Monday 28 January 2013

7 Top Business Intelligence Trends For 2013

3 Big Data Vendors To Watch In 2013(click image for larger view and for slideshow)Many people seem to want to stick a sexier name on business intelligence, whether that's "business analytics" or "big data." To me, it's still business intelligence, a top-priority technology that can help companiesboost revenues, improve customer service or control costs by making better, faster decisions.Whatever you want to call this still-vital category, here are my predictions for the top BI trends of 2013, along with a few looks back athighlights of 2012.
1. Dashboards Evolve, ExpandYou would think that there's not much room for dashboard innovation now that they're the bread-and-butter BI interface, already in use among most large and midsized companies. And yet dashboards were ratedthetop priority for expansion and innovation in the BI Scorecard2012Successful BI Survey. The dashboard's rise to prominence is aconfluence of next-generation technology along with a recognition that BI must be aligned to business goals to be successful.[ Want more on trends in the year ahead? Read5 Cloud App Trends To Expect In 2013. ]Access to data alone doesn't help a company improve. Next-generationdashboards keep workers focused on the right metrics and inform in away that lets employees take preemptive action. Key features enabling such dashboards include in-memory processing, the ability for users to mash data together andto assemble their own dashboards, KPIs, faceted (filter-by-category) search, mobile, and the ability to link insight to action.With big BI platform vendors IBM, Microsoft, and SAP generally lagging the dashboard capabilities provided by specialty vendors, customers will continue to mix and match systems from different providers in 2013. Differentiated leaders include QlikTech, which supports rapid deployment and intuitive "associative" analysis, JackBe, which has strong operational dashboards, and Metric Insight, which offers top-notch KPIs.Look for all vendors in this space tocontinue to improve their capabilities in 2013. SAP, for example, recently released its next-generation dashboard tool, Design Studio, though data-source support is initially limited to SAP BW and the Hana in-memory database. Look for SAP to improve related mobile and data-visualization capabilities. SAP will also eventually integrate and merge its once-leading Xcelsius dashboarding product, now rebranded "Dashboards," into Design Studio. QlikTech also is expected to release a next-generation dashboarding product this year.Looking back, one important dashboard release in 2012 was Oracle Endeca Information Discovery, acquired by Oracle at the end of 2011 and adapted to runon its Exalytics appliance. Oracle classifies this product as a discoverytool, but in my view it's best positioned as a dashboard application uniquely positioned to explore unstructured data using faceted search.2. Self-Service BI Gets RealSelf-service BI continues to be a vision for many companies in whichusers are empowered to explore new data sets without much IT support. Visual-data-discovery toolshave become synonymous with self-service BI and are growing at three times the pace of the overall BI market. Unfortunately, some vendors are too quick to attach the visual discovery moniker to their products. As I wrote in the latestBI Scorecard Strategic and Product Summary report, there's a continuum of self-service BI capabilities that ranges from interactive reporting to business query to visual data discovery, and yes, even to tools such as spreadsheets.My hope in 2013 is that practitioners recognize this range of self-service, and that vendors help educate rather than just jumping on whatever bandwagon has the most hype. Leading companies will make the shift to self-service BI, both to empower workers and to ensure the smartestallocation of constrained IT resources. In our Successful BI Survey, 44% of respondents say BI teams do not have adequate time, funding or resources to keep up with BI demand. With the fight for BI talent, simply hiring more people is not the solution. Instead, business users have to embrace responsibility for routine BI tasks. At the same time, IT has to let go of some of the mundane enhancement requests and focus on complex data challenges and leveraging innovations.In 2013 Tableau will release version 8 of its software, which will include browser and iPad-based authoring, a relative rarity in the visual data discovery category. Also look for improvements in other first-generation visual discovery products:-- SAS Visual Analytics Explorer, first released in February 2012, is due out with a new version that willsupport calculated columns, forecasting, decision trees, and maps.-- Microsoft's Power View via SharePoint (released in Q1 2012) will reemerge as an Excel add-in.-- AP Visual Intelligence, first released for Hana in March 2012, isnow on a six-week release cycle, gaining support for more data sources and capabilities.3. Mobile BI Boosts BI AdoptionJust when you thought the dust had settled on the question of tablet leadership (the iPad), Microsoft released the Windows Surface and Apple missed Wall Street earnings estimates. Prime-time ads for the Surface abound! And oh, how I would love to more easily synch myOutlook calendar!Gone are the days when corporate IT can set mobile device standards. Instead, users are increasingly bringing their own devices, forcing IT (and BI vendors) to support a broad swath of smartphones and tablets. The most promising way to support diversity is to support HTML5, but the best user experience continues to be throughdevice-native apps. Just what those apps need to support is a moving target, as user requirements evolve. For example, availability of offline data-interaction capabilities -- rare in 2011, but supported by specialty vendor RoamBI -- increased in 2012 with MicroStrategy, SAP Mobile and Oracle Mobile HD adding such capabilities.Will we see native support for Microsoft Surface in 2013, or will vendors use the HTML5 approach for this device? It's too early to tell,but I don't anticipate any broad shift. The debate about which capabilities to provide on smartphones versus tablets will continue. Mobile Device Management will remain a separatemarket segment, but savvy mobile BI providers and customers will integrate with these solutions so that when a device is lost or stolen, there is additional security beyond just a user name and password so that offline data can be wiped.Mobile will also continue to drive BI adoption in 2013, re-igniting executive interest and making BI more relevant to field and front-line workers. In last year's Successful BI Survey, only 11% of respondents said their firms had successfully deployed mobile BI. BIadoption at those firms stood at 39% of employees, far ahead of theindustry average of 24% of employees.

13 Secret Tech Stars Of Silicon Valley

Bangalore: More than often it is the people with ranks—founders, co-founders, CEOs and others whograb the limelight for things big or small. But there are people, like undercurrents, dynamic but not visible, play a crucial role, andare least likely to grab the credit they deserve. However Business Insider initiated the novel campaign to unearth these tech stars and bring them to lime light.Here are the 13 secret tech stars ofSilicon Valley.#13 Shiva Rajaraman, for making YouTube ubiquitousShiva Rajaraman is Director, Product Management at Google. He helms the consumer product team focused on discovery, consumption, and devices, helpingto grow views to over 3 billion views a day. Prior to his current role, he launched several of YouTube's first advertising products and initial TV and film launches.Though there is huge buzz about Google+ being the Altair of searchgiant, it is YouTube which deserves the crown. Rajaraman's big push this year has been to rollout a new, consistent look wherever videos play, available invariety of platforms—iOS, Android, Xbox, Wii game consoles and many more, excluding its already huge web presence, making YouTube ubiquitous.

#12 Sara Sperling, for making Facebook a great place to work foreveryoneSara Sperling is head of community engagement at Facebook and leads the company’sdiversity and inclusion efforts. She is the person behind installingZuckerbergs ideal about how Facebook enables people to have an authentic identity at the company. It is her efforts that 450Facebook employees took part in this year's San Francisco Gay PrideParade, up by 50 percent than theprevious year. Thanks to her thatFacebookcampus now includes unisex bathrooms to help transgender employees to feel comfortable.In May this year, GLAAD, the nation’s lesbian, gay bisexual and transgender (LGBT) media advocacy and anti-defamation organization, felicitated Facebook with Special Recognition Award at the 23rd Annual GLAAD Media Awards.#11 Matt Fischer, for running Apple's home for killer appsMatt Fischer is the Director, App Store and Mac App Store at Apple.As one of the Start-up CEO says about Matt, he is secretly one of the most important people at Apple. App Store is the key feature which hooks on the Apple users and developers to the brandand attracts many others to be a Apple customer, the credit solely goes to Apple’s Director of App Store Matt Fischer.

12 Best Online Shopping Sites In India

Bangalore:Indianshave finally taken toshop online. Initiatives likeGoogle’s online shopping festival was a blockbuster in the country, waned the remaining whatever apprehensions people had, to shop online.At the time you are about to call it a year, here are the top 12onlineshopping sites in India, compiled according toAlexa rankings, that delighted the shopaholics on the go, at office, at home or simply whenever the urge to shop surfaced.#12 Naaptol.comNaaptol was founded by Manu Agarwal in 2008 in Mumbai. The website was essentially a price comparison engine, but later evolved into an online market place. The company focuses on Tier 2 and Tier 3 retail markets, and also comes up with lowest possible prices on products. It’s the platform where merchants from different city can post their products and buyers can buy them.According to Alexa, the site is particularly popular in Mumbai and Delhi. The fraction of visits to this site referred by search engines is approximately 15%. Alexa global rank of Naaptol is 1,809, its ranking in India is 136 and has 3,557 sites linking in.

