles, where we had one public test build and didn't see another until the release candidates hit months later.


Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Saturday 15 November 2014

6 ways to maximize your IT training budget

Customized, in-house training often zeros in on topics relevant to your business. However, it comes with an equally high price tag. If your employees simply need to fill in knowledge gaps or get up to speed with a specific software package, there are a plethora of affordable, flexible options for even the most limited budgets.

Although the economy is picking up ever so slightly, IT departments remain on the lookout for ways to do more with less – fewer people, fewer resources, less money. That's why learning how to stretch the training budget as far as possible can pay significant dividends. This is true both for those organizations seeking to develop employee skills and knowledge for the least expenditure, and for employees looking to improve and enhance their career potential and longevity.

If an organization can get its employees to buy into training and career development, they can literally double their dollars when costs get split 50-50. This is already an implicit aspect in many tuition support programs, where employers offer a partial stipend or payment to help cover the costs of academic coursework. Why not make it a part of how IT training dollars get spent, too?

Some IT departments offer their employees a menu of courses or certifications from which employees can choose, coupled with (partial) reimbursement plans to help defray their costs. By offering more support for those credentials it needs the most, and less for those credentials outside the "must-have" list, organizations can steer employees in the directions they want them to go.
Negotiate Discounts to Control Costs

Times are tough for training companies, too. If you do want to buy into online or classroom training, you'll get a better bang from your budget if you negotiate a "group rate" of sorts to cover some or all of your training needs.

Although online or virtual classes may not be as popular as instructor-led in-class training, remote offerings usually cost less to begin with; obtaining additional discounts will help leverage such spending even further. Some training companies offer subscriptions to their entire training libraries on a per-seat, per-month basis.

Pluralsight offers its extensive training catalog to individuals for about $50 a month, for example, and its business offerings include progress tracking and assessments for enrolled employees, as well as library access for some number of individuals. A 10-user license costs about $25 per month, per individual user for a Basic package, and double that for their Plus package, which adds exercises, assessments and offline viewing to the basic ability to watch courses online on a PC or mobile device.
Purchase Key Items in Bulk

If you know you need to run a team of system engineers or senior tech support staff through a specific curriculum that includes certain certification exams, and you can hold those people to a schedule, then you can purchase exam voucher or training/voucher bundles at a discount. As the purveyor of many popular and high-demand cert exams, and a publisher of copious related training materials, Pearson VUE/Pearson Education offers much of what employers need for such programs. Contact the Voucher Store to inquire about volume purchase pricing and arrangements.

(Note: The author writes on an occasional basis for InformIt, a professional development branch of Pearson, and on a frequent basis for the Pearson IT Certification blog.)
Assemble Employee Study Groups and Resources

Just a little added support for employees involved in training, or preparing for certification, can help organizations realize better results from (and returns on) their training investments. Consider some or all of the following strategies to help employees make the most of their training experience and get the best value for your training dollars

Set up a wiki or online forums/chat rooms on a per-topic or per-exam basis for employees to use and share.
Encourage employees to share their best resources, learning materials, study techniques and so forth with one another. Build compendia of such materials and pointers for ongoing sharing.
Provide access to practice tests, exercises and simulated or virtual labs for hands-on work so employees can check their learning, buttress their weak spots and develop a well-rounded understanding of training materials, exam objectives and coverage.
Identify local subject matter experts to whom training and certification candidates can turn for added information and explanation when the

Because many employees will be interested in these kinds of things, you can find volunteers to help create and maintain these kinds of low-cost but high-value training and prep tools and resources.

Provide Recognition and Rewards to Those Who Succeed

Sure, it would be nice if everyone who earns a certification or masters some new body of knowledge could get a 25 percent raise and/or a promotion as a consequence of completing a program of some kind. In some cases, such rewards may even be required to retain employees who earn coveted credentials such as the Cisco CCIE, (ISC)2 CISSP or the ITIL Master Qualification.

However, even small rewards, such as a $100 gift certificate for a family night out or a gift card to a local department store can communicate your appreciation to those employees who manage to chew, swallow and digest what they must bite off to pursue training and certification. A public pat on the back in the employee newsletter or at a period employee meeting doesn't hurt, either. Recognition provides added impetus for employees to finish what they start and shows them that you value the time and effort they must expend in pursuing training and certification.
Ask for Ideas and Suggestions, Then Act Upon Them

Beyond the various methods to stretch your training budget outlined here, you can also turn to your target audience to ask how it thinks you can maximize the return on training and certification. You may be surprised by the quality and quantity of resulting feedback. Most employees respond positively to on-the-job opportunities for career and professional development. They, too, understand that the likelihood of continuing support rests on the outcomes of their training and certification efforts. In the end, they know full well that, by helping the organization excel and improve, they too will benefit from improved job and pay prospects.


Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Saturday 1 November 2014

Major banks prep their own mobile payment apps

The apps could prove to be a major competitor for Apple Pay and competing products

Several major national and international banks are planning to launch their own mobile payments apps next year.

The banks would be major competitors to handset makers Apple and Google because unlike others pushing mobile wallet technology, such as mobile phone carriers and retailers, they already have an intimate relationship with consumers and know their spending habits.

"Banks all around the world are working on this right now," said James Anderson, senior vice president for mobile and emerging payments at MasterCard.

Anderson didn't name any of the banks, but said MasterCard is already in conversations with them on how to add mobile payment capability to the existing apps that millions of consumers already have on their phones.

The most likely way will be through a technology called host card emulation, that was introduced in Android 4.4 "KitKat" and allows software apps to emulate the secure element chip found on some bank cards and the iPhone 6. Using software means wider compatibility with phones than if a dedicated chip was required.

The mobile payments market had been relatively quiet until recently. Google Wallet and Softcard, a competitor backed by cellular carriers, were in the market but consumer awareness and interest appeared to be low.

That changed with the launch of Apple Pay on Oct. 20. A million cards were activated in the first three days of use and early adopters have praised its ease of use: users just need to hold their thumb over the iPhone 6 fingerprint reader and bring the device near a terminal for payment to be made.

