Evolution of the Business Website

Long ago, when the commercial internet was in its infancy, business websites were basically electronic versions of the business card. There was a time when a business would purchase a domain, set up a server and throw up some HTML pages and pronounce the website done. For a little extra panache, perhaps a menu of purchasable goods would be listed along with instructions on how to send an order to the company. This might be a simple phone number, an email link, or for the truly advanced an online form to fill out. Of course, that form would get sent to the inbox of some junior level associate who would dutifully print it out and drop it into the actual physical inbox of the order processing department. While many small businesses start off believing that this sort of simple business card style approach is sufficient, if they expect web traffic to appear out of nowhere they soon learn there is a lot more to building a successful business website than a few static HTML pages.

It might help to consider things in terms of older analogs. Let’s consider business cards and catalogs to start with. A business card was intended to give a customer or potential customers an easily fileable and quickly accessible means of storing your contact information. A catalog would allow customers (and potential customers… from now on just assume I include that group) to look at a polished representation of what the company is about and what services or goods it provides. Typically business cards would be left in locations where customers frequented or might be given directly when a salesperson would call on them. Catalogs might be mailed out in bulk if a marketing campaign were in full effect or would be made available to those who knew to ask for one, typically as a result of running across a business card or getting in touch with someone who referred them to the company. So how does any of this translate into the electronic presence?

Building Your Business Website: Have Something To Say

The first aspect to consider when creating your website is actually the catalog aspect, not the business card aspect. Consider for a moment who is likely to actually visit your website. For new or potential customers, they have been sent to you by someone they already know or found you through an online ad or search engine. Obviously you prefer direct referrals from a colleague or friend, but that’s another nut to crack. Regardless, they are trying to get to know you. Absolutely, you want to have a page or area of your website which details how to get in touch with you. But besides that, you have to have something interesting on your website. You must have something to say. Now, the very minimum you should provide is an indication of what goods or services you offer. If your website doesn’t tell a customer what you can do for them right off, then why would they spend any more time on your site. They looked you up to do business, now tell them why they should be doing business with you.

There’s more to it than that though. Remember, think “catalog”. Give them an idea of specifics. If it makes sense to do so, give them an idea of pricing. And remember too that while catalogs would stay in print for awhile, you still updated them, perhaps annually, and usually with information about what has changed since the last printing. With your website you have far more flexibility with regard to how frequently you update information. Include recent activities, indications of growth or expansion or new product lines. Your business website is the one place where you can advertise for free, so feel free to do so. Sell yourself, but don’t sell yourself short! Make sure someone coming to your website knows all of the interesting bits about you.

Here’s another little tidbit. Stay fresh. That means you need to update your website and if possible add new content, with some frequency. Why? Search engines. Organic search engine optimization is key to long term successful online web presence building. And one key to organic SEO is fresh content. Search engines are increasingly designed to be a sort of champion for online searchers. As a result, they increase the value of sites that keep their content fresh and relevant. If you are selling computer support and your pages reference computer support and you are consistently creating new pages and content concerning computer support, the search engines will look more favorably on your website than on a similar website that creates a single page referencing computer support and never updates it. But remember, ultimately you are not trying to fool the search engines. You want actual living people to come to your website and do business with you. For that, your content needs to be real and relevant, not just drivel to try to trick search engines into driving eyes to you. That approach will only cause you problems down the road.

Advertising Your Business Website: Getting the Message Out

Okay, so you have some idea of how the “catalog” analogy translates to your website. How about the business card aspect? How do you get the word out? Remember how I mentioned that business cards were something you made available in places customers frequent? And how your sales personnel would hand them out when they went out on call? Or how you might mail your catalogs out during ad campaigns? Those all have analogs in the electronic world, too.

Start by putting yourself in the mind of your potential customers. Where do they go online? Don’t just think the obvious (i.e. they go to Google to search for ‘computer support’), consider the non-obvious. Are your primary customers males, ages 18-24? Females, ages 29-38? What social sites do customers in your target demographic use? Can you advertise there? Better yet, can you join as a company? The more you know about who you are trying to attract, the better the chances of you being able to get your website in front of them.