#11 Infibeam.comInfibeam.com was founded by Vishal Mehta in 2007. It is an e-commerce company headquartered in Ahmedabad andis an online retailer for books, electronics, and automobiles in the country. The company has offices in Delhi, Mumbai and Bangalore.According to Alexa,Search enginesrefer approximately 9 percent of visits to this site; about36 percent of visits to Infibeam.comare bounces (one pageview only). Its Alexa global ranking is 1,966, India ranking is 135 and has 5,465 sites linking in.#10 Shopclues.comSandeep Aggarwal and Sanjay Sethi co-founded ShopClues.comin July 2011 in Silicon Valley. It is a fully managed marketplace that connects buyers and sellers onlineand offers a trusted and safe online shopping experience.According to Alexa, the site's visitors view 7.0 unique pages each day on average. The site has a bounce rate of about 32 percent(one pageview only). Shopclues.comis particularly highly ranked in the city of Gurgaon. The Alexa global rankingis 2,050, Indian ranking is 129 andit has 775 site linking in.

#9 Tradus.comSanjay Suri, former architect at Amazon founded Tradus.com. Tradus.comoffers online shoppingfor mobiles, cameras, laptops, clothes, jewellery, home appliances and many more at bestprices, and also offers pay cash ondelivery (COD) option. Tradus Coupon Codes is usually mailed toall their subscribers for current offers, so you should register your email to get the latest news and alerts from them.The site is particularly highly ranked in the city of Gurgaon. Thesite's visitors view 8.9 unique pages each day on average. Sites Alexa global ranking is 1,330, Indian ranking is 92 and has 542 site linking in.#8 Yebhi.comYebhi.com is a life style online shopping portal, and it is a franchisee of Bigshoebazaar, founded in the year 2009. It is a one-stop-shop for all lifestyle products and offers the latest and quality product to its customers dealing in Shoes, apparels, Bags, Mobiles, Cameras, Sunglasses, Watches accessories and many more.   The site has Alexa global ranking of 1,277, Indian ranking of 89 andhas 1,825 sites linking in.

Apple to include 128GB model in next-generation iOS devices?

Apple to include 128GB model in next-generation iOS devices?

Sunday 27 January 2013

Is Lenovo considering BlackBerry-maker RIM for takeover?

senior Lenovo executive said on Thursday that the Chinese computer maker may consider Research in Motion as a takeover target, sending the Blackberry maker's shares up 2 percent.

Toronto: A senior Lenovo executive said on Thursday that the Chinese computer maker may consider Research in Motion as a takeover target, sending the Blackberry maker's shares up 2 percent just a week before it launches a make-or-break line of redesigned smartphones. But Levovo, whichvaulted into the personal computer market with its 2005 purchase of IBM's PC division, would face formidable hurdles ifit tried to buy a company that Canadian Prime Minister Stephen Harper once described as a national "crown jewel." The Chinese company would also encounter tough regulatory scrutiny in Washington, cybersecurity experts say. Lenovo, on track to become the world's largest PC maker, has held talks with RIM and its bankers about various combinations or strategic ventures, its chief financial officer, Wong Wai Ming, said on Thursday

Apple chart: Why iPhones, iPads are key to future results

Apple's biggest selling products are the iPhone and iPad. For most analysts, these are products that will define the company's future.
Apple Inc on Wednesday announced its results for Q1 2013 and the company posted a quarterly revenueof $54.5 billion and a quarterly net profit of $13.1 billion. While these numbers are a record by themselvesfor Apple, for Wall Street these numbers were just not good enough as Apple missed forecasts for the third time.In q1 2013 Apple sold 47.8 million iPhones, up 29 percent from the year-ago period where it sold 37 million iPhones. This was however below the 50 million number that was forecast.In the tablet category, Apple sold 22.9 million iPads during the quarter, compared to 15.4 million inthe year-ago quarter. The company did not reveal numbers for iPad mini separately though so it's not clear how well the iPad mini did.As far as Macs were concerned the sales declined and Apple sold only 4.1 million Macs, compared to 5.2 million in the year-ago quarter. iPods too saw a decline with company selling only 12.7 million compared to 15.4 million in the year-ago quarter.Clearly as the chart above shows, Apple's biggest selling products are the iPhone and iPad. Here's a quick look at some expectations from both.iPhone:There's no doubt that the iPhone has been the jewel in Apple'skitty, and the one device that revolutionised the smartphone industry. But with the rise of Android and Samsung, the iPhone is often seen as too expensive and lacking some features. Rivals have created smartphones with bigger screens; the Galaxy S III has a 4.8-inch screen while Apple has onlyincreased the size of the iPhone's screen with the latest model. iPhone5 has a four inch screen and some feel Apple needs to change this.Then of course there is the high-price of the iPhone which makes it a very expensive smartphone to buy, especially in developing countries.

Want to remove embarrassing photos from FB? Try Facewash app

The "Facewash" app developed by researchers from Kent State University will search through a user's Facebook activity and content for items that the user may want to hide or delete.

Researchers have developed a new app that can help Facebook users clean up vulgar or embarrassing pages from their profile. The "Facewash" app developed by researchers from Kent State University will search through a user's Facebook activity and content for items that the user may want to hide or delete. That could include status updates, photo captions, and comments users left or received as well as pages and links that were liked, Los Angeles Timesreported. "We realised that there's a lot of content that perhaps someone might not want a future employer to see," researcher Daniel Gur. Gur created the Facewash over the weekend along his two friends and fellow computer science majors Camden Fullmer, and David Steinberg. The trio built the app in less than two days while at a hackathon at the University of Pennsylvania. To use Facewash, users first need to go to its website, Facewa.sh, click on get started and then log into their Facebook account.They will be prompted to click "Go to App" and then give they have to give the app permission to access their content. caption id="attachment_602316" align="alignleft" width="380"] A screengrab of the Facewash App.

Infidelity in the age of tech: Beware Mobile phones, Facebook!

In the age of modern technology, snooping on a partner's mobile phone is the most common way to catch if they are cheating, followed by going through their Facebook activities, according to a new UK poll.'Going through mobile phone' has been cited as the top reason why illicit affairs have been exposed, the poll found.Nearly 2,400 UK adults, all of whom had either been caught cheating while in a relationship or who had found a partner was being unfaithfulto them in the past, were quizzed bya mobile phone insurance website on the circumstances in which the infidelity was discovered.Almost half of those questioned - 41per cent - said checking for evidenceon their partner's mobile phone wasthe reason why an affair came to light, the 'Daily Mail' reported.The second most common way to catch a cheater was via social network websites like Facebook (23 per cent) and by going through their files on their personal computer or tablet (13 per cent).A minority of 11 per cent were unable to cover their tracks so they were caught face-to-face while 5 percent had to be told their partner wasup to no good by a friend or family member.Just two per cent admitted having a guilty conscience led them to making a full confession.Mobile phone insurance website www.mobileinsurance.co.ukconducted the research after noting a rise in the number of claims for breakages that occurred to handsets during relationship splits or arguments.Almost a tenth of the respondents taking part said that a mobile phone had become broken as a direct result of an argument within a relationship, such as by being thrown or dropped."You'd be surprised how often relationship arguments and cheatinggets cited in mobile phone insuranceclaims, even though we often dont ask for that depth of detail," John Lamerton, managing director of MobileInsurance.co.uk, said."Evidently, those being unfaithful in relationships need to keep better tabs on who is looking at their mobile....