As a result, competitors are planning their attack. Next year CurrentC, backed by some of the biggest retailers in the U.S., will launch and companies like PayPal are also hoping to expand their footprint in stores.

But an app from a bank might have an edge because it removes a potential hurdle to adoption: unease among consumers that at a third-party is getting access to details of purchases they make.

Apple has stressed that it doesn't see any of the purchases made by its users but Google's system is set up so that all payments run through the company's servers -- giving the company an additional layer of information into the lives of its users.

A bank already has access to this information because of its nature and is presumably trusted by its customers. If a customer has a banking app on their phone, it would suggest they also have faith in the bank's online security system.


Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Monday 27 October 2014

Internet of Things roundtable: Experts discuss what to look for in IoT platforms

Networking is at the heart of every Internet of Things deployment, connecting sensors and other “Things” to the apps that interpret the data or take action.

But these are still early days. Assembling an IoT network from commercial off-the-shelf components is still, let’s just say, a work in progress. This will change over time, but for now the technical immaturity is being addressed by System Integrators building custom code to connect disparate parts and by a new class of network meta-product known as the IoT Platform.

IoT Platform products are still in their infancy, but there are already more than 20 on the market today. Approaches vary, so when making a build or buy decision, consider these critical areas of IoT Platform tech: security, sensor compatibility, analytics compatibility, APIs and standards.

iot platform diagram Iot-Inc.

To see where we stand on developments in these areas, I emailed experts from seven IoT Platform companies, big and small, asking for input: Roberto De La Mora, Sr. Director at Cisco, Steve Jennis, SVP at PrismTech, Bryan Kester, CEO at SeeControl, Lothar Schubert, Platform Marketing leader, GE Software, Niall Murphy, Founder & CEO at EVRYTHNG, Alan Tait, Technical Manager at Stream Technologies and Raj Vaswani, CTO and Co-Founder, Silver Spring Networks. Here’s what they had to say:

* Security
De La Mora: Security technologies and solutions that are omnipresent in IT networks can be adapted (carefully) to serve Operational Technology in IoT environments. But security is not about adding firewalls or IPS/IDS systems here and there. Cyber Security for IoT should follow a model applied at every layer of the architecture, and be combined with physical security to add intelligence to the operation via data correlation and analytics.

Jennis: Without a standards-based security framework it is very difficult to create communication channels that are both secure and interoperable. An interoperable security solution is very important in order to prevent vendor lock-in and to enable the system to be extended if required.

Kester: Sophisticated customers are encrypting traffic between the sensor board and the cloud. However most deployments are using private VPNs which don’t require a lot precious CPU or RAM from the remote device/system.

Murphy: Crypto-secure digital identities for physical things enable authenticated identities online by applying token-based security methods through Web standards to manage application access to these digital identities.

Vaswani: Embed security at each layer of the network, including sophisticated authentication and authorization techniques for all intelligent endpoints, require digital signatures and private keys to prevent any unauthorized access or activity on the system, and end-to-end encryption for all communications across the network. Incorporating physical tamper detection and resistance technologies further reduces the risk of unauthorized access and monitoring.

* Sensor Compatibility
Jennis: The following Platform considerations should be taken into account:

· Memory footprint – how much memory does the Platform require to function? Some simple sensors have only 128KB of memory to work with.

· Operating system support – does the Platform require a full POSIX-like OS or can it accept something simpler?

· Network stack support, e.g. IPv4, IPv6, 6LoWPAN, other – simple sensors used in Low Power Wireless Area Networks (LoWPAN) may require a cut down IP stack.

· Programming language support – a Platform may provide APIs for only specific programming languages (e.g. C or C++).

· Java dependence – does the Platform require a JVM to function, limiting sensor choices?

Murphy: The most important consideration is recognizing the risks inherent in vertically integrated solution architectures. By definition, the Internet of Things is heterogeneous in the types of things it is connecting. A horizontal architecture, to manage the information from and about the things they are connecting, can abstract the transport layer from the application layer. This allows applications to be developed independently of specific sensor devices, and sensor devices to be changed and network connectivity methods changed without breaking the application dependencies.

Schubert: A Software-Defined Machine (SDM) decouples software from the underlying hardware, making machines directly programmable through machine apps and allows connecting with virtually “any” machine and edge device, including retrofitting machines and connections to legacy systems.

* Analytics Compatibility

De La Mora: Support for structured and non-structured data, ease of integration with existing operation, automation and control systems, and the ability to operate in a distributed computing environment are all important factors for analytic compatibility.

Kester: To do advanced long-term business intelligence, machine learning or Hadoop-type of parallel processing, your Platform choice should have a well-documented and Web accessible API to interface with your analytic product of choice. It should also be easy for any IT employee, or even savvy business analysts, to use without training.

Murphy: The network platform has to enable multiple disparate audiences within a company access to benefit from data collection and perform meaningful analysis. Analytics is often thought of in a reporting sense only, but increasingly analytics is being applied in conjunction with machine learning algorithms and rules logic to drive applications and actuate devices.

Tait: You need to be sure the information you are collecting is stored well (backed up, secure, etc.) and that you have the ability to export your data and you maintain ownership.

Schubert: The tremendous data growth in industrial IoT demands massively scalable, low-cost infrastructure, such as that based on Apache Hadoop v2 and COTS (commercial off-the shelf) hardware. It has to support the various security, compliance and data privacy mandates. Predictive Analytics is how value is delivered to customers. It provides timely foresight into asset and operations, and provides actionable recommendations (when paired with rule engines). Perhaps most important, analytics need to be integrated into the operational processes, rather than be a stand-alone IT solution.

* APIs
De La Mora: RESTful API’s are becoming standard. The abstraction capabilities they provide, along with the architectural model based on the Web, are key. SDK’s that provide API’s that are not compatible with the W3C TAG group are a nonstarter for applications that should be in the end, connected to the Internet.

Jennis: First and foremost, APIs should be clean, type-safe and idiomatic. In addition, APIs should favor non-blocking/asynchronous interaction models to make it easier to build responsive systems. Where possible APIs should be standardized to ease component integration and prevent lock-in.

