Tag Archives: Deloitte

About 918 days ago Spyware and Malware

Malware Takes Aim at USB Devices

our beautiful site

A USB drive is such a handy, inexpensive way to transport information that technology research analyst Gartner estimates 222 million USB devices shipped last year. But in some instances, those devices transport trouble as well. Small businesses in particular are paying a price for the convenience of using USB drives. As we grow more savvy to malicious attacks via e-mail and other avenues, cybercriminals are turning to USB drives to distribute malware. According to research by Panda Security, a whopping 25 percent of malware today is developed to disseminate through USB devices.  The top two threats in security provider BitDefender’s most recent E-Threats report are spread through USB drives. “Just these two viruses account for 17 percent of the total number of malware apps in the world,” says Catalin Cosoi, head the Online Threats Lab for BitDefender. BitDefender is also seeing new samples of malware distributed via USB drive. “Most hackers are lazy and don’t want to spend hours and hours trying to hack secured computers,” Cosoi explains. “If they can attack an easy target with just a few clicks, they will do that. Spreading malware through USB devices is just as easy as it sounds.” Why you might be vulnerable The risk posed by malware-infected USB drives isn’t limited to small and mid-sized businesses. IBM apologized after distributing infected drives at an Australian security conference earlier this year. However, experts say small businesses are vulnerable because of these factors: Older operating systems. Windows Vista and Windows 7 offer much more protection against infected USB drives, notes Tim Armstrong, a malware analyst with security vendor Kapersky Labs. However, Windows XP remains the most-used operating system worldwide, and the malware exploits the “AutoRun” feature for removable media. Stick a USB drive into the port on a Windows XP machine, and you may find your every keystroke logged and sensitive business files distributed to servers halfway around the world. Even if your company has upgraded its operating system, your employee might be working at home on Windows XP. A lack of security know-how. Smaller businesses are less likely to have dedicated IT personnel or to have policies in place to combat risky USB use. For instance, Good Samaritans in your company may be inclined to pick up a drive found in the parking lot, then insert it into their work computer to see if they can find the drive’s owner. “Somebody could write a script on that drive that goes and searches for your sales database and contact list,” says Rich Baich, principal for security and privacy at Deloitte & Touche LLP. Alternative ways to share information. It may be easier for a small company to rely on USB drives than to take the time and resources to develop other solutions, such as working in the cloud. How to protect your business You can’t afford to ignore this threat, say security experts. However, there are smart steps you can take to insulate your business from the risks posed by malware-infected USB devices. These steps are essential: Maintain up-to-date security solutions. Make sure your security is up to date on all computers attached to your business, and enable Windows updates. Consider an endpoint security solution that can prevent USB drives from being recognized Disable AutoRun. Countless online tutorials detail how to disable AutoRun. To temporarily disable AutoRun, hold down the shift key as you insert a USB drive. Maintain a dedicated computer. If your business is small enough that it’s practical to keep all critical information on one computer, consider doing so, says Baich. Then, don’t ever insert USB devices into that computer. “Keep it very clean. Don’t go surfing websites, use it only for business functions,” he advises. Update your operating system. Lessen your risk by using a more recent version of Windows or another operating system. Use security-protected devices. “Although USB drives are a major culprit for spreading malware, they have also evolved tremendously over the years,” says Cosoi.  “Some brands have built-in security software, which makes them safer. Look for these USB drives, and use them exclusively.” Educate your employees. In most cases, your employees are going to find the simplest, most convenient way to get their jobs done. It’s up to you to provide a means for them to move information when necessary and to outline the risks involved with USB drive use. Even posting a sign telling workers not to use unknown USB devices is likely to help. However, establishing a usage policy is your best protection. Parameters might include never running personal USB drives on work computers or business drives on home computers and passing along “found” drives to a designated employee, who can safely scan the devices. Consider alternatives. “It’s almost time to move away from USB sticks to cloud-based solutions,” Armstrong says. Break the USB habit by offering alternatives for file-sharing and storage, but make sure you have employee buy-in, say experts. “Companies should take this issue very seriously,” cautions Cosoi. “At BitDefender, we think USB-transmitted malware is more dangerous than e-mail or other ways of propagating malware.”  