Award Winning Interactive Agency Database Launched by Web Marketing Association

Finding an "award winning" interactive agency has justgotten easier. The Web Marketing Association has just launched a new website that brings together advertising agencies and interactiveagencies who have won recognition in major award programs. 燭his new searchable database of award winning interactive agencies is found atwww.AwardWinningInteractiveAgencies.com.(Logo:http://photos.prnewswire.com
"Each year, we are contacted by individuals looking for a reputable interactive agency to help with website development, online advertising or other forms of internet marketing.  Now they havea single source to find the right interactive agency for them," saidWilliam Rice, President of the Web Marketing Association. "One of the major reasons advertising agencies enter award programs is to standout from the rest of the field and receive third party endorsement for their work. Entering takes time and money, butthe rewards when they win are worth the effort. The Web Marketing Association has created the AWAdb as a service to the online marketing community and tohelp bring together brand marketers and qualified interactive agencies."The Award Winning Agency Database, or AWAdb, allows users to search thousands of full service advertising agencies and interactiveagencies that been recognized by major award programs for their outstanding interactive work. The AWAdb can be searched by several fields that are cumulative in helping to narrow your search quickly. Visitors can search by:牋牋燗gency Name– Enter the agency name to find that agency牋牋燣ocation– Search by country and/or state to find agencies close to you.牋牋燣anguages– Need a specific language skills? Narrow your searchto 10 different牋牋爈anguages including English, Spanish, Turkish, German and Chinese.牋牋燬pecialty– Finding the right agency also means finding someonewho is an expert牋牋爄n your specific need. 53 specialties can be selected in areas include web development,牋牋爋nline marketing, mobile, social media and public relations.The site also offers anInteractive Agency Mapthat allows the user to click on the geographic area they are interested in and drill down to see the exact locations of various award winning agencies.To have great award winning interactive agencies, you need to have great interactive award programs for them to enter and win. AWAdb draws upon some of the major award programs that the online marketing community recognizes as significant awards for interactive marketers.  They include: Web Marketing Association WebAwards, Internet Advertising Competition and MobileWebAwards, Clio Awards, Cannes Cyber Lions, Ad Club of NewYork Andy Awards, Effie Awards, American Advertising Federation Addy Awards, The One Show Interactive, D&AD Pencil Awards, DMA Echo Awards, SXSW InteractiveAwards IAB Mixx Awards, PRSA Silver Anvils, BIMA Awards, Webby Awards, and the Stevie Awards to name a few.Rice added, "These are not all of the award programs out there, onlysome of the best. Many of these are awards are categories of long-standing advertising award programs. Others have been started specifically to recognize outstanding interactive advertising and great websites."Participation in the Award Winning Agency Database is free to all agencies who have won recognition in a recognized interactive award program. If your agency is not already listed and you've won awards, pleaseadd your agency to the AWAdb.About the Web Marketing AssociationTheWeb Marketing Associationis working to create a high standard ofexcellence for Web site development and marketing on theInternet. Staffed by volunteers, it ismade up of Internet marketing, advertising, PR and design professionals who share an interestin improving the quality of Website development and marketing on theInternet. Since 1997, the Web Marketing Association's annualWebAward,Internet Advertising CompetitionandMobileWebAwardaward programs have been helpinginteractive professionals promote themselves, their companies, and their best work to the outside world. Now in its 17th year, the WebAward Competition has become the premier award event for Web developers and marketers worldwide.

7 Top Business Intelligence Trends For 2013

3 Big Data Vendors To Watch In 2013(click image for larger view and for slideshow)Many people seem to want to stick a sexier name on business intelligence, whether that's "business analytics" or "big data." To me, it's still business intelligence, a top-priority technology that can help companiesboost revenues, improve customer service or control costs by making better, faster decisions.Whatever you want to call this still-vital category, here are my predictions for the top BI trends of 2013, along with a few looks back athighlights of 2012.
1. Dashboards Evolve, ExpandYou would think that there's not much room for dashboard innovation now that they're the bread-and-butter BI interface, already in use among most large and midsized companies. And yet dashboards were ratedthetop priority for expansion and innovation in the BI Scorecard2012Successful BI Survey. The dashboard's rise to prominence is aconfluence of next-generation technology along with a recognition that BI must be aligned to business goals to be successful.[ Want more on trends in the year ahead? Read5 Cloud App Trends To Expect In 2013. ]Access to data alone doesn't help a company improve. Next-generationdashboards keep workers focused on the right metrics and inform in away that lets employees take preemptive action. Key features enabling such dashboards include in-memory processing, the ability for users to mash data together andto assemble their own dashboards, KPIs, faceted (filter-by-category) search, mobile, and the ability to link insight to action.With big BI platform vendors IBM, Microsoft, and SAP generally lagging the dashboard capabilities provided by specialty vendors, customers will continue to mix and match systems from different providers in 2013. Differentiated leaders include QlikTech, which supports rapid deployment and intuitive "associative" analysis, JackBe, which has strong operational dashboards, and Metric Insight, which offers top-notch KPIs.Look for all vendors in this space tocontinue to improve their capabilities in 2013. SAP, for example, recently released its next-generation dashboard tool, Design Studio, though data-source support is initially limited to SAP BW and the Hana in-memory database. Look for SAP to improve related mobile and data-visualization capabilities. SAP will also eventually integrate and merge its once-leading Xcelsius dashboarding product, now rebranded "Dashboards," into Design Studio. QlikTech also is expected to release a next-generation dashboarding product this year.Looking back, one important dashboard release in 2012 was Oracle Endeca Information Discovery, acquired by Oracle at the end of 2011 and adapted to runon its Exalytics appliance. Oracle classifies this product as a discoverytool, but in my view it's best positioned as a dashboard application uniquely positioned to explore unstructured data using faceted search.2. Self-Service BI Gets RealSelf-service BI continues to be a vision for many companies in whichusers are empowered to explore new data sets without much IT support. Visual-data-discovery toolshave become synonymous with self-service BI and are growing at three times the pace of the overall BI market. Unfortunately, some vendors are too quick to attach the visual discovery moniker to their products. As I wrote in the latestBI Scorecard Strategic and Product Summary report, there's a continuum of self-service BI capabilities that ranges from interactive reporting to business query to visual data discovery, and yes, even to tools such as spreadsheets.My hope in 2013 is that practitioners recognize this range of self-service, and that vendors help educate rather than just jumping on whatever bandwagon has the most hype. Leading companies will make the shift to self-service BI, both to empower workers and to ensure the smartestallocation of constrained IT resources. In our Successful BI Survey, 44% of respondents say BI teams do not have adequate time, funding or resources to keep up with BI demand. With the fight for BI talent, simply hiring more people is not the solution. Instead, business users have to embrace responsibility for routine BI tasks. At the same time, IT has to let go of some of the mundane enhancement requests and focus on complex data challenges and leveraging innovations.In 2013 Tableau will release version 8 of its software, which will include browser and iPad-based authoring, a relative rarity in the visual data discovery category. Also look for improvements in other first-generation visual discovery products:-- SAS Visual Analytics Explorer, first released in February 2012, is due out with a new version that willsupport calculated columns, forecasting, decision trees, and maps.-- Microsoft's Power View via SharePoint (released in Q1 2012) will reemerge as an Excel add-in.-- AP Visual Intelligence, first released for Hana in March 2012, isnow on a six-week release cycle, gaining support for more data sources and capabilities.3. Mobile BI Boosts BI AdoptionJust when you thought the dust had settled on the question of tablet leadership (the iPad), Microsoft released the Windows Surface and Apple missed Wall Street earnings estimates. Prime-time ads for the Surface abound! And oh, how I would love to more easily synch myOutlook calendar!Gone are the days when corporate IT can set mobile device standards. Instead, users are increasingly bringing their own devices, forcing IT (and BI vendors) to support a broad swath of smartphones and tablets. The most promising way to support diversity is to support HTML5, but the best user experience continues to be throughdevice-native apps. Just what those apps need to support is a moving target, as user requirements evolve. For example, availability of offline data-interaction capabilities -- rare in 2011, but supported by specialty vendor RoamBI -- increased in 2012 with MicroStrategy, SAP Mobile and Oracle Mobile HD adding such capabilities.Will we see native support for Microsoft Surface in 2013, or will vendors use the HTML5 approach for this device? It's too early to tell,but I don't anticipate any broad shift. The debate about which capabilities to provide on smartphones versus tablets will continue. Mobile Device Management will remain a separatemarket segment, but savvy mobile BI providers and customers will integrate with these solutions so that when a device is lost or stolen, there is additional security beyond just a user name and password so that offline data can be wiped.Mobile will also continue to drive BI adoption in 2013, re-igniting executive interest and making BI more relevant to field and front-line workers. In last year's Successful BI Survey, only 11% of respondents said their firms had successfully deployed mobile BI. BIadoption at those firms stood at 39% of employees, far ahead of theindustry average of 24% of employees.

Java security news is not getting any better.