Murphy: APIs should use Web standards and blueprints (e.g. REST and no WSDL/SOAP), and state-of-art Web security systems. They should also offer ways of extracting the data, not just feeding it in.

Tait: Keep it simple, truly good APIs are clear, concise and have a purpose. They should also do the common things easily.

Schubert: Service-oriented architectures (SOA) and related application development paradigms rely on APIs for integration of services, processes and systems. APIs must be open, accessible and upgrade-compatible.

* Standards
De La Mora: We are calling this the Internet of Things because it will be part of the next generation of the Internet, so the only key standard protocol, that I see in the future, is IPv6.

Kester: Any Platform that is in communication with devices should support the major communication protocols in use today, which are UDP, MQTT, XMPP, CoAP, Modbus/TCP and HTTP.

Murphy: RESTful application programming interfaces, JSON and similar Web-centric formats for data exchange should be used. The Platform that an enterprise uses to manage its physical products and assets as digital assets, needs to be able to integrate smoothly with both the enterprise’s other systems and third party applications. Integration means both the technical protocols of system-to-system interaction (e.g. REST, OAuth) but also critically, the semantics of the information itself.

Vaswani: The use of universal standards such as IP ensures that products can be easily mixed and matched from different vendors to ensure full interoperability and to deliver on other applications supported by an even broader ecosystem of hardware and software players.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com


Sunday 19 October 2014

9 employee insiders who breached security

These disgruntled employees show what can happen when an employer wrongs them.

Security admins used to have to worry about keeping the bad guys out of the network, but there have been many documented cases where the devil you know is sitting right next to you. A review of recent FBI cyber investigations revealed victim businesses incur significant costs ranging from $5,000 to $3 million due to cyber incidents involving disgruntled or former employees, according to AlgoSec. Here are just a few over the years of insiders trying to take down their employer's network.

Terry Childs, the former network administrator for the City of San Francisco, held the city's systems hostage for a time. He refused to surrender passwords because he felt his supervisors were incompetent. Childs was convicted of violating California's computer crime laws in April 2010.

In June 2012, Ricky Joe Mitchell of Charleston, W.Va., a former network engineer for oil and gas company EnerVest, was sentenced to prison for sabotaging the company's systems. He found out he was going to be fired and decided to reset the company's servers to their original factory settings.

It was discovered in 2007 that database administrator William Sullivan had stolen 3.2 million customer records including credit card, banking and personal information from Fidelity National Information Services. Sullivan agreed to plead guilty to federal fraud charges and was sentenced to four years and nine months in prison and ordered to pay a $3.2 million fine.

Flowers Hospital had an insider data breach that occurred from June 2013 to February 2014 when one of its employees stole forms containing patient information and possibly used the stolen information to file fraudulent income tax returns.

According to Techworld.com, 34-year-old Sam Chihlung Yin created a fake VPN token in the name of a non-existent employee which he tricked Gucci IT staff into activating after he was fired in May 2010.

Army Private First Class Bradley Manning released sensitive military documents to WikiLeaks in 2009. Manning, now known as Chelsea Manning, was given a sentence of 35 years in prison.

Back in 2002, Timothy Lloyd was sentenced to three-and-a-half years in prison for planting a software time bomb after he became disgruntled with his employer Omega. The result of the software sabotage was the loss of millions of dollars to the company and the loss of 80 jobs.

Earlier this year, NRAD Medical Associates discovered that an employee radiologist had accessed and acquired protected health information from NRAD’s billing systems without authorization. The breach was estimated to be 97,000 records of patient names and addresses, dates of birth, Social Security information, health insurance, and diagnosis information.

And of course there is the most famous whistleblower of all time: Edward Snowden. Before fleeing the country, he released sensitive NSA documents that became a blowup about government surveillance.




Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Thursday 9 October 2014

Gartner: Top 10 strategic predictions for businesses to watch out for

For a session that is high-tech oriented, this year’s Gartner strategic predictions were decidedly human.

That is to say many were related to increasing the customer’s experience with technology and systems rather than the usual techno-calculations.
Gartner 2014

“Machines are taking an active role in enhancing human endeavors,” said Daryl Plummer is a managing vice president, chief of Research and chief Gartner Fellow. “Our predictions this year maybe not be directly tied to the IT or CIO function but they will affect what you do.”

Plummer outlined the following predictions and a small recommendation as to what IT can do to prepare for the item. Read on:

1. By 2018, digital business requires 50% less business process workers and 500% more key digital business jobs, compared to traditional models. IT leaders — need to develop new hiring practices to recruit for the new nontraditional IT roles.

2. By 2017, a significant disruptive digital business will be launched that was conceived by a computer algorithm. CIOs must begin to simulate technology-driven transformation options for business.

3. By 2018, the total cost of ownership for business operations will be reduced by 30% through smart machines and industrialized services. CIOs must experiment with precursor "almost smart machine" technologies and phantom robotic business process automation. Business leaders must examine the impact of increased wellness on insurance and employee healthcare costs as a competitive factor.

4. By 2020, developed world life expectancy will increase by 0.5 years due to widespread adoption of wireless health monitoring technology. Business leaders must examine the impact of increased wellness on insurance and employee healthcare costs as a competitive factor

5. By year-end 2016, $2.5 billion in online shopping will be performed exclusively by mobile digital assistants. Apple’s Siri is a type of assistant, but many online vendors offer some sort of software-assist that you may or may not be aware of. Marketing executives must develop marketing techniques that capture the attention of digital assistants as well as people. By the end of 2016, $2.5 billion in online shopping will be performed exclusively by mobile digital assistants.

6. By 2017, U.S. customers' mobile engagement behavior will drive U.S. mobile commerce revenue to 50% of U.S. digital commerce revenue. Recommendation: Marketing executives must develop marketing techniques that capture the attention of digital assistants as well as people. Mobile marketing teams investigate mobile wallets such as Apple's Passbook and Google Wallet as consumer interest in mobile commerce and payments grows.