About 918 days ago Mobility Tips and Tricks

Malware Takes Aim at USB Devices

our beautiful site

A USB drive is such a handy, inexpensive way to transport information that technology research analyst Gartner estimates 222 million USB devices shipped last year. But in some instances, those devices transport trouble as well. Small businesses in particular are paying a price for the convenience of using USB drives. As we grow more savvy to malicious attacks via e-mail and other avenues, cybercriminals are turning to USB drives to distribute malware. According to research by Panda Security, a whopping 25 percent of malware today is developed to disseminate through USB devices.  The top two threats in security provider BitDefender’s most recent E-Threats report are spread through USB drives. “Just these two viruses account for 17 percent of the total number of malware apps in the world,” says Catalin Cosoi, head the Online Threats Lab for BitDefender. BitDefender is also seeing new samples of malware distributed via USB drive. “Most hackers are lazy and don’t want to spend hours and hours trying to hack secured computers,” Cosoi explains. “If they can attack an easy target with just a few clicks, they will do that. Spreading malware through USB devices is just as easy as it sounds.” Why you might be vulnerable The risk posed by malware-infected USB drives isn’t limited to small and mid-sized businesses. IBM apologized after distributing infected drives at an Australian security conference earlier this year. However, experts say small businesses are vulnerable because of these factors: Older operating systems. Windows Vista and Windows 7 offer much more protection against infected USB drives, notes Tim Armstrong, a malware analyst with security vendor Kapersky Labs. However, Windows XP remains the most-used operating system worldwide, and the malware exploits the “AutoRun” feature for removable media. Stick a USB drive into the port on a Windows XP machine, and you may find your every keystroke logged and sensitive business files distributed to servers halfway around the world. Even if your company has upgraded its operating system, your employee might be working at home on Windows XP. A lack of security know-how. Smaller businesses are less likely to have dedicated IT personnel or to have policies in place to combat risky USB use. For instance, Good Samaritans in your company may be inclined to pick up a drive found in the parking lot, then insert it into their work computer to see if they can find the drive’s owner. “Somebody could write a script on that drive that goes and searches for your sales database and contact list,” says Rich Baich, principal for security and privacy at Deloitte & Touche LLP. Alternative ways to share information. It may be easier for a small company to rely on USB drives than to take the time and resources to develop other solutions, such as working in the cloud. How to protect your business You can’t afford to ignore this threat, say security experts. However, there are smart steps you can take to insulate your business from the risks posed by malware-infected USB devices. These steps are essential: Maintain up-to-date security solutions. Make sure your security is up to date on all computers attached to your business, and enable Windows updates. Consider an endpoint security solution that can prevent USB drives from being recognized Disable AutoRun. Countless online tutorials detail how to disable AutoRun. To temporarily disable AutoRun, hold down the shift key as you insert a USB drive. Maintain a dedicated computer. If your business is small enough that it’s practical to keep all critical information on one computer, consider doing so, says Baich. Then, don’t ever insert USB devices into that computer. “Keep it very clean. Don’t go surfing websites, use it only for business functions,” he advises. Update your operating system. Lessen your risk by using a more recent version of Windows or another operating system. Use security-protected devices. “Although USB drives are a major culprit for spreading malware, they have also evolved tremendously over the years,” says Cosoi.  “Some brands have built-in security software, which makes them safer. Look for these USB drives, and use them exclusively.” Educate your employees. In most cases, your employees are going to find the simplest, most convenient way to get their jobs done. It’s up to you to provide a means for them to move information when necessary and to outline the risks involved with USB drive use. Even posting a sign telling workers not to use unknown USB devices is likely to help. However, establishing a usage policy is your best protection. Parameters might include never running personal USB drives on work computers or business drives on home computers and passing along “found” drives to a designated employee, who can safely scan the devices. Consider alternatives. “It’s almost time to move away from USB sticks to cloud-based solutions,” Armstrong says. Break the USB habit by offering alternatives for file-sharing and storage, but make sure you have employee buy-in, say experts. “Companies should take this issue very seriously,” cautions Cosoi. “At BitDefender, we think USB-transmitted malware is more dangerous than e-mail or other ways of propagating malware.”  