The Data Protection Act offerseightcentral principlesthat any organization working in the U.K. and holding personal data must comply with. These require that such personal information must be:fairly and lawfully processed; obtained for limited purposes; adequate, relevant and not excessive; accurate and kept up to date; never kept for longer than necessary; processed in line with personal legal rights; not transferred to other countries without adequate protection; and, most relevant to this case, always kept securely.The organization's deputy commissioner and director of data protection, David Smith, said in theInformation Commissioner's findingthat, "If you are responsiblefor so many payment card details and log-in details then keeping that personal data secure has to be yourpriority. In this case that just didn't happen, and when the database wastargeted -- albeit in a determined criminal attack -- the security measures in place were simply not good enough ... There's no disguising that this is a business that should have known better. It isa company that trades on its technical expertise, and there's no doubt in my mind that they had access to both the technical knowledge and the resources to keep this information safe."The body also points to the impact the scandal has had on U.K. consumers' willingness to share their personal information online, which could of course impactU.K. e-commercemore widely. It quotesdata based on market research conducted shortly after the incidentthat said 77% of consumers had been left "more cautious" about giving their personal details to websites.The Information Commissioner's action is part of a stream of high-profile actions on organizations it deems have been too lax in protecting customer information.What's unusual here is both the sizeof the financial swipe it's made on the global brand of Sony -- more commonly, it fines public-sector bodies in the U.K., with a particular focus on cases where hospital workers lose USBs with sensitive patient data -- and also how clearly it says the company's bad security practices are to blame."The penalty we've issued today is clearly substantial, but we make no apologies for that," says Smith."The case is one of the most serious ever reported to us. It directly affected a huge number of consumers, and at the very least put them at risk of identity theft."Sony has yet to publicly react to thenews.Recent breaches have tarnished digital certificates, the Web securitytechnology.

Sony Slapped With $390,000 U.K. Data Breach Fine

Sony's European arm has been dealt a harsh punishment by the U.K.'s data privacy czar for poor protection of its customer's privacy:a punishing $390,000 (£250,000) fine.In 2011, due to ahack of its PlayStation Networkonline gaming community's database, 77 million customers' personal details were exposed. The cyber housebreakers were able to get away with customers' payment card details, names, postal and email addresses,dates of birth, and account passwords. In the U.K., about three million bank customers had to change their account details and obtain new credit cards, it has beenreported.
Two years later, the U.K. Information Commissioner -- the official watchdog for privacy and data security -- has decided the breach was due to poor IT security by Sony and has decided to teach it a lesson.It busted the company under the U.K.'s 1998 Data Protection Act, after its investigators decided the attack could have been prevented ifnetwork software had been up to date. It also believes the way Sony Entertainment Europe had set up user passwords was not sufficiently secure.

4 Steps For Proactive Cybersecurity

If not all, nongovernmental entities it's too soon to go down thepath of all-out, offensive security counterattacks. Many other securityprofessionals agree, and you can get a good summary of the academic and government researchon cyber espionage, cyber deterrence and cyber offense by reading a recent post by Dave Dittrich, a member of the HoneyNet Project:"No, Executing Offensive Actions Against Our Adversaries Really Does Have High Risk (Deal With It)."But you can do a lot more than read and hope. Here are some ways to take action now that will at least let your team start taking a more offensive security mindset.
Step 1: Do active risk analysis to know what attackers may strike at, and how.Intelligence gathering is an arduoustask for even well-funded government agencies, so it is highlyunlikely that your company can achieve the level of detail required for true cyber intelligence about attackers. Further complicating intelligence gathering is that private-sector chief information security officers don't share details of successful breaches, even thoughsuch collaboration would be critical to understanding and linking methods and attackers. But that's another article.For now, focus your effort on the intelligence gathering you do control: knowledge of your own systems, networks and business.

The iPad and the rise of the Planet of the Apes

Apple CEO Tim Cook made no mention of it in this week'searnings call, but there's a burgeoning demand for iPads among the country's zoo-boundprimates, thanks to theApps for Apesinitiative. However, not all apes are created equal: Orangutans introduced to Apple's tablet have loved the device, butgorillas haven't taken to the iPadwith the sameenthusiasm -- a development Corning obviously didn't consider when naming itsGorilla Glass.According to Orangutan Outreach, sponsor of the Apps for Apes initiative:Orangutans are highly intelligent creatures that require mental stimulation to keep from growing bored and depressed. Every orangutan is a unique individual with his or her own particular likes and dislikes, and freedom of choice is critical to their well-being. They like to choose everything from their afternoon snack to their daytime companions and sleeping area.Don't we all?Among the dozen-plus zoos participating in the Orangutan Outreach initiative are the Atlanta Zoo and the National Zoo in Washington. Participantsare in touch with each other to compare and recommend appsthat the apes seem to prefer. The orangutans' tastes, it seems, are not so different from a human child's, with special favorites being musical instruments, video watching -- particularly of themselves and other orangutans -- finger painting, and interactive books.The Milwaukee County Zoo, which nearly two years ago pioneered the use of iPads to stimulate and enrich the lives its orangutans, took the effort to a new level when it outfittedits primate buildings with Wi-Fito arrange"play dates" with orangutansat other zoos and wildlife preserves. Can the offer of a reality TV show be far behind?Check out this video of orangutans at the Milwaukee County Zoo interacting with theiPad. Sadly,Mahal-- one of the orangutans featured in the video -- died last month from pneumonia.Orangutans are among the most intelligent primates. A 2008 study of two orangutans at the Leipzig Zoo in Germany showed they couldweigh the costs and benefits of gift exchangesand keep track of them over time -- the first nonhuman species documented to do so.The Apps for Apes program goals include:*.Provide stimulating enrichment and immediate gratification for orangutans*.Make zoo visitors aware of the critical need to protect orangutans in the wild*.Promote the conservation efforts of Orangutan OutreachIf you have a gently used iPad that you'd like to donate to an orangutan, you're invited tocontact Orangutan Outreach.

Fujitsu developing HTML5 app platform for enterprise security

Engineers at Fujitsu Laboratories are developing anHTML5-based platform for smartphones that designed to keep corporate data secure when accessed from employee-owned handsets.The system, which Fujitsu plansto launch later this year, is one of a number that addresses this increasingly common problem: how to allow workersaccess to corporate IT systems while avoiding deliberate or inadvertent leaks of data from devices that are not totally under the company's control.[ Find out how to block the viruses, worms, and other malware that threaten your business, with hands-on advice from InfoWorld's expert contributors in InfoWorld's "Malware Deep Dive" PDF guide. | Don't look now, butyour antivirus may be killing your virtualization infrastructure. InfoWorld's Matt Prigge shows you how to detect the warning signs. ]Fujitsu's system matches an app on the phone with a cloud-based server that delivers corporate apps such as email, sales databases and customer contacts, as HTML5 applications.The phone app senses whether it's in the workplace or not and therefore whether it has accessto corporate data. The cloud apps are delivered over an encrypted connection to the handset, which runs them inside a secure application environment on the phone.As soon as the employee leaves the workplace, the cloudconnection is severed and the corporate apps are no longer accessible. And because they ran in the application environment, the phone doesn't contain any remnants of their use, such as cookies or temporary data files, said Kazuaki Nimura, a research manager at the smart platformlaboratory of Fujitsu Laboratories.At an event in Silicon Valley on Thursday, Nimura demonstrated the system running on both an iPhone and Android handset. Each mobile OS requires a native app to runthe execution environment, but the HTML5 cloud apps will run across all platforms.In the demonstration, access tothe corporate apps was enabled in the iPhone when it came within reach of a simulated company Wi-Fi signal, while the Android phone had the option of being switched on by either Wi-Fi detection or through a tap on an NFC (near field communication) card.As soon as the phones detectedthe network or NFC card, they switched to work mode, which brought up a new home screenwith different set of apps. While in work mode, access to personal apps could be determined by a company security policy, said Nimura.In the demonstration, work mode also disabled the phone'scamera.When the phone lost the network connection or tapped on the NFC card, it was returned to its conventional home screen and stricter corporate security policies were removed.The same system could also be used to deliver corporate apps to workers outside of the office, maintaining the securitypolicies in place for access and use of the data.Fujitsu hopes to release the technology as its Mobile Enterprise Application Platformlater this year.

AT&T to buy Verizon spectrum for $1.9 billion

The new spectrum will help thecompany deploy 4G LTE services and meet mobile broadband demand from smartphones and tablets IDG News ServiceAT&T will buy mobile spectrumin the 700MHz band from Verizon Communications for US$1.9 billion, AT&T said Friday.AT&T will pay cash and trade AWS (advanced wireless services) spectrum for the B block of the 700MHz spectrum,the company said. Verizon will gain AWS spectrum licenses in several markets, including Los Angeles, Phoenix, and Portland, Oregon, AT&T said in a press release.[ Understand how to both manage and benefit from the consumerization of IT trend with InfoWorld's"Consumerization Digital Spotlight" PDF special report. |Subscribe to InfoWorld'sConsumerization of IT newslettertoday, then join our#CoIT discussion group at LinkedIn. ]In April,Verizon pledged to sellofftwo 12MHz blocks of mobilespectrum in the 700MHz band, including the B block, if U.S. regulators approved its purchase of spectrum from a group of cable providers.The U.S. Federal Communications Commission approved Verizon's purchase ofthe cable spectrum in August.Verizon purchased the 700MHzspectrum in a 2008 FCC auction. AT&T was also a major purchaser of B block licenses. The 700 MHz licenses to be acquired by AT&T cover 42 million people in 18 states, including California, Florida, New York and Virginia.The deal complements AT&T's existing holdings in the B block,the company said in a press release. The new spectrum willhelp the company deploy 4G LTE services and meet mobile broadband demand from smartphones and tablets, it added.In conjunction with the transaction, AT&T will sell a single AWS license to Grain Management, a wireless private equity firm, and will lease 700 MHz spectrum from Grain Management in three markets.The transaction is subject to regulatory approval. AT&T said it anticipates closing the transaction in the second half of 2013.