A quick note about joining a social site (or any site) as your company for purposes of promotion. Generally speaking, there is really just one rule to follow: be a member of the community, not a user. It’s a simple rule though not always easily followed. It means that if you are going to join a community, have something to offer them. Some firms use witty and/or funny status updates to entertain. Some offer specials and deals to anyone acting on a posted link. Sometimes they provide insight into their industry, updates regarding who is doing what. The point is, they offer something. This is something even regular individual users quickly learn, because if they don’t they find themselves more or less shunned, at least until they start behaving as the community expects. This is more important for a company because in such cases the rest of the community knows the company is there to advertise and draw customers. You have to give them something to bring them in.

Okay, now you’ve considered the non-obvious. Now consider the obvious. Search engines. Think for a moment about how customers would expect to find you on a search engine. Do those search terms show up anywhere on your website? If so, good job! If not, get back to work. What about advertising? You can using something like Google AdWords to advertise on Google and their related networks. You set up search terms, specify a price, give them a URL and some text and unleash your advertising might! Depending on how much you spend and the search terms you use, you can expect thousands (or more!) of impressions but only a percentage of click throughs and even fewer conversions (i.e. someone emailing you, buying from you, calling you, etc). That’s just the nature of things.

But Wait, There’s More

There is indeed more to the story besides what I’ve mentioned here. I’ve only scratched the surface of what you need to do. Some things make sense for one company but not for another. Others are more or less universal. If you are interested in discussing business website SEO in more detail, please let us know. Those who come from more old school notions of advertising and generating customer leads might be somewhat discouraged in how things have changed with the transition to the internet, but the fact is the principles are really the same. It’s only the execution that has changed. You still have to generate those leads and you still have to capitalize on them once you have an audience. It’s not the ‘what’ that has changed, but the ‘how’. If you would like some help in that regard, give us a call.

October 10, 2011 – 7:01 am Categories: Uncategorized | Post a comment

Tagged , , , , |

How Windows Gets Infected With Malware

Anti-Malware symbol with malware image alongside itCSIS Security Group A/S released a report showing how Windows machines become infected with malware. It’s one of the questions we most frequently get asked when cleaning up a malware infection on a client machine. “How did this happen?” It’s a reasonable question. We make sure our clients have up to date anti-malware applications, inform them of safe computing habits, and yet they still sometimes end up with infections. The point of the CSIS research was to:

reveal precisely how Microsoft Windows machines are infected with the virus/malware and which browsers, versions of Windows and third party software that are at risk.

So the report details which browsers are infected and how often, which versions of Windows are infected and how often, as well as third party software (typically plugins but also some standalone applications) which are infected and how often. From a computer support perspective, this is invaluable because it allows those of us in IT to help clients make technology decisions in a more informed manner.

Chrome: Taking the Shine Off of Malware

The first graphic we run across shows the breakdown of browser infection rates. The immediate piece of information that grabs us is that Internet Explorer accounts for 66% of malware exploits on the tested systems in this report. That may seem alarming for IE users, but there is a very important point to consider here; Internet Explorer has several versions in use right now, most of them quite old and rife with exploitable security holes. IE6 is the worst offender here and likely the oldest version of IE you’re going to see, but it’s not as widespread as it used to be. IE7 is, sadly, still widely deployed mostly due to inertia from users who simply haven’t upgraded. IE8 marks a significant improvement in security and stability over its predecessors and represents the final version of IE that will be made available on Windows XP. IE9 is the most recent version of IE available and isn’t as widely deployed as its kin but is the most secure of the bunch. I wish the report had broken this out by version but given the improvements in IE9, I believe it can stand shoulder to shoulder with the other browsers that had fewer malware attacks in the report.