About 4464 days ago E-Commerce

A Helping Hand With Taxing Matters

Best of the Web Tax pointers are available from several online sites at no charge. Twelve CEOs assess what the advice is really worth Print neatly. That’s the kind of advice that the IRS considers a “dynamite” tax tip, Dave Barry once wrote in his Miami Herald column. “If you ask them a real tax question, such as how you can cheat,” Barry said, “they’re useless.” The IRS won’t tell you how to cheat, but it does attempt to mitigate the tax-filing (if not the tax-paying) ordeal by offering a helping hand, and now it does so online. In partnership with the Small Business Administration, the IRS makes tax information for business owners quickly and easily accessible on a Web site titled Small Business Corner ( www.irs.ustreas.gov/bus_info/sm_bus). The site offers the government’s latest intelligence on such things as its rules for business-expense deductions and what the tax agency considers the best record-keeping systems for small companies. If the IRS is the authoritative source of tax information, is there any reason to look elsewhere on the Net for tax expertise? Several privately owned sites say yes. Each site has its own spin, depending on what group it aims to attract — a general small-business audience or merely start-up entrepreneurs, for example. Like the IRS site, the private offerings are free. They contrast with the tax-prep sites, such as Intuit’s TurboTax or H&R Block’s TaxCut, which enable users to fill out their tax returns online for a fee. To determine which of the tax-advice sites were worthwhile, Inc. asked 12 small-business CEOs to evaluate seven of the most popular ones. Two of the sites belong to Big Five accounting firms: Deloitte & Touche’s Dtonline.com and Ernst & Young’s TaxCast.com. Individual accountants operate others, including TaxMama.com, which began as an online newsletter. Another site that was a newsletter before it evolved into an in-depth source of complex tax matters is TaxProphet.com. It has 40,000 users and registers about 300,000 hits a month, according to tax lawyer Robert L. Sommers, who runs it. Although the sites don’t charge user fees, some make money by selling ads posted alongside the tax advice. Others are marketing tools. For example, Sommers, who’s also a columnist for the San Francisco Examiner, says that TaxProphet.com brings in clients for his law practice — and generates ideas for his column. Sommers claims that even taxpayers who have the assistance of a certified public accountant can benefit from consulting the tax-code nuances laid out in TaxProphet.com. “At tax time, CPAs are working 18-hour days and may not have time to ponder the gray areas, like whether you need a W-4 for the Israeli teacher you employed or if a treaty with Israel makes that unnecessary,” he says. Traffic is heaviest on the sites in the run-up to the April 15 tax-filing deadline, but they post information for all seasons. One tip on TaxMama.com last fall, for instance, suggested that tax-payers consider charging business expenses to a credit card up until December 31, 2000. The charges are deductible on the 2000 return, even if they weren’t paid before year-end. If you’re perplexed by some tax wrinkle or want an update on lawful tax-avoidance schemes, which of the seven sites is your best bet? Here’s what our CEOs had to say. www.bankrate.com What it’s good for: A well-organized, clearly defined primer. “The entire site has a lot of value,” said one CEO. Bankrate.com contains a Calculations section, which is useful for computing gross profit margins and a variety of business ratios. Don’t waste your time if: You want a hard-core, business-oriented site or you’re a lender or you’re doing tax work for a financial institution. What our CEOs had to say: “It will make my favorites list,” commented one reviewer. A second panelist said, “This site is easy to navigate, easy on the eyes, and gives you a good, brief understanding of each topic.” What you ought to know: The site’s owner is Bankrate Inc. (formerly known as Bank Rate Monitor), based in North Palm Beach, Fla., a longtime publisher of financial information. Bankrate.com’s content now appears in the Money section of Usatoday.com. www.dtonline.com What it’s good for: A guide for personal financial planning. It also contains useful tidbits, including a schedule of gift- and estate-tax rates and a rundown of 10 “essential” practices for growing a company. Don’t waste your time if: You need access to tax schedules or links to other sites. What our CEOs had to say: “One visit was all it took” to sour one CEO on the site because he found it lacked forms that he could download. A fellow panelist, however, said the site was “very informative, especially for small businesses.” What you ought to know: Dtonline.com contains a weekly online missive, “Tax News & Views,” a Deloitte & Touche compilation of the latest tax news from Washington. www.irs.ustreas.gov/bus_info/sm_bus What it’s good for: Comprehensive tax information furnished by the IRS and tailored for small businesses, plus links to other useful tax-related sites, such as www.tax.gov (which covers the tax- and wage-reporting basics). Don’t waste your time if: You seek tax loopholes. What our CEOs had to say: “Excellent tax information for small businesses,” one panelist said. It’s great for “getting a handle on tax issues relating to a start-up,” said another. Still, one CEO disliked the site and said he couldn’t find valuable advice there. What you ought to know: The IRS also offers online sites not specifically devoted to small businesses, including www.irs.ustreas.gov, a