| Student
Shelter In Computers |

Internet Security
How to protect your company's data
As with any sophisticated machine, data safeguards for MFPs are
available to IT administrators and users. Manufacturers, dealers and
retailers are all capable of providing support to implement a successful
security strategy. Just as you would install a virus scan on your laptop
or PC, there are tools that can be used to help protect data on MFPs.
Features available to help protect data include:
Encryption: All data that interacts with the MFP, as well as data stored within the device, is secured with state-of-the-art encryption.
Network Authentication and Authorization: Access to scan, e-mail and fax features can be restricted by verifying network user names and passwords in network directories prior to use of these functions. Access permissions can be controlled on a per-user and per-service basis, all managed centrally at the network domain controller. Additionally, all activity is monitored and recorded in a security audit log.Fax/Network Separation: MFPs should include a firewall to prevent unauthorized access to your system through the network connection. However, unprotected fax connections in MFPs can be an open back door into the network, so purchase a machine that provides complete separation of the telephone line and network fax connection.
Secure Print: Jobs are safely stored at the MFP until the owner enters a personal number to release them. This controls unauthorized viewing of documents sent to the printer.Hard Drive Removal: Some manufacturers offer options for removal of the hard drive before the MFP is disposed of or turned in after a lease. While the owner of the MFP is ultimately responsible for their data, choosing a vendor that will help understand the risks associated with data when returning machines, and will provide recommendations on the most effective way to rid the hard drive of information, is something to keep in mind during the purchasing process.
In addition to the above tools, it's also important to keep in mind the
value of updating the software that runs on MFPs. With new threats
developing on a daily basis, there will always be a need to update the
software that runs your copiers, or any networked peripheral including
printers, fax machines and scanners. Responsible MFP manufacturers make
new patches available for their customers to easily download, through a
website or even RSS feed, so machines can easily be updated with the
latest protection.
MFPs are intricate machines that use a hard drive for many functions,
making them valuable tools to streamline business processes and share
information. By taking advantage of the available options, users can
benefit from these sophisticated machines, while ensuring their
company's and customers' information is secure.
A distributed denial of service (DDoS) attack is carried out in two
stages. First, a virus must be spread to multiple computers using the
standard methods for doing so. Once that is complete, a central control
computer issues a command for all the infected computers to begin the
attack. At this point, all the computers begin simultaneously requesting
data from the target in large amounts. This blocks other systems from
being able to communicate with the targeted server, effectively taking
it offline. This is not the first time the Wikileaks has been the victim
of such an attack, although they did seem to be more vulnerable this
time around.
Wikileaks hoped to find some relief in the cloud by utilizing the Amazon
Elastic Cloud Computing (EC2) service. This proved to be a short-lived
venture. As of December 1st, Amazon decided to revoke Wikileaks' ability
to use EC2. This came after much political pressure was put on Amazon by
Congressmen like Senator Joe Leiberman, who released a written statement
saying that "[Amazon's] decision to cut off WikiLeaks now is the right
decision and should set the standard for other companies WikiLeaks is
using to distribute its illegally seized materials." This move has been
met with outcry from Wikileaks supporters who have taken up the cry of
government censorship and quoting the First Amendment in blogs and new
story comments across the internet.
Now that Wikileaks has been removed from the cloud, where they sought
refuge from the DDoS attacks that they have fallen prey to, it remains
to be seen whether there will be more such attacks.
Sophos, an internet security company that advertises a variety of email
and encryption services, has released an
article concerning the new Facebook Messages system which focuses on
the new security issues that need to be considered for people who opt to
use it. In it, senior technology consultant Graham Cluley discusses that
the burden of security lies more with the user than with Facebook
itself. He says, "Before signing up, users need to realize that these
new features increase the attack surface on the Facebook platform, and
make personal accounts all the more alluring for cybercriminals to break
into. Facebook accounts will now be linked with many more people in the
users' social circles - opening up new opportunities for identity
fraudsters to launch attacks." Basically, spammers now have more of an
incentive to hack into Facebook accounts using phishing attacks and
exploiting weak passwords.
The other security issue that Cluley discussed was the fact that "users
also need to be aware that Facebook will be storing a complete archive
of all of their communications with one person - this raises concerns as
to how this data could be misused if it fell into the wrong hands."
Imagine every conversation you've ever had with anyone being recorded
and stored on servers you have no control over. All that vital
information in the wrong hands could most certainly spell trouble for
anyone unfortunate enough to fall victim to such a situation. For more
security-based information about the new Facebook Messages system, check
out the Sophos
FAQ about it.
Microsoft Office is the collection of several productivity software
products: Word, Excel, Outlook, PowerPoint, and OneNote. The
vulnerabilities recently patched spanned two security bulletins,
MS10-087 and
MS10-088. MS10-087 patches five bugs, all of which can allow remote
code execution. They affect all versions of Office, including Office for
Mac. There are three vulnerabilities having to do with the mishandling
of maliciously crafted office files, meaning that a person would need to
open that file on their system, but once they did they would have
complete control over that system. The other two vulnerabilities deal
with the loading of "Rich Text Format" files and DLL files, and are just
as dangerous as the others. MS10-088 is specific to PowerPoint and only
contains two bugs, although they both can allow remote code execution as
well. These are both dealing with maliciously crafted PowerPoint files,
one being a buffer overflow and the other an integer underflow.
Microsoft Forefront is a security software suite for Windows Networks.
You read that correctly, Microsoft sent out a security patch to fix
their security software (something that should probably have been secure
to begin with). UAG is a service that provides security to people
remotely accessing those networks.
MS10-089 details several cross-site scripting (XSS) vulnerabilities
plaguing this software. Basically, a hacker can gain elevated privileges
on your machine if you go to a certain URL. This seems like it would
fall into the 'critical' category of bugs, while Microsoft placed it in
the 'important' group. It may seem that this was an underwhelming Patch
Tuesday in volume of patches, but looking at the serious nature of the
vulnerabilities, I would have to say I'm glad they have been fixed.
Coverity Inc. is in the business of scanning software for potential
security vulnerabilities. They recently scanned the open-source Android
operating system and discovered 359 bugs. 88 of these are listed as
high-risk which according to
the report, "include four categories that we have found, through
experience and consultation with our customers, to be ones that can
cause the most damage and are most likely to be fixed first by
developers. These include memory corruptions, illegal memory accesses
(e.g., reading beyond the bounds of a memory buffer), resource leaks,
and uninitialized variables. "
Let's look at how those bugs compare in the open source world. Coverity
claims that the industry average 'defect density' is one defect per
every 1,000 lines of code. Android has only half that number, which is
impressive until you look at the areas those bugs were found. Most of
the code in the operating system is a Linux kernel with custom additions
added in, and in the Android specific code, the defect density is twice
as high.
Fragmentation of accountability is listed as one of the main conclusions
of the report. Coverity basically says that, just like the rest of open
source software, with so many people contributing so many different
elements to the project, it is almost impossible to keep track of who is
in charge of fixing what. This is definitely a problem as open source
becomes more and more popular.


Designed &
Developed by Webmaster Abbas Shahid Baqir
Webmaster Feedback: [email protected]
All Rights
Reserved Copyright, 2010-2020 Student Shelter In Computers
®