7. By 2016, 70% of successful digital business models will rely on deliberately unstable processes designed to shift as customer needs shift. CIO need to create an agile, responsive workforce that is accountable, responsive, and supports your organizational liquidity.

8. By 2017, more than half of consumer product and service R&D investments will be redirected to customer experience innovations. Consumer companies must invest in customer insight through persona and ethnographic research.

9. By 2017, nearly 20% of durable goods e-tailers will use 3D printing to create personalized product offerings. CIOs, product development leaders, and business partners—evaluate gaps between the existing "as is" and future "to be" state (process, skills, and technology.)

10. By 2018, retail businesses that utilize targeted messaging in combination with internal positioning systems (systems that know you are in or near a store) will see a 20% increase in customer visits. CIOs must help expand good customer data to support real-time offers.


Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Friday 26 September 2014

First Look: BlackBerry Passport

BlackBerry does an about-face, back towards its enterprise roots.

So BB 10 didn't work out so well, did it?
Which helps explain why, with the new Passport smartphone, BlackBerry is ditching the years-late emphasis on competing for consumers and refocusing on the enterprise users on which the company was built. The Passport is uniquely focused on being a device for work first and personal stuff second - take a look at how it's turned out.

It's hip to be square
We're just not used to square screens anymore, are we? I think the last one I used was on a flip-phone, circa about 2005. So in a sense, BlackBerry's not putting the Passport in great company there. Given that this screen is 4.5 inches and boasts 1440x1440 resolution, though, it's probably OK.

Big in Canada
It's a big device, there's no getting around that - as the name suggests, it's the size of a U.S. passport. That said, it's no more outsized than other recently released phablets like the Samsung Galaxy Note 4 or the iPhone 6 Plus.

Of course it has a keyboard
It's a new design, and it incorporates some intriguing touchpad functionality, like swiping to select auto-suggest entries. And it's a business-focused BlackBerry device - of course it has a physical keyboard.

A voice search thingy!
One of many catch-up boxes checked by the Passport, the new voice search functionality appears to work more or less the same way as Siri/Cortana/Google Voice search, et al.

Blend
The impressive BlackBerry Blend system provides an app that can run on other mobile devices, as well as on desktops and laptops, that brings files and messages from the Passport to whichever device you happen to be using at the time, and segregates them into personal and enterprise spaces.

Some apps
BlackBerry bolsters its own somewhat limited app offerings with access to the Amazon App Store, which provides a larger selection of Android apps for use on the Passport.

Under the hood
The Passport's specs bring it into line with the latest Androids and iPhones - a 2.2GHz, quad-core Snapdragon processor, 3GB of RAM, a 13MP camera with optical image stabilization and 32GB of on-board storage, with a microSD slot for expandability. It's also got a big 3450 mAh battery, which BlackBerry was eager to talk up.

The nitty-gritty
The Passport goes on sale tomorrow from Amazon and BlackBerry directly, for $600 unlocked. It'll be available on-contract from as-yet unspecified carriers for about $250, BlackBerry said.




Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com



Monday 1 September 2014

Android Power's 3 favorite things for August 2014

From powerful custom shortcuts to pleasingly pretty home screens, these three simple tools bring fresh functionality to any Android phone or tablet.

This summer's been a wild one for mobile tech launches, and that means it's been a while since I've had a chance to take a deep breath and think about all the interesting little treasures that round out the Android experience.

From apps to accessories and everything in between, Android is full of easily overlooked items -- seemingly small things that make our lives easier or make the mobile landscape a more pleasant place to live.

Now that we have a brief breather between the rapid-fire product launches, I thought I'd take a moment to step back and shine the light on a few of my favorite things, as I occasionally like to do.

So without further ado, here are three things I'm particularly fond of at the moment:

1. TapPath
Sometimes it's the simplest ideas that make the biggest impact. TapPath is a perfect example: The app, created by the same developer behind Link Bubble and Action Launcher, does one very focused but useful thing: It lets you expand and control what happens when you tap a link on your phone or tablet.

Normally, when you tap a link in a third-party app, the link opens in your default browser. With TapPath, you can specify different destinations that you can then trigger by single-tapping, double-tapping, or even triple-tapping any link from anywhere in the system.

Why bother, you might be wondering? Easy: It can save you time by giving you a powerful set of custom universal shortcuts. You might set a single-tap to open a link in your browser, for instance, a double-link to save it directly to Pocket, and a triple-link to open it with the system share picker so you can send it directly to any other destination. There are all sorts of possibilities.

TapPath isn't the kind of thing I'd recommend for a novice user, but for those of us who like to take full control of our phones, it's an incredibly handy tool to have.


2. Commandr
I've mentioned Commandr before, but it's cool enough to deserve a formal spot in this month's roundup. The app, which is free with an optional donation, makes your Android device's Voice Search function more powerful than ever.

All you do is set Commandr up on your phone or tablet, and it gives you a whole range of new voice command options -- you know, the things you can say after "Okay, Google" or after tapping the microphone icon that's part of Google Now. The commands work as if they were part of Android's native Voice Search system, too, so once the app is installed, you'll never actively think about it again.

Since I last discussed it, Commandr has grown to provide an even wider range of interesting possibilities. It could already do things like toggle your device's Wi-Fi, Bluetooth, or flashlight and control music playback by voice. Now it also gives you native-like voice commands for having your new Gmail messages read aloud, adjusting your device's volume, and controlling your camera.

Commandr can integrate with Tasker for even more advanced functionality, if you want. Its developer also adds new commands quite frequently, so the list of options is always expanding.

All in all, it's one of the most useful apps I've seen in some time and a prime example of how Android's flexibility can work for you.

3. SmugZei
You remember Muzei, right? It's the simple (and free) app by Android Developer Advocate Roman Nurik that changes your wallpaper to a new image every day.

I recently stumbled onto a great (and also free) extension for Muzei called SmugZei. It connects to an online photography gallery called SmugMug to pull in gorgeous photographs for your phone's background.

Muzei, SmugZei, SmugMug -- sounds like an awful lot of gibberish, I know. But forget about the silliness of the names and stick with me for a minute.

