Cyber Crime - A Threat to Every Internet User

According to the Federal trade Commission (FTC), there are around 10 million reported cases of identity theft each year in the United States. A recent report by Eugene Kaspersky, founder and head analyst of Kaspersky Labs (a leading internet security company), indicates that the level of criminal activity on the internet has doubled in the past year, and there is reason to believe this trend will continue to grow exponentially in the future.

Cyber crime has become a serious problem for everyone who uses the internet. The biggest threats to all internet users are malicious software programs known as crimeware and social engineering schemes, often referred to as phishing and pharming scams.

Although computer viruses have always presented a big problem regarding potential loss of data or damage to our computers, spyware and phishing scams are where the real danger is. These forms of internet crime don't hurt our computers - they cause personal damage.

Spyware

The most common form of crime-ware comes in the form of spyware, which is a small program or piece of code that is designed to "spy" on your online activity and/or personal information. There are many types and forms of spyware and new versions are introduced into the internet every day.

Although not all spyware is used for illegal purposes, much of it can be very dangerous due of its ability to record keystrokes, take snapshots of our PC screen, and monitor everything we do online. Spyware usually installs without anyone's knowledge and runs silently in the background.

The information gathered by spyware is secretly transmitted to the person who planted it. It is sometimes sent out via email without our knowledge, but more often it is relayed to a hijacked "slave" computer, where it is picked up by the criminal who installed it. He/she will either use it to access bank accounts or credit cards, sell it to another thief, or perhaps steal our identity altogether.

Some spyware is used to "hijack" computers, turning them into "slaves" that are used to collect and store data that was obtained illegally. The computer's owner rarely knows that his PC is being used to house illegal information. Many "slave" computers are also used to help social engineers collect data via Pharming scams.

Phishing Scams

One of the most popular criminal activities on the internet is Phishing. In fact, this type of scam is so prevalent that an estimated 99% of email users have seen at least one phishing scam in their inbox. Phishing is mostly done via email, and is usually performed in conjunction with Pharming. Social engineers often send email letters that appear to come from your bank or other financial institution. The message urges you to click the link, log in, and verify your credentials. These emails sound and look very legitimate, and this is why so many people follow through by clicking the link.

Pharming

Once a person has clicked a link in a fraudulent Phishing email, they are taken to a website that appears to be legitimate. This is because the social engineer has copied the home page of the financial institution. What most victims don't realize is that the website they are on is really in some third world country, or on a "slave" computer that has been hijacked by spyware. The Pharming occurs when the person enters his/her credentials to "log on" to their account. This provides the Pharmer with all the information he needs to quickly wipe out the account or charge up a fortune on the associated credit card.

How to Protect Yourself Online

There are several things you can do to protect yourself from cyber-crime. The most obvious is to use good internet security products. At minimum, everyone who uses the internet should be using a good personal firewall, anti-spyware software, and anti-virus software.

The easiest, most effective way for most home computer users to stay protected is to purchase an internet security suite. A suite will include antivirus, anti-spyware/anti-adware, software firewall, and possibly some extras like a spam filter and password protection software. Suites are easy to use because everything is controlled via one interface.

There are many "free" things you can and should do to protect yourself from cyber-crime, such as keeping your computer's operating system and all applications up-to-date. This combined with the implementation of cautious browsing and email habits will have a big impact on your safety.

Internet Security Suites [http://www.antivirus-firewall-spyware.com/computer-security-suites.html]

How to Protect Yourself Online [http://www.antivirus-firewall-spyware.com/Free-Report.html]

Computer Security for Everyone

Security Poll

There are plenty of threats to secure personal computing. Just using the Internet at all exposes you to identity theft, spyware, viruses and more. The question of the day is this: in your opinion, what is the biggest concern or most insidious threat to your safe and secure use of your computer? Vote below and check out the poll results to find out what others think. Poll:What Do You Think Is The Biggest Threat To Computer Security?Viruses or WormsSpamPhishing AttacksSpyware and AdwareRootkitsInsecure Wireless NetworksInstant Messaging and P2P ApplicationsLack of User AwarenessView Results

View the original article here

Anti-Spyware Coalition - Watching the Henhouse

In 2003 the Consortium of Anti-Spyware Technology vendors (COAST) was formed to "collaborate on projects to increase awareness of issues involving spyware." Their goals included helping consumers understand what had been installed on their systems, enabling them to remove what they didn't want and pressuring the advertising software industry to change their business practices.