In any event, Firefox was the next most represented on the list at 21% followed by Chrome, Opera and Safari, each with less than 10%. Opera and Safari have far lower usage numbers than the other browsers and so can be expected to have fewer exploits directed at them. Chrome is approaching equivalent browser usage with Firefox but has a far lower number of exploits. And unlike the common refrain directed at Mac users, that their platform isn’t targeted because it’s not as popular, Chrome is cross platform and widely deployed. This puts a big feather in Chrome’s cap.

Windows 7: Wherefore Art Thou?

The next graphic shows the number of exploits by operating system. Since the whole report is focused on Windows exploits, we’re going to see things broken up exactly as we want, by version. The most noticeable thing we see is that Windows XP is at the heart of 41% of malware exploits. We’ve already discussed the fact that you really should not be running Windows XP. The fact that Windows XP is at the midst of the maelstrom of malware maleficence is not a surprise but is informative. The bigger surprise in my mind is the fact that Windows Vista accounted for 38% of malware vulnerabilities. Now bear in mind this is only indicative of the fact that this is the OS that was installed at the time of infection, not necessarily that the OS was the vulnerable point. Still, given Vista never had much of an uptake compared to XP, being panned as failure and quickly supplanted by Windows 7, to see Vista so high on the chart suggests it’s not a good alternative. We do find Windows 7 at 16% and given it’s finally overtaken Windows XP deployments, I think it’s fair to say Windows 7 represents a significant increase in security compared to its older siblings. The other operating systems listed (Windows 98, Windows 2000 and Windows 2003) aren’t worth mentioning because they are either very old and whatever was said about XP applies doubly or triply to them or they are a server OS (in the case of 2003) and have a different set of needs.

The takeaway here should be that if you are not on Windows 7 then… why not? It’s clearly the most secure desktop OS Microsoft has available right now and is going to be the best jumping off point for future support, updates and upgrades to Windows 8 when it becomes available. Do not walk, run. Go. It will be a big improvement and your IT support staff will thank you for it.

Did I Do That? Actual Malware Infection Points

In some respects the previous two sections represent incidental information. The infected machine happened to be using a certain browser or a certain OS. There are, of course, some things that those browsers and OS versions do to forestall malware attacks, but by and large the information above doesn’t necessarily correlate directly to actual vulnerabilities. For example, the sandboxing model used by current browsers means that many malware attack vectors simply won’t work, but if the user chooses to download malware through that browser and then run it, in spite of any warnings that might pop up, there’s nothing the browser can do to prevent that. So what’s actually going on?

To my own surprise, Java was the biggest reported application listed as offering a malware attack point. Why would you have it? Simple; many websites, including internal corporate apps, are written using Java applets, small applications that run inside the Java virtual machine in your browser. Because they are deployed through your browser, they can be installed centrally at a server and be updated in one location, allowing updates to flow automatically each time you run the applet. But they require the Java virtual machine software to be installed on any machine which will run the applet and that software can have vulnerabilities which need patching. You might have a small orange icon down in your system tray right now, waiting for you to click on it to apply Java updates. Have you been ignoring that? Remember, keeping your software updated is vitally important.

The next most common vulnerability was through Adobe’s Acrobat Reader and Acrobat software. This is the software that allows you to view (or in the case of the full version of Acrobat, create) PDF files. You know you can’t edit a PDF so how on earth can there possibly be a vulnerability there? It turns out a PDF file can contain scripts that, when you click on various portions of the PDF document, do different things. The scripting functionality in Adobe products is quite powerful and capable of manipulating your file system and interoperating with your OS and other applications. However, there are recent updates which have created a similar sandboxing model as I mentioned with the browsers above. This greatly limits how much interactivity such scripts can have with your machine, thus greatly reducing your exposure to security vulnerabilities through this software. Again, it becomes a matter of staying up to date with your software.