The reason this extension caught my eye is that some well-known photographers upload their images to SmugMug for anyone to enjoy. One of them is the talented Trey Ratcliff, whose images I've enjoyed via Google+ for quite a while.

With Muzei and SmugZei, I see a different one of Trey's gorgeous photos as my phone's wallpaper every day. I don't have to do anything; the app just automatically changes out the wallpaper to a new photo every several hours. It's a delightful surprise every time -- and it's really refreshing to have my home screen take on a different and equally beautiful look so often.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Wednesday 20 August 2014

Lenovo N20p Chromebook review: An affordable dual-mode device

Lenovo's latest Chromebook functions as both a regular laptop and a stand-supported tablet. But what is it like to use in the real world?

When you think of a Chromebook, you typically think of a keyboard-centric laptop -- but Lenovo's hoping to shake up that mindset with some versatile new devices.

The company has come out with a couple of convertible Chromebooks that can act as both traditional laptops and touchscreen tablets. The first, the Lenovo N20p Chromebook, costs $330 and offers a 300-degree tilting display. The second, the ThinkPad Yoga 11e Chromebook, costs $479 and features a higher-quality screen that bends back a full 360 degrees.

I've been living with the N20p model to start with, and one thing's for sure: It offers a Chrome OS experience like no other.
Body, design and that tilting display

At first glance, Lenovo's N20p Chromebook looks like any run-of-the-mill laptop: The computer has a matte-plastic gray casing with Lenovo's logo and the Google Chrome logo at its top. Open the lid and you're greeted by an 11.6-in. screen and a chiclet-style Chrome OS keyboard.

In that mode, the N20p Chromebook is pleasant enough to use: It's one of the higher-quality devices in its class, with sturdy construction, a commendable keyboard and a smooth-feeling and responsive trackpad. If you press on the center of the lid, you do feel a little give -- almost a slight springiness -- but by and large, the N20p seems well-built and less flimsy than some of the cheaper options in its price range.

The N20p is comfortable to hold on your lap, too: The laptop is 11.6 x 8.3 x 0.7 in. and 2.9 lbs. -- slightly heavier than some of the less sturdy devices of its size but still quite light and easy to carry.

As with other touch-enabled Chromebooks, you have the ability to tap, scroll or zoom the N20p's screen with your fingers, which I find to be a surprisingly useful feature. It's even more interesting, though, when you push the N20p's display back beyond the standard stopping point -- past the flattened-out 180-degree mark and all the way around to its fully tilted stand mode.

In that mode, you actually end up with the keyboard upside-down -- in other words, with keys facing downward -- serving as a base. The keyboard is automatically disabled in that state, so you don't have to worry about accidental key presses. Instead, what you get is a tablet-like experience, complete with a virtual on-screen keyboard that appears when you need it.

Coupled with the N20p's touch input, this setup works incredibly well. It opens up a whole new range of uses for the device while still leaving its traditional operations in place.

I've been using the N20p Chromebook in its laptop mode for work, for instance, then flipping the screen around and shifting into stand mode when I want to do something less input-oriented and more browsing-based -- catching up on articles I've opened throughout the day, scrolling through my social media streams or watching videos with the device resting comfortably on my lap.

It's reached the point where shifting between the system's two modes feels effortless and natural to me, and I've really grown to appreciate having that option. Chrome OS itself isn't entirely optimized for touch, so certain things are still a little awkward -- like trying to tap the small "x" to close a tab with your finger, for example -- but all in all, the touch-centric stand experience is quite pleasant. You just have to think of it as a complement to the traditional laptop environment rather than a replacement for it.

When the N20p is in its stand mode, the user interface does change a bit: All windows appear maximized, while a button shows up in the bottom-right area of the screen that allows you to switch between opened windows using a graphical interface. (Those already familiar with Chromebooks will note that it's the same task-switching command also present on the top row of the regular Chrome OS keyboard.)

The on-screen keyboard works well enough, too, though if you're typing anything more than a few words, you'll almost certainly want to flip the system back around into its laptop mode for easier text input. Given the choice on any device, I think a full-size physical keyboard is always going to be preferable for heavy-duty typing.

Because the screen can be adjusted to any position while the N20p is in its stand mode, you can flip the laptop into a tent-like arrangement if you want -- or even onto its side for a vertically oriented portrait view. I haven't found a need to use either of those orientations, but the possibilities are there if you want them.

As for the display itself, it's the same 1366 x 768 TN panel found in most lower-end Chromebooks these days -- but even within those parameters, it's one of the better screens I've seen. It's glossy, bright and less grainy than the displays on many similarly priced systems. Viewing angles aren't great and it's no match for a higher-quality IPS display, but I've been able to use it for full days without being annoyed or feeling any significant eyestrain.

On the left edge of its frame, Lenovo's N20p Chromebook has a proprietary charging port along with a USB 3.0 port, a dedicated HDMI-out port and a 3.5mm headphone jack. The laptop's right edge, meanwhile, holds a USB 2.0 port and a physical power button -- something slightly different from most Chromebooks, where the power button exists on the keyboard.

The N20p Chromebook has two speakers on either side of its bottom surface. The speakers are pretty decent, with loud, clear and full-sounding audio. They're not the best you'll ever hear, but for this class of device, they're actually quite impressive.

Performance

So far so good, right? Unfortunately, there is one asterisk with Lenovo's N20p Chromebook -- and it's on the subject of performance.

The N20p Chromebook uses one of Intel's new Bay Trail processors -- the Intel Celeron N2830 -- along with 2GB of RAM. In real-world use, it feels like a meaningful step backward from the level of performance I've grown accustomed to seeing with the recent crop of Chrome OS devices, most of which are powered by Intel's speedier Haswell-based chips.

To see the difference between two Chrome OS devices that use Intel processors, I compared the N20p to an Asus Chromebox, with a Haswell-based Cerelon 2955U processor and 2GB of RAM. The N20p Chromebook was consistently slower at loading pages -- by as much as two to six seconds, depending on the site -- and just seemed significantly less zippy overall.