However, things began to unravel when several founding members (Lavasoft, Computer Associates, Webroot and Aluria) pulled out of the consortium, reportedly because of the group's inability to create a set of standards and code of ethics. Some of those departing members also indicated that COAST had begun to certify -- for a fee -- certain publishers that were known by many anti-spyware firms as purveyors of spyware. Yes, my friends, allegedly the fox was watching the henhouse!

So COAST basically disintegrated and many say that was a good thing! The good news is this: in early 2005 the Center for Democracy and Technology (CDT) convened a meeting with industry anti-spyware leaders to discuss issues facing the anti-spyware industry, and the Anti-Spyware Coalition (ASC) was then formed. The new group includes the original COAST founders as well as consumer groups, academia and just about every big name in computing, including all the top anti-virus players.

Spyware has previously been defined as a computer program that, surreptitiously, gathers information without the knowledge of the user and may port that data back to another entity or as software that asserts control over a computer without the user's knowledge.

One of the first tasks that ASC did was to create a formal definition of spyware and other potentially unwanted technologies. Their description is this: Technologies deployed without appropriate user consent and/or implemented in ways that impair user control over the following: (1) material changes that affect their user experience, privacy or system security; (2) use of their system resources, including the programs that are installed on their computers; and/or (3) collection, use and distribution of their personal or other sensitive information.

Another task of ASC was to create a set of common industry guidelines for publishers who allege that their software has been improperly flagged as spyware. This is an important step because, well frankly, sometimes anti-spyware vendors make mistakes and it can be quite costly for a publisher to be flagged as a bad guy! The guidelines are just that -- guidelines -- ASC does not independently resolve the disputes but has framed recommended best practices for anti-spyware software publishers. Bravo!

ASC also has published a glossary of terms commonly used in discussions about spyware and a list of anti-spyware Safety Tips to provide basic guidelines for consumers to protect themselves and their computers. They recommend that users keep their security patches up to date, download programs only from websites they trust, read the fine print in license agreements, not be tricked into clicking anything on a popup window, beware of free software and use tools to detect and delete spyware.

In an effort to fight spyware, three U.S. Senators have introduced a bill that would attempt to combat this plague by making it a crime to offer this type of spying computer program. The bill (S.2145) is entitled "Software Principles Yielding Better Levels of Consumer Knowledge Act," or the "SPY BLOCK Act." Cute name!

If passed it will outlaw software that, without explicit user permission, installs itself or other programs, reconfigures settings (or redirects the user), captures personal information or keeps track of visited websites. And, this is the best part: the software must disclose in clear language each aspect of what the program will do to your computer and with your information and must obtain your consent to do so.

In addition, the software must be easily uninstallable through the "add and remove programs" feature (in Windows OS) or other standard methods. Spyware programs are so notoriously difficult to remove from infected systems they are often referred to as parasitic. It appears the proposed legislation is lingering in committee. So, we'll have to wait to see what happens to publishers of "unwanted technology" if SPY BLOCK ever becomes law.

According to a recent study by the Pew Internet & American Life Project, nine out of ten Internet users say they have adjusted their online behavior out of fear of falling victim to software intrusions and about 59 million American adults, say they have had spyware or adware on their home computer. Additionally the project reports that 68% of home Internet users or about 93 million American adults have experienced at least one computer problem in the past year that was consistent with problems caused by spyware or viruses.

While those stats are discouraging, the report also indicated that 25% of Internet users say they have stopped downloading music or video files from peer-to-peer networks to avoid getting unwanted software programs on their computers. Perhaps there is some silver lining to the epidemic!

The report also indicated that there is a significant gap between people's perceptions and the reality of what is on their computers. An October 2004 study by AOL and the National Cyber Security Alliance reported that 53% of respondents said they had spyware or adware on their computers, but a scan revealed that 80% of them actually had such programs installed. Yikes!