The third most common point of vulnerability was through Adobe’s Flash player. This is used to watch videos on sites such as Youtube, presentations by some artists, interactive content on websites and online games. It can provide a rich user experience but seems to be being phased out over time. Still it is widely deployed and while you can go without it, most users are likely to want it. The exploits in this case weren’t listed as being caused by known Flash vulnerabilities that have patches available, but Adobe does keep Flash regularly updated to patch up security holes as they are discovered and Flash runs in a sandbox as well as being sandboxed when run within modern browsers, so that should help limit vulnerabilities through this. But once again, it requires fully updated software to stay on top of this issue.

I was going to mention that the remaining vulnerabilities are individually less than 10% each of the exploits tracked, but I want to draw attention to one point. Internet Explorer happens to be the next vulnerable application listed at exactly 10%. Once again I wish the researchers had listed individual versions of IE, as I imagine that would show that IE9 and even IE8 have a better security record than this chart would imply. Still, the fact is that there are no other browsers which are listed as being the direct source of a vulnerability. Still, the specific IE related vulnerabilities listed in this section are as follows:

CVE-2006-0003 IE MDAC
CVE-2006-4704 Microsoft Visual Studio 2005 WMI Object Broker Remote Code Execution Vulnerability
CVE-2004-0549 ShowModalDialog method and modifying the location to execute code

Note that the IDs are in the format of CVE-YYYY-####, where YYYY is the year the exploit was discovered. Those dates are 2006 and 2004, rather old, suggesting older versions of the browser or subcomponents were at play. It’s not conclusive but seems indicative of problems with just older versions of IE, not with the newer versions.

The Conclusion

In the end, what we see here is really a confirmation of what computer support professionals and IT staffers everywhere have been saying all along. Stay current on your software, keep up with updates, don’t let your computer become full of antiquated software riddled with vulnerabilities that have been fixed in more recent versions of the software. While it may seem to be the least expensive option to try to stick with older copies of software, in the end you are not only going to be forced to upgrade eventually as a matter of practicality, you’re going to be spending more in support costs than you saved by not upgrading in the first place as well as incurring additional downtime. Do yourself a favor and keep updated.

October 5, 2011 – 12:56 pm Categories: Uncategorized | Comments (2)

Tagged , , , , , |

Why You Should Ditch Windows XP

According to StatCounter (http://gs.statcounter.com/#os-ww-monthly-201009-201110), Windows 7 finally surpassed Windows XP as of the start of this month. Considering Windows XP is going on 10 years old and is no longer in mainstream support by Microsoft, it may seem surprising that it is as widely used today as it is. There are several reasons why Windows XP is so deeply entrenched but more importantly there are a number of reasons why you should consider ditching Windows XP and upgrading to Windows 7. These reasons break down to compatilibity, security and ongoing support.

The world of software is fast moving and rapidly evolving, a moving target which it can sometimes be difficult to keep up with. It is also highly competitive. Software vendors in competitive markets are constantly trying to find the next thing they can add to their software that will convince consumers to upgrade or switch from a competing platform. Many times this involves a facelift to improve the look of an application or perhaps some new services offered through the company directly. Other times this involves additional integration with the operating system. Windows XP is, in software terms, archaic. It has been explored at depth and there is really nothing new to be found there. Software focusing on capabilities built into XP are offering nothing new to the user. As a result, companies are turning to features offered in Windows 7 in order to present a fresh look. Slowly they are cutting support to their applications available on XP, offering only support to versions which are targeted at Windows 7. As this continues it will become increasingly difficult to retain warranties and maintenance agreements with these companies which in turn will make it difficult to receive support or reduced cost upgrades as you fall further behind the version schedule. By staying up to date with your OS, you’ll be able to stay up to date with your third party software and take full advantage of new features and bug fixes that are available only in the latest versions.