guide for filing electronic tax returns. www.smbiz.com What it’s good for: News and tax tips are updated daily. It also has a host of useful links to other sites. Don’t waste your time if: You need answers to specific tax questions. What our CEOs had to say: They agreed that the site is valuable mostly as a “link farm,” in the words of one of them. They generally faulted its design as lacking pizzazz. What you ought to know: The genesis of the site is the Small Business Tax Review, a newsletter published since 1980 by the A/N Group, in Melville, N.Y., a provider of tax news and analyses for small businesses. www.taxcast.com What it’s good for: Tax-law summaries and a trove of tax documents mostly suited to accountants and financial planners. Don’t waste your time if: You want a fast, easy-to-understand tour through the tax landscape. One business owner said the site, though rich in complex information, was “too sterile” and “does not keep my interest.” What our CEOs had to say: They applauded its many links and other resources, but craved a more inviting format. “It’s very vanilla,” said one panelist. What you ought to know: Affiliated sites furnish many kinds of Ernst & Young tax help. One example is www.ey.com, a site well known for financial counseling for individuals and families. www.taxmama.com What it’s good for: A joyful and occasionally informative romp through the tax world for inexperienced businesspeople. This site’s “personal commentary and humor make it unintimidating,” said one CEO. Another recommended it only for tax filers with rudimentary questions. Don’t waste your time if: You’re looking for a highly professional format or need more than a casual presentation of everyday tax issues. What our CEOs had to say: This is a site “more geared toward the consumer than toward businesses,” said one CEO. Another echoed the assessment, saying, “It just doesn’t have the kind of information I need” as a business owner. However, a third CEO said that this is a “great site with good information.” What you ought to know: The site’s founder, Eva Rosenberg, holds the Enrolled Agent credential, which the U.S. Treasury Department issues to qualified accountants. Rosenberg claims to respond to every E-mail query she receives. www.taxprophet.com What it’s good for: Basic facts. The site’s a good do-it-yourself reference for those who are just starting a business and can’t afford an accountant. “If you know what you’re looking for,” one CEO said, “you can do full-text searches of a large tax-law database,” which will give you a heap of hits to sift through. You just need to have the time to do it. Don’t waste your time if: You want quick answers to your questions. What our CEOs had to say: It’s better to leave to an accountant the kind of time-consuming tax research that’s available on the site. “I don’t have the time to just browse,” one CEO said, and “it’s cheaper for me to call my accountant for a quick answer.” But for those with the stomach for truly in-depth tax research or an education in tax law, the site may be useful, according to another reviewer. What you ought to know: In the spirit of fulfilling Robert Sommers’s mission of educating its users about everything to do with taxes, the site posts advisories about tax scams on an online bulletin board. The bottom line For overall tax advice that’s accessible and relevant to small businesses, our CEOs favored the IRS site, Dtonline .com, and Bankrate.com. The reviewers singled out Bankrate.com for its supe- rior ease of navigation, and they appreciated TaxProphet.com’s extensive tax- research database. They lauded Smbiz.com for links to other tax-related sites. The panelists scorned TaxMama.com in many respects yet couldn’t help liking it for its sheer fun. Sara Trainor Callard is a freelance writer based in Quincy, Mass. The savvy entrepreneur’s guide to online tax advice Comments Would CEOs go back? What are the site’s pluses? CEOs’ quick take www.bankrate.com Yes. “The news section, which seems to be updated often.” “This is a worthwhile site to visit.” www.dtonline.com Maybe. “Clear and concise language.” “Very informative.” www.irs.ustreas.gov/ bus_info/sm_bus Maybe. “Quick and easy to explore.” “Would recommend for tax issues relating to start-ups and small businesses.” www.smbiz.com Probably not. “The links.” “Could use a redesign.” www.taxcast.com No. “A comprehensive listing of links.” “It was loaded with information but was a little overwhelming for the tax novice.” www.taxmama.com No. “Good basic information that’s well categorized.” The site can give you the basics for “general tax queries.” www.taxprophet.com Maybe. “Searches of a large tax-law database.” For extensive tax research without a CPA’s services, this is a “good reference.” Grades Ease of navigation Variety User- friendliness Technical reliability Average grade www.bankrate.com A- A- B B B+ www.dtonline.com B B B- A B www.irs.ustreas.gov/ bus_info/sm_bus A- B B A- B+ www.smbiz.com B- B C- A- B- www.taxcast.com B- C B B B- www.taxmama.com C C B C C www.taxprophet.com B- C B- A B- Our panelists John Auger, cofounder, Operations Associates Gary Barras, CEO, Integral Systems Henry L. Foster, CEO, Call Henry Dr. Jim Goodnight, CEO, SAS Kevin J. Goslin, CEO and cofounder, Construction Technology Group Tim Handley, CEO, Advantage Credit International Duncan Harrison, CEO, Alaskan Automotive Distributing Dean Hunt, president, Certified Associates James Matuszewski, CEO, FeelGood for Life George G. Mueller, CEO, Color Kinetics Victor Tsao, CEO, Linksys Ross Youngs, CEO, Univenture Please e-mail your comments to editors@inc.com.