Windows earnings report a work of smoke and mirrors

Microsoft says the Windows division generated the most revenue last quarter, but in theend the report tell us absolutely nothing about Windows 8 sales
Last November I talked about the wayMicrosoft stacks the deck in its financial reports-- all perfectly legal, of course -- to obfuscate sales of its new Windows systems. We saw it happen with Vista and Windows7, and we're seeing it again with Windows 8. As I said back then: "We're likely to know lessabout Windows 8 sales in January than we do now."That's exactly what's happened.Microsoft released its fiscal Q2 resultslast night, and the sales part of the equation -- $21.5 billion for the whole company, up 3 percent year-over-year -- was exactly what everyone wanted to see: slow, steady growth. Profits weren't quite asreassuring, with operating income down 3 percent from last year, but it's hard to argue with a $7.8 billion profit.Once again, we saw deft application of the deferred revenue technique. Microsoft can book income from a sale now or later, depending on its estimates of how many customers have upgraded, or will upgrade, to Windows 8. Theearnings reportgives both numbers, with and without deferrals.If you ignore the revenue deferrals, the Windows divisionhad just under $5.9 billion in income. Include the deferrals and the adjusted figure is just under $5.3 billion, which is$518 million -- or 11 percent --higher than a year ago. That's quite an accomplishment, given the fact that PC sales in the fourth quarter of 2012 weredown 6.4 percent, year over year, according to IDC.The one hard and fast accounting rule is that Microsoft has to unwind all of its Windows 8 revenue deferrals by the end of February, when itsupgrade offers expire. There's an extra$1.1 billion in deferred incomefloating around that will show up in the Windows division's fiscal Q3 report, unless it comes up with a different accounting technique.So look for a similarly obfuscating but apparently positive report on Windows division sales next quarter.The best analysis of the numbers I've seen comes fromMatt Rosoff at CITEworld. Rosoff estimates that at least$300 million of that $518 million difference came from sales of Surface RT. Microsoft claims its volume license sales were up more than 10 percent from last year. It also says that OEM revenue "outperformed the overall x86 PC market." Considering the overall PC market was down 6.4 percent, I'd call that damning with extremely faint praise.I guess we could try to read something into the fact that Microsoft repeated its statement from three weeks ago that it's sold60 million copies of Windows 8. But the original statement was so squishy it wasn't even credible.If Windows 8 were tracking at 18 to 20 million copies per month, as Windows 7 did for most of its later lifetime, I'm sure we would've heard something about 70 million or 75 million in Win8 sales to date. But we haven't. We also haven't heard diddly about Windows RT sales.In the end, what does Microsoft's quarterly report tell us about Windows 8?Absolutely nothing -- which, I suspect, is exactly what the brass at Microsoft want.

Twitter updated embedded tweets with new features

Twitter has added some new functionalities to embedded tweets such as now tweets have more space for your content and context, embed tweet to your website etc

Tweets bring you closer to what’s happening around the world, from breaking news to global conversations. With embedded Tweets, you can see and interact with Tweets across the web. We often embed Tweets here on our blog to highlight great Tweets, photos and other content shared on Twitter; you can embed any Tweet on your website too.

Embedded Tweets display photos, videos, article summaries and other content shared in a Tweet, just like you see on twitter.com. You can also view retweet and favorite counts to better understand engagement, and we’ve made some tweaks to the design so that embedded Tweets are easier to read.

You’ll see Embedded Tweets show up faster on the sites you visit.


With updated embedded features, you can easily embed any Tweet on your own website.  Just click the “More” button in any Tweet on twitter.com, and then select “Embed this Tweet” to enrich your blog posts or pages.

 

The post Twitter updated embedded tweets with new features appeared first on
www.whitehatillusions4u.blogspot.in

How to Reset Windows 8 Password in Minutes

According to Microsoft, Windows 8 is most secure operating system ever and Microsoft also claims, it is pretty difficult to crack Windows 8, but Microsoft has forgot to fix its password reset hack that also works on earlier windows version including windows 7, windows vista, and Windows Server 2008.

To change Windows 8 user’s password, all you have to need is Windows 8 System Recovery disc or USB flash drive. This hack work with built-in troubleshooting tools, So no third-party software is required.

reboot.pro user Jamal H. Naji has discovered this windows 8 password hack,

It has been less than 2 months since the launch of Windows 8 and I recieved tons of emails from Boot-Landers /members and guests also friends and collegues asking me if there’s a way to reset a forgotten Windows 8 password the easiest way ? The answer was yes and as usual without the need for any third party software to unlock or remove or reset the user or admin account password. Here I will try to make an easy to follow tutorial that will be useful for novice users as well as professionals when they get stuck behind the logon screen of a Windows 8 because they lost or forgotten their password.


Check at below how to reset windows 8 account password:-

1- You need a Windows 8 PC to make a System Recovery Disk .

2- You need a CD Burner + Blanck CD.

3- If you have a tablet or a netbook and you don’t have a CD burner then You need a 512 MB USB thumb drive to make a System Recovery USB instead.

4- To make a system recovery CD, Go to control panel and navigate to Windows 7  File Recovery, click on that icon, and
from the next screen choose from the top left ( Create a System Recovery Disk ) and follow the on-screen instructions to make
that CD.

5- To make a System Recovery USB thumb drive go to control panel and navigate to ( Recovery ), click on that icon and from
the next screen choose ( Create a recovery drive ) and follow the instructions to make a bootable System Recovery USB.

6- When you are ready, boot the locked PC that needs to be unlocked with that CD or USB you just made, and follow the
pictures below :

7- The command prompt screen will open, type : diskpart and hit Enter key

8- Type :  list vol and hit Enter key (watch for spaces)

9- locate your Windows partition letter ( in our case here the letter will be C drive)

10- Type : Exit and hit Enter key.

11- Type:  c:   and hit Enter key  (your Windows drive maybe different so change it accordingly to the drive letter you have)

12- Type: cd windows (watch for spaces ) and hit Enter key

13- Type: cd system32 (watch for spaces) and hit Enter key

14- Type: copy  cmd.exe cmd.exe.original (watch for spaces) and hit Enter key.

15- Type: copy Utilman.exe Utilman.exe.original (watch for spaces) and hit Enter key.

16- Type: del Utilman.exe  (watch for spaces)  and hit Enter key.

17- Type: ren cmd.exe Utilman.exe  (watch for spaces)  and hit Enter key.

18- Type: Shutdown  -r  -t  00 (watch for spaces) and hit Enter key, the PC will restart.

19 – When you reach the Logon screen click on the Ease of Access Center icon on the left bottom side of the screen.

20 – The command prompt window will open

21- Type: net user  (watch for spaces)  and hit Enter key.

22- Type: net user  Reboot.Pro *  ( replace Reboot.Pro with the name you find in your pc)  and hit Enter key

23- now type the new password you want and hit Enter key( when you type the cursor will not move and you will not see what you
type, so be careful what you type, because you are typing blindly the new password)

24- confirm the new password when prompted and hit Enter key when done:

25- Type exit and hit the Enter key to close the command window.

26- Logon now to the locked account with the new password you just created.

27- After successfully unlocking  your account and resetting the account password now you need to roll back the changes you
made to Utilman.exe and cmd.exe, so go ahead and boot your pc with the System Recovery CD or USB you made earlier in this
tutorial and repeat steps in # 6 so you open the command prompt window :
28- Type: c: and hit Enter key(your Windows drive maybe different so change it accordingly to the drive letter you have) [see picture below]
29- Type:  cd windows  (watch for spaces) and hit Enter key [see picture below]
30- Type:  cd system32 (watch for spaces) and hit Enter key [see picture below]
31- Type:  del  Utilman.exe  (watch for spaces) and hit Enter key [see picture below]
32- Type: ren  Utilman.exe.original Utilman.exe  (watch for spaces) and hit Enter key [see picture below]
33- Type: ren cmd.exe.original cmd.exe  (watch for spaces) and hit Enter key [see picture below]
34- Type: shutdown  -r  -t  00  (watch for spaces) and hit Enter key to reboot your pc [see picture below]

35- Now when the pc reboots and reaches the logon screen, check to see if the Utilman is fixed and returned back to place by
clicking on its icon on the bottom left side of the screen, if the Ease of Access list pops up then you succeeded in your work.
See picture below.