Cons: Low-resolution display with low-quality TN panel; performance not as good as that of other Chromebooks in its class

In fact, even without a side-by-side comparison, the N20p just doesn't feel terribly snappy. I noticed its limitations the most in situations where I had several browser tabs running; there, the device really seemed to struggle and reach levels of sluggishness I haven't experienced on Chrome OS in quite some time.

All things considered, I'd say this: If you're like most people and tend to keep only one or two tabs open at a time, the N20p should be fine for your needs. It's still a noticeable step down from the level of performance you'd get from other similarly priced or even less expensive systems -- which is disappointing, to say the least -- but for basic levels of use, it's acceptable enough and may be a worthwhile tradeoff for all of the device's positives. If you do any resource-intensive multitasking, however, you're going to find yourself frustrated by the relatively low performance ceiling.

Lenovo does offer a model of the N20p Chromebook with a slightly higher-end Bay Trail processor, the Intel Celeron N2930; that model is sold only via Lenovo's website and costs $20 more than the regular base model. While I haven't had an opportunity to test it firsthand, the promise of enhanced performance seems to make the extra $20 a worthwhile investment.

The N20p does do reasonably well in terms of battery life: The laptop is listed for eight hours of use per charge, which is pretty much in line with what I've gotten. As for storage, the device comes with 16GB of onboard space along with the option to expand with your own SD card.
Bottom line

Lenovo's N20p Chromebook offers a compelling experience that goes beyond what the typical Chromebook provides. The tilting display really is a nice touch that expands the device's potential and opens it up to new and interesting types of uses.

The system is held back, however, by lower than average performance -- something we'll probably be seeing more of as Intel's Bay Trail chips make their way into more Chrome OS devices. That's a factor you'll have to closely consider in determining whether the N20p Chromebook is right for you.

The N20p Chromebook is a standout device with lots of attractive qualities. For folks in the power-user camp, it's just a shame it's not available with the more robust internals that other similarly priced products provide.

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com


Saturday 2 August 2014

In search of a social site that doesn't lie

Facebook and OKCupid experiment on users. So what's wrong with that?

Rudder's post described a few of the experiments that the dating website had carried out. In one, OKCupid told people that they would be good matches with certain other people even though the site's algorithms had determined that they would be bad matches. That's right: The company deliberately lied to its users. OKCupid wanted to see if people liked each other because they have the capacity to make up their own minds about who they like, or if they like each other because OKCupid tells them they should like each other.

(The controversial post was Rudder's first in several years; he had taken time off to write a book about experimenting on people. Due out next month, the book is called Dataclysm: Who We Are (When We Think No One's Looking).)

The OKCupid post was in part a response to controversy over a recently discovered Facebook experiment, the results of which were published in an academic journal. Facebook wanted to see if people would post more negative posts if their own News Feeds had more negative posts from their friends. In the experiment, Facebook removed some posts by family and friends because they were positive. The experiment involved deliberately making people sadder by censoring friends' more uplifting and positive posts.

Don't like this kind of manipulation? Here's Rudder's response: "Guess what, everybody: if you use the Internet, you're the subject of hundreds of experiments at any given time, on every site.

That's how websites work."


What's wrong here

Rudder's "everyone is doing it" rationalization for experimenting on users makes it clear that he doesn't understand the difference between what OKCupid and Facebook are doing, and what other sites that conduct A/B tests of different options are doing.

The difference is that OKCupid and Facebook are potentially changing, damaging or affecting the real relationships of real people. They are manipulating the happiness of people on purpose.

These companies might argue that this damage to the mood and relationships of people is small to the point of being inconsequential. But what makes them think it's OK to deliberately do any damage at all?

The other glaring problem with these social science experiments is that the subjects don't know they're participating.

Yes, I'm sure company lawyers can argue in court that the Terms of Service that everyone agreed to (but almost nobody read) gives OKCupid and Facebook the right to do everything they do. And I'm sure the sites believe that they're working so hard and investing so much to provide free services that users owe them big time, and that makes it all OK.

Imagine a splash screen that pops up each month on these sites that says: "Hi. Just wanted to make sure you're aware that we do experiments on people, and we might do experiments on you. We might lie to you, meddle in your relationships and make you feel bad, just to see what you'll do."

No, you can't imagine it. The reason is that the business models of sites like OKCupid and Facebook are based on the assumption of user ignorance.
Why OKCupid and Facebook think it's OK to mess with people's relationships

The OKCupid admission and the revelations about the Facebook research were shocking to the public because we weren't aware of the evolving mindset behind social websites. No doubt the OKCupid people and the Facebook people arrived at their coldly cynical view of users as lab rats via a long, evolutionary slippery slope.

Let's imagine the process with Facebook. Zuckerberg drops out of Harvard, moves to Silicon Valley, gets funded and starts building Facebook into a social network. Zuck and the guys want to make Facebook super appealing, but they notice a disconnect in human reason, a bias that is leading heavy Facebook users to be unhappy.

You see, people want to follow and share and post a lot, and Facebook wants users to be active. But when everybody posts a lot, the incoming streams are overwhelming, and that makes Facebook users unhappy. What to do?

The solution is to use software algorithms to selectively choose which posts to let through and which to hold back. But what criteria do you use?

Facebook's current algorithm, which is no longer called Edgerank (I guess if you get rid of the name, people won't talk about it), is the product of thousands of social experiments -- testing and tweaking and checking and refining until everyone is happy.

The result of those experiments is that Facebook changes your relationships. For example, let's say you follow 20 friends from high school. You feel confident that by following them -- and by them following you -- that you have a reliable social connection to these people that replaces phone calls, emails and other forms of communication.

Let's say you have a good friend named Brian who doesn't post a lot of personal stuff. And you have another friend, Sophia, who is someone you don't care about but who is very active and posts funny stuff every day. After a period of several months during which you barely interact with Brian but occasionally like and comment on Sophia's posts, Facebook decides to cut Brian's posts out of your News Feed while maintaining the steady stream of Sophia posts. Facebook boldly ends your relationship with Brian, someone you care about. When Brian posts an emotional item about the birth of his child, you don't see it because Facebook has eliminated your connection to Brian.