Then there is security. One of the big factors involved in the development of Windows Vista, the direct descendant of Windows XP, was the large number of security issues which had cropped up throughout Windows XP’s deployment. Windows 7 has refined these security enhancements, with better controls on accessing the filesystem, increased security in the browser and better native defenses against malware. While Windows XP might receive security updates, these updates are after the fact patches of existing holes in Windows XP, not introduction of wholesale rewrites of the OS to tighten security. As a result, there will be no further refinement of security on the XP platform. Windows 7 offers the opportunity to increase your security through upgrading your OS.

Speaking of updates, Windows XP isn’t receiving many. That’s because it has left mainstream support and entered extended support. This means that there are no more design changes, no more bug fixes, no more free tech support, and no more warranty claims. As mentioned before, security updates are provided but they can’t fix systemic flaws, only patch holes with minor editing. And while it’s three years, out, by 2014 XP won’t even receive that. That’s 13 years of support, the longest I’m aware of for any one version of an OS, but it will run out. It would be better to already have transitioned to a newer OS before then, rather than waiting until you have absolutely no other options.

Some of our clients have avoided upgrading to Windows XP in spite of our strongest suggestions. They have older hardware that doesn’t meet the minimum system requirements for Windows 7 or in some cases simply don’t want to learn the new system. The fact is that over time, more money will be sunk into supporting the old hardware to keep XP running than it would take to simply purchase a new system running the latest OS, along with an increase in performance. Additionally, at some point the hardware will fail and they will be faced with not only having to purchase new hardware but simultaneously learning the new OS as well as perhaps even new applications.

In the end, sticking with Windows XP is simply going to become impossible or at least untenable for your business. The longer you wait to upgrade, the harder it will be when the time does come. It might hurt a little now, but better a little pain now rather than a lot later on.

October 3, 2011 – 1:56 pm Categories: Uncategorized | Comments Off

Tagged , , , |

The Importance of Updates

Have you ever come into work one morning expecting to get started on that project you left open the day before, only to find your machine has rebooted because automatic updates force a restart? That can be pretty aggravating. Thankfully there are methods of keeping those updates from automatically installing themselves and forcing a restart, but often we find our clients that choose this route end up ignoring their updates altogether. I’d like to talk about why for computer support purposes it’s actually important to stay on top of your updates and what steps you can take to make that job a little more reasonable. We’ll uncover the three rules of updating along the way.

First, understand the difference between when a software company releases an update versus a new version. An update is typically released in order to fix a bug or introduce a previously promised feature for the current version of the application. Typically these updates are free or are included in the license for use. A new version typically represents an overhaul of the application and introduces a large number of new features. Compatibility is not always guaranteed between files created with one version and the new version of the application. In most cases a new version of a software application will cost additional money. Your IT support staff isn’t likely to recommend an immediate upgrade to a new version of an application just because it is available. However, in order to properly support your computer they will likely recommend you allow most if not all updates.

Because an update is intended to fix bugs and should generally not break compatibility, it is almost always advised to allow updates to occur when they are available. While it is always possible that an update will break functionality, the norm in the industry is that this will not happen. More importantly, when you stay properly updated, you’re a lot less likely to have to deal with nasty crashes or security holes. Some other user out there stumbled across these problems and reported them to the developer; you might as well benefit from their suffering, right?! Aside from fixing bugs (which may or may not have been plaguing you), many developers won’t provide support if you do have a problem unless you are running the most recent version of the software. So updating not only helps avoid bugs in the first place, it also ensures that if you do run into a bug, the developer is more likely to assist you. What’s to lose?

“Fine,” you say, “I’m convinced. I’ll keep things updated. But I don’t want it to reboot my machine!” Well, we can do something about that. If you’re running Windows 7, click the ‘Start’ button and in the search box that appears type ‘automatic updates’. Eventually the search will return an entry that reads ‘Turn automatic updating on or off’. Click that and you’ll see several options. By default, it will look something like this:

Windows 7 control panel applet for automatic updates

Where the dropdown box reads ‘Install updates automatically (recommended)’, click and choose ‘Download updates but let me choose whether to install them’. Then click ‘OK’. This will continue to allow updates for Windows to be downloaded in the background just like they would have previously, but now instead of automatically applying them and possibly rebooting your machine at 3AM, you will get a prompt down in the bottom right of your screen, near your clock, when updates are available. You will also get prompted any time you log off, asking if you want to update, assuming updates are available. As a result, you will be in control of the update schedule of your Windows 7 install. Be forewarned, though. Windows OS updates include critical security patches which if left unapplied will leave your computer vulnerable to attack from hackers and malware. This brings us to the first rule of updating: Always Stay Up To Date.