PS: some of you might have a Windows 8 Installation DVD, he can use it also in this process, boot with this Windows  DVD and
when you reach the first screen where you have to click next – stop there and hit SHIFT key + F 10 , the command prompt window
will pop up and you can use it as we did in steps 7 onward to the end. see picture below

[Source: Reboot.pro]

The post How to Reset Windows 8 Password in Minutes appeared first on
www.whitehatillusions4u.blogspot.in

Exciting Features of Windows 8 as Infographic

The infographic gives users a glance at the various stages of development, editions and the usage of Windows 8 on various devices. Data, statistics and details of the salient features of the OS are presented with clarity along with striking illustrations. The listing of pros and cons lets users to know what they can expect from the OS.

Infographic is designed by Dot Com Infoway – Infographic Design Services

checkout my blog and keep in update and forward and subscribe ur frnds
www.whitehatillusions4u.blogspot.in

Your facebook account has been blocked due to suspicious activity

A bogus email claims facebook users that, “Your account has been blocked due to suspicious activity”, and tricks with them to click on malicious link to verify their facebook account.

Subject:- Account suspicious activity

Email Body:- 

Hi {victims-name},

Your account has been blocked due to suspicious activity.

To verify account, please follow this link:

http://www.facebook.com/confirmemail.php?e={victims-email}&c=6655953

You may be asked to enter this confirmation code: 6655953

The Facebook Team

The above email is personalized email, that can targets to any specific persons.

Don’t be surprised to see the facebook link, Cybercriminals hide their actual malicious URL  under facebook fake URL, This is very simple way to trick with peoples, lets see how it works.

Clicking on this link www.yahoo.com redirects to my home page, www.yahoo.com, You can see actual URL by hovering your mouse pointer on the link.

So when any one clicks on the link, it redirects to fake facebook login page or facebook phishing page, and asks you to your login information.

The post Your facebook account has been blocked due to suspicious activity appeared first on Www.whitehatillusions4u.blogspot.in

How to turn on SSL for your Yahoo Mail

Yahoo mail has added SSL to more secure your email account, Previously Yahoo mail only supports https for login page after login, https convert to http, But from Now Yahoo mail provides Https for entire account.

If you sign in to Yahoo! Mail via a non-secure Internet connection such as a wireless network, your Yahoo! account is more vulnerable to hijacking. Non-secure networks make it easier for someone to impersonate you and gain full access to your Yahoo! account, including any sensitive data you may be storing. Enhance the security of your entire Yahoo! Mail session with HTTPS data encryption (via security socket layer, or SSL) and protect your account from hijackers and fraud.


By default yahoo did not turn on SSL, you have to enable it manually, check it below how to turn SSL for your yahoo mail account:-

Step 1:- First of all, login to your yahoo mail account.

Step 2:- Now click on the settings icon at the top right corner of the screen and select Mail options.

Step 3:- After default page open(General menu), move to to Advanced Settings and check the turn on SSL box.

Step 4:- Now in pop up menu click on the Ok, and save it.

After saving settings, your page refreshes, and it turns on SSL for your yahoo mail account. If your want to turn off SSL then follow all above steps again.

The post How to turn on SSL for your Yahoo Mail appeared first on www.whitehatillusions4u.blogspot.in

Anonymous Group threatens UK Government

The hacking group, Anonymous threatens UK government to changed current systems. They warned government to assist their requests another they have declared war.

Greetings citizens of the world, we are anonymous.

Government of the United Kingdom, It has come to our attention, that despite our continued warnings, you have decided to disregard our requests to assist the people of this country, and have persisted in running a system which only benefits yourselves and the giant corporate bodies operating here.

We have asked politely on many occasions that you change your attitude towards leadership, that you serve the country rather than control it, that you maintain the rights and freedoms of citizens. Instead, you have decided to impose worsening austerity measures upon the people of the UK, increasing taxes for citizens and small businesses, making cuts to our National Health Service, education system, pensions and police force.

You have told the people that the only option out of the financial crisis is to make cuts and have made this humours joke of “we are all in this together”, while simultaneously giving tax breaks to the wealthy corporations, enormous bonuses to the bankers who are responsible for the financial crisis in our country, and increasing your own wages.

You have created to system which ensures the poor remain poor, and the wealthy remain wealthy. You continue to infringe on the fundamental rights and freedoms of the people, attempting to gain access to our private and confidential information. It is now very clear to us that you have no intention of running the country for our people, but you will continue to run it to benefit yourselves.

This system has failed us. We now have homeless people dying on the streets this winter, people unable to support their families. People can no longer afford their education; you keep the elderly in work for much longer, keeping jobs and opportunities for younger people out of reach. The number of unemployed has skyrocketed. In response, you force those on benefits into unpaid labour, doing more hours unpaid than those who are properly employed. You add insult to injury, we say enough is enough.

To the UK government, you have made an enemy of Anonymous, you have angered us considerably and we pose a significant threat to you. You disregard the requests of the people and continue to operate for your own selfish gain. Anonymous is not a small group of powerless people to ignore, we are an organised , globally active, collective of like-minded individuals and our message is clear, we declare war on this current system you have imposed on us. Your worst enemy is now your own people. The revolution has begun.

We are anonymous,
We are legion,
We do not forgive,

Check Out Anonymous Youtube Video:

The post Anonymous Group threatens UK Government appeared first on whitehatillusions4u.blogspot.in

Microsoft repairs flaws in Forefront UAG, critical Office flaw


Microsoft addressed vulnerabilities in its Forefront Unified Access Gateway and flaws in Microsoft Office and PowerPoint as part of its monthly patching schedule.
The software giant issued three security bulletins, Tuesday, addressing 11 vulnerabilities in its November patching cycle. One of five vulnerabilities addressed in Microsoft Office could allow an attacker to execute code remotely on a victim's machine by getting a user to open a malicious rich text formatted email message. The security update is rated "critical" for Microsoft Office 2007 and 2010.
Josh Abraham, a security researcher at Boston-based vulnerability management vendor Rapid7 LLC, said the critical vulnerability could enable cybercriminals to conduct drive-by malware attacks.
Microsoft also addressed four security vulnerabilities in its Forefront Unified Access Gateway. The gateway is an SSL VPN, used to give remote employees secure access to enterprise systems and applications. The UAG is open to a spoofing flaw that enables rogue employees to increase their user privileges. The bulletin is rated "important" for all supported versions of Forefront Unified Access Gateway 2010.
"Without the fix, administrators who click the malicious[cross-site scripting] link could cause code executionallowing attackers to create users or change settings on the Forefront server," wrote Wolfgang Kandek, chief technology officer of Redwood Shores, Calif-based vulnerability management vendor Qualys Inc., in the company's blog.
In addition, Microsoft addressed two PowerPoint flaws. Microsoft said the flaws enable an attacker to execute code remotely on a victim's machine after getting the user to open a malicious PowerPoint file. Despite being rated "important," Microsoft has given the vulnerabilities an Exploitability Index rating of 1, meaning that public exploit code attempting to target the vulnerabilities is likely. The update affects Microsoft PowerPoint 2002, 2003, and Microsoft Office 2004 for Mac.
An Internet Explorer zero-day vulnerability, acknowledged by Microsoft last week, remains unpatched. Security experts warned that the workarounds in the advisory could break some Web pages.

sandbox


1). In general, a sandbox is an isolated computing environment used by software developers to test new programming code.
2). In a Java programming language and development environment, the sandbox is the program area and set of rules that programmers need to use when creating Java code (called an applet) that is sent as part of a page. Since a Java applet is sent automatically as part of the page and can be executed as soon as it arrives, the applet can easily do harm, either accidentally or as the result of malicious intent, if it is allowed unlimited access to memory and operating system services. The sandbox restrictions provide strict limitations on what system resources the applet can request or access. Essentially, the programmer must write code that "plays" only within the sandbox, much as children are allowed to make anything they want to within the confined limits of a real sandbox. The sandbox can be conceived as a small area within your computer where an applet's code can play freely - but it's not allowed to play anywhere else.
The sandbox is implemented not only by requiring programmers to conform to certain rules but also by providing code checkers. The Java language itself provides features such as automatic memory management, garbage collection, and the checking of address ranges in strings and arrays that inherently help to guarantee safe code. In addition, Java includes a compiled code (Java's compiled code is known as bytecode) verifier that guarantees adherence to certain limitations. Java also provides for a local name space within which code may be restricted. The Javavirtual machine (the layer that interprets the Java bytecode for a given computer platform) also mediates access to system resources and ensures that sandbox code is restricted.
In the original sandbox security model, the sandbox code is generally known asuntrusted code. In later versions of the Java Development Kit (JDK) - the programmer's development environment - the sandbox has been made more sophisticated by introducing several levels of trust that the user can specify for sandbox code. The more trust the user allows, the more capability the code has to "play" outside of the sandbox. In the Java Development Kit 1.1 version, the concept of a signed applet was introduced. An applet accompanied by a digital signature can contain trusted code that will be allowed to execute if the signature is recognized by the client browser.
In JDK 2.0, Java provides for assigning different levels of trust to all application code, whether loaded locally or arriving from the Internet. A mechanism exists to define a security policy that will be used to screen all code - whether signed or not - as it executes.