That same study found an average of 93 spyware applications on users' computers. The thought of nearly a hundred spyware applications per computer just blows my mind. Experts conservatively estimate that for every 1,000 users in an organization, the costs of fixing spyware-related problems are $83,000 per year. Forrester Research released "AntiSpyware Adoption In 2005," which indicated that 39% of respondents, dubbed "technology decision makers," did not know the percentage of desktops infected with spyware in their organizations and 56% were unsure of what percentage of help desk calls were related to spyware issues. However, the Forrester report indicates that, on average, 7% of all help desk calls are made in response to spyware infections. Considering how much time it usually takes to resolve a serious spyware infection, that number is huge.

I have been infected a couple of times on my home computer -- ahem -- when someone other than me was using it. It takes days to "fix" the problem. In fact, I now just re-image my PC because it is easier than trying to find the culprit(s) and eliminate them. I simply keep a backup of my data on an ongoing basis so that I don't have to deal with the potential loss of it.

Meanwhile, the need to fight spyware will push anti-spyware revenues from $12 million in 2003 to an estimated $305 million in 2005. Hum ... with all that revenue to be had, how motivated could anti-spyware publishers be to find a cure?

Folks, this insidious problem is not going away any time soon. The best we can do is to alter our cyber-behavior and keep our anti-spyware and anti-virus software up to date. Remember, my little chickens, it may not be Big Brother watching you, but somebody probably is -- let's hope it isn't a fox! Safe surfing.

Donna Johnson Edwards is the Director of Consulting for Tenax, Inc. Established in the U.S. in 2002, Tenax provides IT compliance certifications, training and targeted consulting services. For further information on IT Compliance [http://www.tenaxcorporation.com] and Software Asset Management [http://www.tenaxcorporation.com] please visit the Tenax Corporation website.

NCSA Study Shows Many Computers Lack Antivirus Protection

Even with the scads of information available, even with the numerous antivirus options available to consumers, and even though internet users are inundated with offers for antivirus and anti spyware programs, it seems that some people prefer to take their chances when it comes to infecting their computers. According to the second annual AOL/National Cyber Security Alliance (NCSA) Online Safety Study, fewer than 60 percent of survey participants had antivirus protection software installed on their computers, and those who do fail to update it more than once a week.

Studies show that anywhere from 200 to 600 new viruses and other online infections are released each month, and the NCSA reports that 23 percent of Americans are each month affected by phishing attacks. Additionally, 81 percent of protected computers are not fully protected - very few users have the necessary trio of updated antivirus software, spyware protection, and a secure firewall. According to the survey, however, 83 percent of participants thought themselves secure from online infections.

Viruses, spyware, adware, and other malware all have the potential to pose a serious threat to your computer, not only to the hardware itself but to your personal information and identifying details. A good antivirus security suite should be able to detect and cure viruses, spyware, adware, worms, trojans, malicious code, malware, and keyloggers, all of which can do grave damage to your computer. Updating your software daily and scanning regularly for any unfamiliar or suspicious files on the computer, including archives, email, and instant messages, is also a necessary step in catching and preventing infection.

Due to the sheer number and variety of online threats, it's difficult to keep track of them specifically by name. However, the basic threats you should watch out for are as follows:

Spyware: A program that gathers personal information logged in your computer by noting your internet browsing habits and recording your keystrokes and passwords. It can also hijack your browser settings, redirect your search queries, and transfer any noted information to third parties for the purpose of identity theft.
Virus: Viruses infect the files on the computer and spread by replicating themselves. A virus can also be spread by email, and will automatically mail itself to people in the address book of the account it infects. Though worms and Trojans are not technically viruses, they often fall into the subcategory of "virus." A worm is a piece of software that replicates itself via security holes in networks, infecting vulnerable machines by copying itself and spreading to any other connected, unprotected computer. A Trojan horse is a program that masquerades as a benign application, but actually will damage your computer if you try to run the program.
Adware: Adware generates revenue by displaying advertisements on your screen, offering links to follow that take the user to the advertised website. Third parties then collect money for every hit on that site. Some adware programs gather personal information about you and select ads to display based on your browsing habits.


To be fair, the age of the browser might have something to do with the high instance of computer infection.The NCSA states that homes with children are more likely to have their computers infected by spyware or adware. In fact, more than 69 percent of homes with children under 18 were infected. But don't blame it all on the kids - 58 percent of child-free households had their fair share of spyware and adware infection.