About 4829 days ago E-Commerce

Meet Jennifer Lawton

Jennifer Lawton is a respected company builder, technologist, and advocate for mentoring entrepreneurs. In 1991, Lawton cofounded Net Daemons Associates (NDA), an information technology consulting firm. With Lawton as CEO, NDA’s growth was fast enough to earn it a place on the 1998 Inc. 500 list of the fastest growing privately held U.S. companies. NDA also was named to the Deloitte and Touche Fast 50 and Fast 500 lists for 1997 and 1998.In 1999, Net Daemons was acquired by Interliant Inc. (formerly Sage Networks), an application service provider. Lawton serves as senior vice president of consulting and technology atInterliant. In addition to her own entrepreneurial endeavors, Lawton is devoted to helping other entrepreneurs realize their potential. She serves on the international board of the Young Entrepreneurs’ Organization (YEO) and is also YEO’s vice president of technology. Lawton also serves on the advisory board for several fast-growth companies, as well as the Kauffman Center for Entrepreneurial Leadership, a nonprofit organization dedicated to creating social change through entrepreneurial activity. Lawton contributes a monthly column for the Kauffman-backed e-zine for entrepreneurs, Entreworld. She also is active in a variety of community programs, including the MIT Summer Technology Institute, Boston Mayor Thomas Menino’s Blue Ribbon Commission Steering Committee on Technology, and the Massachusetts Department of Education’s Youth Tech Entrepreneur program. Before founding a successful company, Lawton’s technology background included managing the construction of a bicoastal computer network and writing code for an airborne radar system. She holds a B.S. degree in applied mathematics from Union College. Selected articles about Jennifer Lawton: ” Security: Case Study — On-Line Crime (Part 1)“ ” Case Study: On-Line Crime (Part II)“ ” How Can I Get Employees to Buy Into Our Strategy?“