Gary McGraw on mobile security: It’s all about mobile software security


I wrote my first article on mobile device security way back in June 2005. In it, I pondered whether cell phones were going to be the next big security target. This was before the massive convergence of computers and phones. Even back then, we saw the storm brewing. In fact, the first real cell phone worm, Cabir, was released in 2004.  SMS (or texting as the kids call it) seemed like an even more obvious vector than Bluetooth and, sure enough, there are plenty of SMS-based attacks to be seen.
Convergence is all done now, and phones, computers, laptops, and iPads are mostly interchangeable. Today, the threats and risks that used to apply only to our Internet-connected computers with all of our personal data, financial data, medical data and so on, apply to all of our mobile devices. Oh, joy.
In fact, it’s even worse than that because those enterprises that battened down the hatches on their computer systems and wireless networks long ago now have to contend with the incredible pace of change involved with mobile devices, even devices their users buy for personal use. BYOD means modern mobile devices hop right on the corporate network as easily as they do at Starbucks. But they are harder to secure than a laptop.
Today’s mobile devices pack quite a technical punch --multi-core, multi-GHz processors, gigabytes of onboard and external storage capability coupled with WiFi, Bluetooth, and GSM or CDA radios -- all packed into a form factor not much larger than a candy bar. Yay. Little computers for your pocket -- and the future of business to boot  (there’s an app for that).
Mobile security 101Mobile devices have lots of moving parts to secure, from loaders and hardware at the bottom of the stack, to operating systems, VMs, and platform APIs, all the way to the ubiquitous apps. Each of these areas is prone to potential security weakness, not to mention the gaps between them all. But wait, there’s more. These parts are made, distributed, and used by multiple players who can directly impact the security posture of a device: users and their friends, mobile carriers, app store curators, OS manufacturers, and device manufacturers. Those are only the main players. Questions for another time:  Who makes the firmware? Where do the chips come from? Who built in a backdoor for remote management? Each of these players has an opportunity either to build security in properly or to screw things up completely for everyone. Look at this way: We don’t get safe cars, airplanes, medical devices, or any other such thing unless every parts supplier, integrator, and everyone else not only cares about safety, but actually competently does something about it.

ABOUT THE [IN]SECURITY COLUMN

This monthly security column by Gary McGraw started life in print in IT Architect and Networkmagazines and was originally called “[In]security.” That was back in October 2004. The column then transitioned into Web content at several publications before finding a home at SearchSecurity. You can always find pointers to the complete[In]security series on McGraw’s writing page. Your feedback on the column is greatly appreciated.
Each of the moving parts requires real security attention. Running a worldwide consultancy, I've  been uniquely positioned to see a wide overview of the entire mobile security landscape, taking on projects that run the gamut from handsets, to carriers, to back-end services. It’s a big landscape out there. We’ve assessed a plethora of parts, including: SMS, mobile and REST, mobile and SOA, and pure mobile apps for all kinds of players, from carriers to financial institutions and credit card consortia.
So what did we learn? We learned something we already know: It’s the software stupid! We can either build all of the moving parts correctly from a security perspective  -- and make sure they interact properly -- or we can give up and go home.
BTW, we don’t just mean look for a bunch of bugs (though that’s a good idea, and there are a number of potential problems built right into iOS, Symbian, and Android and their base languages Java and Objective-C). Many of the security weaknesses we have uncovered in real mobile systems are architectural flaws. That means what we have been saying all along about bugs and flaws applies just as well to mobile security as it does to regular software security.
Mobile software security touch pointsIn fact, if there is a silver lining in the big black cloud of mobile security, it’s that what we know about how to carry out software security can be applied directly to mobile security.
A quick review is in order. Pen testing? Good start, especially if you think your mobile app is perfect, because it’s not. A smoking burning pen test result will disavow you of that belief. Code review? You bet. Use a tool for best results. Architectural risk analysis, which is sometimes confused with threat modeling? Yep. Remember the flaws; they will make up at least half of the security defects that need to be fixed. The fact that the app you’re shipping has too much functionality, asks for too much permission to run, and collects way too much personal data. These are all flaws. Oh yeah, and make sure you fix the stuff you find. Too many security vendors and consultants are happy to break your stuff for you (sometimes mysteriously), and too few fix the problems they find. Ironically, if you don’t fix the security defects you find, your mobile system may even be less secure than when you started looking at it!
There are some differences in potential vulnerabilities when it comes to mobile software security, even if the security review techniques are the same. Mobile applications must more diligently authenticate their users, make fewer assumptions about the protection and transport of data, and more carefully handle the storage, creation, and deletion of subscriber data than standard-issue software. Just think about how your view of security would change if you lost your laptop as often as you lose your phone. As you do a review for security, make sure to consider five basic vulnerability areas: architectural flaws, device loss, platform weakness, isolation and permission problems, and application weakness.
Outsource mobile developmentLots of companies are outsourcing their mobile development to others. This happens when internal dev staff has no mobile experience. Sadly (but unsurprisingly), software security problems don’t automatically disappear when somebody else writes the code. In fact, they may be even less invested in security than you are. So, what to do about mobile app code you outsource?
The answer is fairly straightforward: Demand some evidence the vendor you choose has a clue about software security and back that up with service-level agreements (SLAs) that cover security.
If you are only commissioning one app, then by all means pen test the heck out of it. But know that a pen test is no substitute for a real code review, much less an architectural risk analysis. If the app is important enough to your business, make sure to get inside it and check it out thoroughly. Fix what you find. Lather. Rinse. Repeat.
If you are using a vendor to develop lots of mobile apps for you, ask them about their software security initiative and steer them toward the Building Security in Maturity Model (BSIMM). Do they have a software security development lifecycle (SSDL), a software security group (SSG) and a real software security initiative (SSI)? They should, and they should be able to describe them very clearly.
About that app storeIf you decide you need to host an app store of your own, you really have your work cut out for you. Do you stick whatever anyone sends you on your virtual shelves?  What about malware? Do you check permissions against some sane notion of required privilege? Do you take responsibility for infecting your customers? Are Trojan horse programs OK by you? Starting and maintaining an app store is a big enough ball of wax that it deserves its own article. Suffice to say, security should be a fundamental concern.
Mobile malwareI recently wrote an article on bad software, aka badware, and malware. Eliminating badware will help solve the malware problem. This insight applies to mobile security just as it does to any other software-based system. Need some fresh evidence? Look no further than the recent Flame malware, which includes a Bluetooth component aimed directly at sucking the secrets out of mobile devices.
If you haven’t started already, it’s time for your company to get its mobile security act together!