With so many viruses, spyware, and other malware clamoring to infect your computer, it is essential to have in place the necessary preventative tools to catch and eliminate online infections. The fact that so many new threats are released on such a regular basis is not an accident - hackers and the writers of malicious code are targeting those who mistakenly think that using only a firewall or updating once a month will keep their computers safe. Persistence and diligence in keeping your software, updates, and antivirus protections software current can help ensure your information and computer access remain yours and yours alone.

http://home.stopsign.com

UAC Standard User Behavior

This security setting determines the behavior of the elevation prompt for standard users

The options are: Prompt for credentials: An operation that requires elevation of privilege will prompt the user to enter an administrative user name and password. If the user enters valid credentials the operation will continue with the applicable privilege. Automatically deny elevation requests: This option results in an access denied error message being returned to the standard user when they try to perform an operation that requires elevation of privilege. Most enterprises running desktops as standard user will configure this policy to reduce help desk calls.

Default: Prompt for credentials (home) / Automatically deny elevation requests (enterprise)

View the original article here

Scrum Roles

Scrum makes a strong distinction between the people committed to the project and those that are just interested in it. The most famous way of explaining this concept is via the fable of the pig and the chicken.
A pig and a chicken are walking down a road. The chicken looks at the pig and says, �Hey, why don�t we open a restaurant?� The pig looks back at the chicken and says, �Good idea, what do you want to call it?� The chicken thinks about it and says, �Why don�t we call it �Ham and Eggs�?�

�I don�t think so,� says the pig, �I�d be committed, but you�d only be involved.�

The �Pigs� are the people who are committed to the project. They are the ones that handle the creating, testing, and deploying of the project. The �Chickens,� on the other hand, are less committed. They are the stakeholders and/or interested parties who benefit from the project, but are not responsible for delivering it. Input from people classified as Chickens on the project should be taken into consideration; however it should not prevent the team from delivering the project.

Scrum promotes the support of the Pigs, but values and takes into account the views of the Chickens.


Pig Roles
The following are the three Pig roles that make up a Scrum team:
� ScrumMaster
� Product owner
� Delivery team


ScrumMaster
If the team is the engine of a Scrum project, then you can think of the ScrumMaster as the oil that keeps the engine running. The ScrumMaster is responsible for ensuring that the Scrum process is understood and followed. A ScrumMaster facilitates the team meetings and removes any blockages that the team may have in the course of the doing their work. He ensures that there are no obstacles keeping the team from achieving their goals and also isolates the team from outside distractions, all of which ensures focus is kept on the job at hand.

The ScrumMaster also liaises with different parts of the team, from product owners to testers and business stakeholders, ensuring that all members of the team are productive and share the common goal of delivering the sprint. Don�t liken the ScrumMaster position to that of a traditional project manager because the role is much more than that.

The key characteristic of a ScrumMaster is to be a �servant leader.� A ScrumMaster is not the boss of the team, but is there to help the team achieve what it needs to accomplish in the sprint. The ScrumMaster is there to help the team align the work in order to deliver value to the customer. A ScrumMaster is the team coach. He facilitates the decision-making aspects within a team. He is the point person for the team to those outside the group, and thus needs to be a top-notch communicator. When issues arise among a team, it is up to the ScrumMaster to manage that conflict and get the team back on track.

There are times, however, when the ScrumMaster stops being the servant leader and starts becoming a dictator. Since a key responsibility of the ScrumMaster is to ensure that the practices of Scrum are being followed as a team, any issue or attack against the framework should be handled by the ScrumMaster. Hopefully this is something that rarely happens.


Product Owner
A product (or project) owner represents the customer and is responsible for maximizing the value of the work that the team produces. The product owner meets with the customers to determine their wants and needs, and prioritizes those items so that the team is always working on the items of highest customer value. A product owner manages the product backlog and is the only person who can prioritize the user stories for a sprint; all features are developed for her and she is responsible for the sign-off of sprint deliverables. The product owner�s responsibilities change from being classified as a �Pig� before and after a sprint to being a �Chicken� during a sprint. The product owner role is also vital in that this person is the customer�s representative to the team. A product owner is similar to a ScrumMaster, but the main difference is the nature of the roles: the ScrumMaster is looking after the team�s best interest during a sprint while the product owner is looking after the customer�s best interest during the sprint.

In a Scrum team, the product owner is the one role that cannot be miscast. A product owner who is unable to accurately portray the customer�s wants and needs will result in failure. The product owner is key to delivering a product that brings value to the customer and success to the team.