Hold on though, you didn’t think that was it did you? Windows itself is only one of the software components on your computer. There are others that you might have, like Adobe Reader and Adobe Flash, Microsoft Office, various anti-malware suites. Theoretically, every application on your computer that you installed aside from the operating system might have some sort of update agent. These update agents work like the automatic updates for Windows, sitting in the background checking periodically to see if a new update is available. It’s impossible for us to go into any detail here concerning how to monitor such agents, as there are many and they differ wildly in their execution. Some will take any opportunity to grab an update and alert you that it is ready. Others run only on a schedule. For those that run on a schedule, it is important that you keep your machine on during that scheduled time or alter the schedule for a period of time when you are running your PC, otherwise the update check will never occur. That’s a great way to fall way out of date on your updates. That’s especially bad for anti-malware applications because the vast majority of these updates are to update the definitions which are the fingerprints by which these applications detect malware on your computer. Without recent fingerprints, they won’t be able to detect the trending malware out there, leaving you vulnerable to attack. This brings up the second rule of updating: Always Let Updaters Run.

Unfortunately, even these third party updaters can cause a reboot. Why? Well, if they involve drivers or plugins, it could be that the parts they update are tied into the internals of the OS at a level deep enough to require a reboot. Or, frankly, it could be that the developers were simply very, very paranoid when they wrote their updater and didn’t like not rebooting after an update. It’s silly sometimes, requiring a reboot for something that clearly doesn’t need it, but it happens. That’s why we have the third rule of updates: Make Sure You Have Time For Your Update. One thing that frustrates me to no end is when I’m on a laptop that I have to pick up and take with me and I go to shut it off and… the Windows updater kicks off and says not to shut down the machine until it is done updating. If I shut it down with the intent of going somewher it’s because I need to go now. I don’t want to wait until the update is done. Unfortunately, once it starts, you really don’t want to cut it off. That way leads madness.

Keeping your computer updated isn’t difficult and it’s been made less so over the years. Many people aren’t comfortable updating the software on their computers for fear they will mess it up somehow. It’s been made less error prone over time to the point that these days much of it is automated. Nevertheless, it’s important to do your part. Letting updates run, even if you are controlling when they run, is no different from taking your car to get the oil changed. It’s just maintenance that has to be done every so often. Of course, it never hurts to have someone help with IT support. :)

September 28, 2011 – 10:34 pm Categories: Uncategorized | Comments Off

Tagged , , , , , |

Planning for the Future (Need vs Want vs Growth)

Two hands holding a seedling in dirt One of the many IT services we provide involves helping our clients with planning and purchasing decisions. When making such decisions, there needs to be a balance between what is needed, what is wanted, and what the future growth may require. Ultimately, the decision rests with you, the customer but it’s our job to give you the information you need in order to make the right decision for your business. Many times, our customers will go with what we suggest. In some cases, in spite of what we suggest would be optimal, our customer chooses a different path. In those cases, our job becomes to make the decision work as well as possible even if it wasn’t the choice we had suggested. This is fine; at the end of the day, it is your business and your decisions which will make or break it. We’re here to help. That said, let’s take a look at these factors that need balancing.