Thirteen principles to ensure enterprise system security


Long ago in a galaxy far away, two Jedi Knights by the names of Jerry Saltzer and Michael Schroeder published a paper titled "The Protection of Information in Computer Systems (PDF)."  Section three of that paper is a quick treatment of some essential design principles for information security.  To say that "Saltzer and Schroeder," as it has come to be known, was a seminal work in security is an understatement; everything they had to say back in 1975 is relevant today, nearly 40 years later.
Don’t try to go it alone if you can’t.  And don’t feel bad about asking for help; this stuff is tricky.
As your New Year’s resolution, I encourage you to adopt these 13 principles whenever you design a new system. Even though a baker's dozen isn't always considered lucky (note that I have expanded Saltzer and Schroeder’s original list just a smidgen for 2013), I'm confident you'll have good fortune by putting these principles into practice in your organization.
Thirteen security design principles
1) Secure the weakest link -- Spaf (that is, highly respected security expert Gene Spafford of Purdue University) teaches this principle with a funny story.   Imagine you are charged with transporting some gold securely from one homeless guy who lives in a park bench (we’ll call him Linux) to another homeless person who lives across town on a steam grate (we’ll call her Android).  You hire an armored truck to transport the gold.  The name of the transport company is "Applied Crypto, Inc."  Now imagine you’re an attacker who is supposed to steal the gold.  Would you attack the Applied Crypto truck, Linux the homeless guy, or Android the homeless woman?  Pretty easy experiment, huh?  (Hint: the answer is, "Anything but the crypto.")
As my co-author John Viega and I wrote back in our 2001 book, Building Secure Software, "Security practitioners often point out that security is a chain; and just as a chain is only as strong as the weakest link, a software security system is only as secure as its weakest component."  Attackers go after the weakest point in a system, and the weakest point is rarely a security feature or function.  When it comes to secure design, make sure to consider the weakest link in your system and ensure that it is secure enough. 
2) Defend in depth  Author and consultant Kenneth van Wyk likes to call this one the "belt and suspenders" approach.  Redundancy and layering is usually a good thing in security.  Don’t count on your firewall to block all malicious traffic; use an intrusion detection system as well.   If you are designing an application, prevent single points of failure with security redundancies and layers of defense.  FromBuilding Secure Software, "The idea behind defense in depth is to manage risk with diverse defensive strategies, so that if one layer of defense turns out to be inadequate, another layer of defense will hopefully prevent a full breach." It's a concept preached universally by information security experts, and for good reason: it works.
3) Fail securely -- Make sure that any system you design does not fail "open."  My favorite story about this principle comes from the ill-fated Microsoft Bob product of yesteryear.  (Bob was the precursor of Clippy the paperclip.)  According to legend, if you failed to get your username and password right after three attempts, Bob would helpfully notice and ask whether you wanted to pick a new password to use.  Thanks Bob (said the hacker)!  Obviously a better default in this situation is to deny access.
From Building Secure Software, "Any sufficiently complex system will have failure modes. Failure is unavoidable and should be planned for. What is avoidable are security problems related to failure. The problem is that when many systems fail in any way, they exhibit insecure behavior." 
4) Grant least privilege -- When you do have to grant permission for a user or a process to do something, grant as little permission as possible.  Think about your Outlook contacts.  If you need someone to have access to your contacts to see some data, grant them reader permission, but do not grant them edit permission.  Or if you want a geekier example, try this: most users of a system should not need root permission for their everyday work, so don’t give it to them.  Bottom line, avoid unintentional, unwanted, or improper uses of privilege by doling it out in a miserly fashion.
5) Separate privileges -- I once saw a system that divided its authentication front end into an impressive number of roles with different degrees of access to the system.  The problem was that when a user of any role had to perform a back-end database action, the software granted each user de-facto administrator privilege  temporarily.  Not good.  Even the lowliest intern could blitzkrieg the database. 
Know that if an attacker is able to finagle one privilege but not a second, she may not be able to launch a successful attack.  Keep privilege sets apart.
6) Economize mechanism -- Complexity is the enemy of security engineering and the friend of the attacker. It’s just too easy to screw things up in a complicated system, both from a design perspective and from an implementation perspective.  The irony: Want to see something complicated?  Check out just about any piece of modern enterprise software! 
Do what you can to keep things simple.  From Building Secure Software, "The KISS mantra is pervasive: 'Keep It Simple, Stupid!' This motto applies just as well to security as it does everywhere else. Complexity increases the risk of problems. Avoid complexity and avoid problems."
7) Do not share mechanisms -- Should you plunk your inward-facing business application on the public cloud?  Probably not, according to this principle.  Why have your authentication system deal with random Internet traffic when you can limit it to employees who you (supposedly) trust? 
Here’s a geekier example. If you have multiple users using the same components, have your system create different instances for each user.   By not sharing objects and access mechanisms between users, you will lessen the possibility of security failure.
8) Be reluctant to trust -- Assume that the environment where your system operates is hostile.  Don’t let just anyone call your API, and certainly don’t let just anyone gain access to your secrets!  If you rely on a cloud component, put in some checks to make sure that it has not been spoofed or otherwise compromised.  Anticipate attacks such as command-injection, cross-site scripting, and so on.
This principle can get tricky fast.  From Building Secure Software, "One final point to remember is that trust is transitive. Once you dole out some trust, you often implicitly extend it to anyone the trusted entity may trust."
9) Assume your secrets are not safe -- Security is not obscurity, especially when it comes to secrets stored in your code.  Assume that an attacker will find out about as much about your system as a power user, maybe more.  The attacker’s toolkit includes decompilers, disassemblers, and any number of analysis tools.  Expect them to be aimed at your system.  Ever look for a crypto key in binary code?  An entropy sweep can make it stick out like a sore thumb.  Binary is just a language.
10) Mediate completely -- Every access and every object should be checked, every time.  Make sure your access control system is thorough and designed to work in the multi-threaded world we all inhabit today.  Whatever you do, make sure that if permissions change on the fly in your system, that access is systematically rechecked.  Don’t cache results that grant authority or wield authority.  In a world where massively distributed systems are pervasive and machines with multiple processors are the norm, this principle is a doozy to think about.
11) Make security usable -- If your security mechanisms are too odious, your users will go to great length to circumvent or avoid them.  Make sure that your security system is as secure as it needs to be, but no more.  If you affect usability too deeply, nobody will use your stuff, no matter how secure it is.  Then it will be very secure, and very near useless.
Spaf has always laughed at the line that mentions how the most secure system in the world is one with its hard drive demagnetized that is buried in a 30 foot hole filled with concrete poured around a Faraday grid.  Such a system is, ahem, difficult to use.
12) Promote privacy -- Yeah, I know, everybody talks about privacy, but most people don’t actually do anything about it.  You can help fix that.  When you design a system, think about the privacy of its ultimate users.  Are you collecting personally identifiable information (PII) just because somebody from the marketing team said to do so?  Is it a good thing to do?  Do you store PII in a place where it can be compromised?  Shouldn’t that be encrypted? Information security practitioners don't always have to provide the answers to these privacy questions (that's what CIOs get paid for), but it's important for infosec to put forth these kinds of questions if no one else does.
13) Use your resources -- As I was taught in troop leader development class when I was 14, "use your resources" is a principle with incredibly wide application.  If you’re not sure whether your system design is secure, ask for help.  Architectural risk analysis is hard, but there are people who have been doing it well for decades.  Don’t try to go it alone if you can’t.  And don’t feel bad about asking for help; this stuff is tricky.
Borrow others' good ideas, or 'It’s a small world after all'I will never forget the day that I was presenting some slides on software security at a HSARPA meeting in Silicon Valley.  The presentation was based on my bookBuilding Secure Software, which has a chapter on these security principles.  One of the slides had a picture of Saltzer and Schroeder on it, and who should happen to be sitting in the very small audience? None other than Michael Schroeder himself!  Small world indeed.  For what it’s worth, he approved of the slide. Salzer and Schroeder were right in 1975, remained right when we wroteBuilding Secure Software, and remain right today.  Apply their ideas every day in 2013. And don't be afraid to use good ideas developed by others (though always give credit where credit is due).
The original reference is always bestHere is a complete citation of Saltzer and Schroeder’s original article:
Saltzer, Jerome H. & Schroeder, Michael D. "The Protection of Information in Computer Systems," 1278-1308. Proceedings of the IEEE 63, 9 (September 1975).  See especially, section 3.  The paper is available on the web herehttp://www.cs.virginia.edu/~evans/cs551/saltzer/
About the author:
Gary McGraw is the CTO of Cigital, Inc., a software security consulting firm with headquarters in the Washington, D.C. area and offices throughout the world. He is a globally recognized authority on software security and the author of eight best selling books on this topic. His titles include Software Security, Exploiting Software, Building Secure Software, Java Security, Exploiting Online Games, and 6 other books; and he is editor of the Addison-Wesley Software Security series.  Dr. McGraw has also written over 100 peer-reviewed scientific publications, authors a monthly security column for SearchSecurity and Information Security magazine, and is frequently quoted in the press. Besides serving as a strategic counselor for top business and IT executives, Gary is on the Advisory Boards of Dasient (acquired by Twitter), Fortify Software (acquired by HP), Wall + Main, Inc., and Raven White. His dual PhD is in cognitive science and computer science from Indiana University where he serves on the Dean's Advisory Council for the School of Informatics.  Gary served on the IEEE Computer Society Board of Governors and produces the monthly Silver Bullet Security Podcast for IEEE Security & Privacy magazine (syndicated by SearchSecurity).