And don't get me started on OKCupid's algorithms and how they could affect the outcome of people's lives.

Not only do both companies experiment all the time; their experiments make huge changes to users' relationships.

The real danger with these experiments
You might think that the real problem is that social networks that lie to people, manipulate their relationships and regularly perform experiments on their users are succeeding. For example, when Facebook issued its financial report last month, it said revenue rose 61% to $2.91 billion, up from $1.81 billion in the same quarter a year ago. The company's stock soared after the report came out.

Twitter, which is currently a straightforward, honest, nonmanipulative social network, has apparently seen the error of its ways and is seriously considering the Facebook path to financial success. Twitter CEO Dick Costolo said in an interview this week that he "wouldn't rule out any kind of experiment we might be running there around algorithmically curated experiences or otherwise."

No, the real problem is that OKCupid and Facebook may take action based on the results of their research. In both cases, the companies say they're experimenting in order to improve their service.

In the case of OKCupid, the company found that connecting people who are incompatible ends up working out better than it thought. So based on that result, in the future it may match up more people it has identified as incompatible.

In the case of Facebook, it did find that mood is contagious. So maybe it will "improve" Facebook in the future to build in a bias for positive, happy posts in order to make users happier with Facebook than they are with networks that don't filter based on positivity.

What's the solution?

While Twitter may follow Facebook down the rabbit hole of user manipulation, there is a category of "social network" where what you see is what you get -- namely, messaging apps.

When you send a message via, say, WhatsApp or Snapchat or any of the dozens of new apps that have emerged recently, the other person gets it. WhatsApp and Snapchat don't have algorithms that choose to not deliver most of your messages. They don't try to make you happy or sad or connect you with incompatible people to see what happens. They just deliver your communication.

I suspect that's one of the reasons younger users are increasingly embracing these alternatives to the big social networks. They're straightforward and honest and do what they appear to do, rather than manipulating everything behind the scenes.

Still, I'd love to see at least one major social site embrace honesty and respect for users as a core principle. That would mean no lying to users, no doing experiments on them without their clear knowledge, and delivering by default all of the posts of the people they follow.

In other words, I'd love to see the founders of social sites write blog posts that brag: "We DON'T experiment on human beings."

Wouldn't that be nice?

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com


Sunday 29 June 2014

Network World's 2014 State of the Network survey

Aligning IT with the business has been a top priority of IT organizations for the past few years, but that is changing, according to the latest State of the Network Survey. IT has apparently made enough headway on the alignment issue that other priorities are coming to the fore. The No. 1 business objective of the 282 IT respondents is decreasing operational costs, while the top technology objective is lowering IT operational costs through server consolidation and overall IT simplification. Continue for more survey results.

When asked about the benefits of SDN, network flexibility is by far the most anticipated benefit, followed by simplified network operation and management. Reducing CAPEX and OPEX are far down on the list, which means IT might have a hard time convincing the CEO and CFO to take the plunge into the world of SDN if there’s no clear financial benefit.

So, where are people deploying SDN? According to our survey, the most popular place for SDN pilot projects is the data center (14%), followed by enterprise/WAN (10%). And a few brave souls (6%) are tackling both. But a full 50% of respondents are still sitting on the sidelines.

The data center is expected to be the biggest beneficiary of SDN technology, according to respondents, followed by enterprise/WAN. Only 10% of respondents plan to take on SDN deployments in both the data center and throughout the enterprise/WAN. And a full 33% of respondents said that SDN is not on their radar at all.

When it comes to thought leadership in the emerging field of SDN, a full 52% of respondents said they weren’t sure, which means there’s plenty of opportunity for an established vendor or an upstart newcomer to grab the attention of enterprise IT buyers. In the meantime, the usual suspects are at the top of the list, with Cisco at 22%, Juniper at 12%, HP at 11% and Nicira/VMware with a combined 14%.

When it comes to security related challenges, clearly IT execs are facing a number of new problems, with advanced persistent threats high on the list, following by mobile/BYOD, and cloud security. But surprisingly the No. 1 challenge was end users. Respondents said getting awareness and cooperation from end users was their biggest headache.

Productivity-related challenges fell into the very traditional categories, with money being far and away the top impediment to increased IT productivity, according to respondents. Traditional concerns like security, privacy and finding the right talent were at the top of the list. At the bottom on the list are two seemingly hot technologies – video and social media. But it seems that enterprise IT has bigger fish to fry.

Protecting the network/data center against data breaches and data leaks is Job One, according to respondents. Traditional IT metrics like uptime and optimizing end-to-end performance were high on the list. Interestingly, respondents put cloud-related projects lower down on their priority lists.

Protecting the network/data center against data breaches and data leaks is Job One, according to respondents. Traditional IT metrics like uptime and optimizing end-to-end performance were high on the list. Interestingly, respondents put cloud-related projects lower down on their priority lists.

Bad news for Satya Nadella: Nearly half of respondents say a migration to Windows 8 isn’t even on their radar. Only 7% of enterprise IT respondents have migrated to Microsoft’s latest OS, while only 10% are in the pilot stage.

Cloud services are certainly gaining in popularity, but among our respondents, enthusiasm for Infrastructure-as-a-Service is pretty tepid. Only 15% of respondents are using IaaS, with another 7% piloting and 10% researching. However, 45% of respondents don’t have IaaS on their radar.

IT execs in our survey are making good progress when it comes to implementing a BYOD policy. Already, 18% have rolled out a BYOD policy, with another 18% in the pilot stage. Only 30% of respondents are ignoring the need for a formal BYOD policy.

Our respondents were gung-ho when it comes to server consolidation: a full 44% have already implemented this cost saving measure, while 9% were in the pilot stage, 14% were researching and another 13% had server consolidation on their radar.

Our respondents were gung-ho when it comes to server consolidation: a full 44% have already implemented this cost saving measure, while 9% were in the pilot stage, 14% were researching and another 13% had server consolidation on their radar.

The move toward flattening the data center – moving from a traditional three-tier, spanning-tree architecture to something more streamlined and efficient – appears to be going strong. Eighteen percent of respondents have already achieved some level of data center network flattening, while 17% are in the research phase and 9% are actively piloting.