Delivery Team
The delivery team is the group of people responsible for actually delivering the product. The team usually consists of two to ten people and includes a combination of programmers, testers, front-end designers, and members from any other required disciplines. The team works on each sprint to move the user story and related tasks through the different stages on the Kanban board until completion. The key characteristic of a Scrum delivery team is that it is a self-organizing unit. There is no one leader; everyone decides as a group what they can commit to each sprint. Team members also decide what tools they need to be successful for the project. This level of autonomy was unheard of in a waterfall method.

Delivery teams are designed to optimize flexibility and productivity. They are cross functional in that each member of the team should know all aspects of the product to varying degrees. Each individual on the team is not an expert at everything in the application, but each is a generalist in everything and an expert on a few aspects of the product.

The delivery team, along with the ScrumMaster and product owner, work together to complete the user stories and successfully accomplish each sprint. The ScrumMaster is geared to look after the team�s interests and the product owner is geared to look after the customer�s interests. With those two roles in place, the team does can concentrate on creating the application that the customer wants.


Chicken Roles
The people classified in the Chicken roles vary, ranging from business managers and directors to stakeholders such as customers, vendors, and sponsors. The Chickens are not actively involved in the development of the project; rather they are an interested party. Ultimately, the project is developed for these people, so their views are important and must be taken into account, but not at the expense of the development. This is why the ScrumMaster liaises between other people and the team and makes sure that these interested other people provide the resources that the team needs to get the job done, but don�t act as a distraction. Chicken roles are only involved in the process during sprint reviews, when feedback from stakeholders and other interested parties is of high value.

Because Chicken roles typically enjoy higher salaries in an organization they are not usually called chickens! Instead, they are told the pig and chicken story and then invited (and actively encouraged) to attend the Scrum meetings from time to time. Generally they do so and are very happy to observe and hear firsthand about what is going on.

Source of Information : Pro Agile .NET Development with SCRUM

Plan-Driven vs. Value-Driven Methods

When looking at the differences between the Waterfall method and the Agile method you need to look at the core behind each method. One method is driven by the plan that was created at the beginning of the project and the other method is driven by the value that you give the customer.

Waterfall Method (Plan Driven)
The waterfall method can be thought of as a plan-driven method of software development. In the past, this method of development was used by many�not because it was the best way to develop software, but because it was the only method known.

A project that used the waterfall method involved a large amount of risk, mainly because everything was done at the beginning of the project. All the requirements gathering, and discovery and scope definition was completed before the first line of code was ever written. Customers had to know up front everything that they needed or wanted the system to do. At times customers did not know exactly what they wanted, but yet, they had to define every last detail of their needs; and once they defined the details, they could not change them�even if they later realized that their needs had changed.

This approach destined the project for failure before it even began. The entire process led to problems that were hidden until toward the end of a project, simply because the customer had not considered every little detail, and there was no way make changes as the need arose. Sometimes it was too expensive to make a change. Scope creep was rampant in these kinds of projects; developers didn�t understand the problem that the customer was trying to solve�and the customer didn�t either.

Plan-driven development could be like a hoop jumping process: you started at discovery and once you jumped through that hoop, it was on to the requirements-gathering hoop, and from there you went on to the design hoop. You could not jump through one hoop until you had jumped through the previous hoop, and once you were through a hoop it was near impossible to go back to a previous hoop if the need arose. There was no allowance to do a little bit of everything and then pause to make sure you were still on the right path. The waterfall process did not foster an environment where developers could go to a customer and say, �I would like to show you what I am working on to make sure it is what you want.�

Usually the big issues would surface toward the end of a project, which was rather late in the process. This led to many development teams being behind on their projects. When teams got behind on a project, they would just throw more bodies at the project, with the hope that the more people on the project, the faster it would get done. That rarely happened. Most of the time the project would remain behind schedule, so the team had to cut the scope, cut testing, or both.


Scrum Method (Value Driven)
Scrum is considered a value-driven method for software development. Scrum is a dramatic change over the waterfall method for a number of reasons. Instead of first gathering all the requirements needed for every feature of the project, completing all the designs based on these requirements, and then coding the application based upon these up-front designs, Scrum looks at doing iterative, incremental development.