The move toward flattening the data center – moving from a traditional three-tier, spanning-tree architecture to something more streamlined and efficient – appears to be going strong. Eighteen percent of respondents have already achieved some level of data center network flattening, while 17% are in the research phase and 9% are actively piloting.

WAN optimization is a proven money saver for enterprise IT. And adoption of this technology appears to be on the rise, with 16% of respondents having achieved some level of WAN optimization, another 18% in the pilot phase and 17% researching the technology.



Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com


Monday 16 June 2014

Three best practices for reducing the risk of SQL injection attacks

This column is available in a weekly newsletter called IT Best Practices. Click here to subscribe.

SQL injection attacks have been around for more than 10 years. Database security experts know they are a serious problem. Now a recently unsealed Second Superseding Indictment against a notorious group of Russian and Ukrainian hackers shows just how damaging this type of attack can be.

The indictment provides a long list of companies that have suffered costly data breaches where the root cause has proven to be a SQL injection. According to the indictment:

Beginning on or around Dec. 26, 2007, Heartland Payment Systems was the victim of a SQL injection attack that resulted in malware being placed on its payment processing system and the theft of more than 130 million card numbers and losses of approximately $200 million.
In or about early November 2007, a related company of Hannaford Brothers Co. was the victim of a SQL injection attack that resulted in the later placement of malware on Hannaford's network, the theft of approximately 4.2 million card numbers.
Between January 2011 and March 2012, Global Payment Systems was the victim of SQL injection attacks that resulted in malware being placed on its payment processing system, the theft of more than 950,000 card numbers, and losses of approximately $92.7 million.
In or around May 2007,NASDAQ was the victim of a SQL injection attack that resulted in the placement of malware on its network and the theft of login credentials.

I think you are beginning to see the pattern here. Other companies cited in this indictment as victims of attacks include 7-Eleven, JC Penney, Carrefour S.A., Wet Seal, Commidea, Dexia Bank Belgium, JetBlue Airways, Dow Jones, Euronet, Visa Jordan Card Services, Diners Club International, lngenicard US and an unnamed bank.
MORE ON NETWORK WORLD: Free security tools you should try

The indictment goes on to say that “conservatively, the defendants and their co-conspirators unlawfully acquired over 160 million card numbers through their hacking activities. As a result of this conduct, financial institutions, credit card companies, and consumers suffered hundreds of millions in losses, including losses in excess of $300 million by just three of the corporate victims, and immeasurable losses to the identity theft victims due to the costs associated with stolen identities and fraudulent charges.”

These particular breaches occurred in 2007. Think how many additional breaches, large and small, have occurred since then.

I think it will come to light that the recent Target, Neiman Marcus and Michaels breaches also might stem from SQL injection attacks of some sort. Though it hasn’t been made public, security experts are already saying that the Target breach used SQL injection to install malware on the point-of-sale systems where the attackers were then able to collect the card numbers out of memory. Many people don’t realize that SQL can be bidirectional. It can be used to drain the database but it also can be used to modify and upload to a database. An attacker can use SQL injection to upload the malware into the database system and then have that system send out the malware to all the POS endpoints.

Structured Query Language is flawed because of the way it was architected. It can be fooled into trying to interpret data as an instruction. On the other hand, there’s a lot of capability in SQL that makes it attractive to developers, especially for web applications.

Since the consequences of SQL injection attacks can be so damaging, I asked Michael Sabo of DB Networks about best practices that companies can follow in order to reduce their risk of this threat. Sabo says there’s no silver bullet, but he does have some advice.

“Often you will hear, ‘if you just do this, or just do that, the problem will go away’,” says Sabo. “But it’s not that simple. Any individual countermeasure can go a long way but it is not going to close the threat. It doesn’t work that way.”

He says that one popular countermeasure that is promoted by the Open Web Application Security Project (OWASP) is to write perfect code. “Even if I write perfect application code, I can still be vulnerable because the vulnerabilities come in through third-party software that I had nothing to do with,” says Sabo. “Look at Ruby on Rails. Who knew that the underlying framework was vulnerable? It affected 250,000 websites with a SQL injection vulnerability because those developers built their websites on top of the vulnerable framework.”

Sabo says there are instances in which they have found vulnerabilities in the relational database management system itself. “Oracle has had SQL injection vulnerabilities in the RDMS itself, so regardless of how good I write my application code, I can still be vulnerable,” he says.

Short of having perfect code, there are three critical things companies can do to reduce the risk of experiencing a SQL injection attack.

The first is to conduct an inventory of what you have as far as databases go, and understand their connections to applications. “Many companies are completely unaware of some of the databases in their environment,” says Sabo. “And even if they know about all their databases, often what happens is the database is being exposed on network segments that it’s not supposed to be exposed on. This is not a database problem per se, but a networking problem.”

For example, Sabo says a company might bring up a database in a test environment and then forget to close it down at the end of testing. Often that database might have default passwords, and sometimes it has real data. Developers do this sort of thing because they want to stress test the application and they use real rather than fake data because they think no one will ever see it.

Then there is the mapping issue. What applications are mapped to the database, and are they the correct ones? “Maybe for a test, a production database was connected up to a test database for a short while and then the connection was left by accident. Or a production database is mapped to an application that was retired, or that no one knows about. These things happen,” says Sabo. “So our first best practice is to provide visibility and an inventory into what databases you have and what they are mapped to.”

The next step is to continuously monitor what is going on between your application and the database. This is actually a recommendation from NIST. You will want to know if there is any rogue traffic going on there. This is where you look for SQL injections because you see the real SQL going across. There are tools that continuously monitor this traffic and detect if there is an unauthorized attempt at modifying data or getting data out.

And finally, the last best practice is to protect the database network with data loss prevention tools. “If you start to see credit card information coming out over the network and you know it shouldn’t be coming out that way, you know there is a problem,” says Sabo.

If your organization has some serious data to protect, and you know how common SQL injection attacks are, then it may benefit you to put these recommendations into practice.


Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com