Scrum is all about taking small passes at a problem and reassessing that problem after each pass. Scrum is all about small:
� Small time blocks called sprints
� Small features
� Small teams

Small time blocks are how the team works on a solution for the customer. Each sprint can be looked at as a mini waterfall project. This is because in every sprint you are doing everything you would normally do in a waterfall project, except you are doing it on a smaller scale. In each sprint, you take a feature and you gather requirements on that feature, you design that feature based on those requirements, and you code and test that feature based on those designs. In Scrum, unlike waterfall, you are not trying to do everything up front; you are doing everything you need to do when you need to do it. The goal of each sprint is to deliver an increment of the final product�but an increment that is potentially releasable.

So how can we do numerous waterfall projects in each sprint, when we could barely do one waterfall project before? By doing these sprints against small features. Small features are pieces of a project that try to solve a particular problem for the customer; they don�t attempt to create the whole application. The massive features of the project are broken down into smaller chunks that can still provide value to the customer and are able to be completed more quickly. As more and more of these features are completed, the customer will start seeing the entire application coming into view.

All of this is done with a small team of developers, testers, and designers that are dedicated to getting the project done. This team is cross functional in that every member knows how to do everything. Each member may not be the best at everything, but everyone knows how to do everything necessary to complete the project. Think of them as a SEAL1 team, where every member knows how to do everything needed, but there are also experts on every aspect of the operation.

By doing things on a small scale, problems are less likely to arise near the end of the project. In fact, Scrum works to expose problems as soon as possible. Issues can�t hide because the process is broken down to a manageable scale. When a problem does surface, it causes major discomfort for the team until they address and fix it. They can�t ignore the problem because it is visible to everyone.

There is one important thing to realize about Scrum, however: it works to expose problems to the team as soon as possible, but it is not designed to fix the problems. It exposes the mud, but it is still the team�s job to clean it up.

With Scrum, you are not just creating features for the sales and marketing teams to show the customers, you are creating solutions for the customer. This is done by prioritizing the features that need to be completed based on the customer�s needs and wants. If a customer deems feature A to be more important than feature B, then the developer would be wasting his time working on feature B before feature A. Give the customers what they want when you say you can deliver it.

Source of Information : Pro Agile .NET Development with SCRUM

Secret Passage

Network and security administrators sometimes evoke images of the Little Dutch Boy from Hans Brinker who stuck his finger in the dike to plug a leak, except for network and security administrators every time they plug one leak a new one springs up. They implement file attachment filters and antivirus scanning on the corporate email servers only to have users access web-based email like Hotmail and sidestep the security. Every time administrators think they have the network locked down some other method of entry pops up- instant messaging, wireless devices, USB hard drives, etc..

Some of these things can be eliminated through firewall or content filtering rules to deny users access to sites that pose a potential security risk. Other things are harder to control except through strict policies and procedures specifically prohibiting certain actions or technologies from the company network and then monitoring and policing to enforce compliance.

Many companies have already addressed the issue of wireless device security. Initially many companies and individuals jumped onto the wireless networking bandwagon for the convenience of being able to wander un-tethered by network cables or being able to deploy more workstations without having to run network wiring through the walls and ceiling. However, many of those wireless networks used no security whatsoever and the ones that did used WEP encryption which proved to be barely better than having no security. This is still a serious problem for many wireless networks, but wireless security has improved drastically.

Douglas Schweitzer, author of Incident Response and columnist for Processor.com, says �There's no denying that wireless networks can help to increase worker productivity and often produces a considerable ROI for organizations with large, mobile workforces. However, it is important to note that there are significant risks involved from any unprotected wireless network. To mitigate these risks, organizations interested in deploying wireless networks should consider a defense-in-depth (layered approach) to security that involves both procedural and physical components such as policies and intrusion detection/prevention. Used in conjunction with firewall and anti-virus, network security administrators can successfully lock down their wireless networks.�

So, now we come to the administrator with all 10 fingers already occupied plugging different holes in the dike: malware, spam, denial-of-service attacks, USB devices, web-based email, etc. and thinking that the network is relatively secure and along comes remote access.

Whether it�s a business partner that needs remote access to the company network in order to facilitate work or company employees or executives that need to access the company network from their home computers in order to remain productive during �off� hours, remote access can create a number of security risks for your otherwise secure network.

View the original article here