Planning for What You Need

Imagine that you are looking at a range of options for a given purchase and all of these options are spread out in a line. Somewhere on that line is an “optimal” decision, the most perfectly right choice you could make. In most cases, what you “need” is a little to the left of that line somewhere. For our purposes, what is needed is defined as what will satisfy the minimum necessary requirements to get the job done. Suppose you are looking to share files between multiple PCs on your SOHO network. What is needed is perhaps to enable file sharing between the PCs. This functionality is built right into your PCs in most cases and will allow you to send files back and forth with minimal fuss. It’s not ideal, being a little brittle, but it would get the job done. In many cases, you’ll want to move a little further right of the bare minimum to meet “need”.

This is usually the first set of choices you will consider for a given project. It establishes that anything even further to the left is inadequate and will not serve your purposes. It gives you a baseline for comparison, usually on price but also on features. Again, I’m talking generically here. We could be discussing file sharing, software, backups, workstation or server configurations, or any of a number of other computer support and IT related items. Each has costs and features (benefits) associated with them and when we start with establishing our “needs” we make sure we are eliminating the dregs that simply won’t fit the bill.

Pondering What You Want

Okay, now you know what you need but you have already started considering what you want. “Want” in this case is the polar opposite of need. It establishes how far you’re willing to go. Where “need” bent closer to accommodating for cost at the sake of features, “want” gives up lower costs in order to get some of those features back. Perhaps some of the nicer file sharing options provide for nifty alerts to let folks know when quotas are used up or when new files are placed in their folders. Do you want that feature? How much are you willing to pay for it? This is where you start establishing a cap on how far to the right of the mark you are willing to go.

This is usually something our clients tend to mull over once we’ve helped them become aware of the options available, usually because for the most part they come to us with a computer support problem and expect a simple solution to that problem, yet the solutions provided tend to also have additional capabilities. Thus these wish lists get born. “Oh, I didn’t know we could do that, too” is a very common refrain and helps our clients start considering additional things they may like a solution to resolve for them, often problems they didn’t even realize they had. Even planning under tight budget constraints it can be good to spend some time looking at “want” because it helps you when planning for the next balancing point.

Planning For Growth

I’ve heard it said that for a company to grow, those in charge have to have a plan for growth, and IT services are no exception. When one of customers asks us to consider new services or equipment, we also ask them to consider how they plan for this to be used in the future. Going back to our file sharing example, perhaps you expect to have more physical locations in the future. Do you expect to have projects synchronized among the sites in order to have faster local access to all projects? Or do you want them pulled across sites only as needed? One requires more local storage than the other as well as access to synchronization software. It’s a somewhat contrived example, but you get the idea. Where are you taking your company? Will this solution scale? More importantly, if I purchase this equipment now will I still be able to use it down the road or have to buy something else? Maybe the money involved won’t matter then. These are all questions we can help our customers be aware of but we can’t answer for them.

Whomever you choose to provide your computer and IT support services, don’t be afraid to let them be your Technical Advocates. They should not be afraid to provide the information you need in order to help you make the most informed choice. Be wary if they push a specific product and simply won’t budge, or if they are unwilling to support your choices if they contradict their suggestions. Worse, if they refuse to get involved with the information gathering and are simply there to make the purchase and install the kit, then you need to find someone who will go the extra mile for you. If you find yourself in that situation, give us a call.

September 24, 2011 – 10:42 pm Categories: Uncategorized | Comments Off

Tagged , , , , , , |

Malware on the Mac (Redux)

Anti-Malware symbol with malware image alongside itMea culpa. At least a little bit. Give me a moment while I wipe the egg from face. According to a recent CNET article, there’s a new trojan for OS X, out in the wild and effective albeit not particularly active at the moment. You may recall that I recently (just a few days ago in fact) posted an article about malware on the Mac in which I essentially claimed you need not do anything, and that existing third party anti-malware software packages are really not doing much other than catching the random stray Windows infection when it hits your inbox. Well it appears I was a bit mistaken.

If you don’t want to read the CNET article, the nuts and bolts of the malware are that it comes in two parts. One is the downloader and one is the payload. The downloader does two things. It downloads the payload and installs it and also pops up PDF files written in Chinese with offensive political statements. The payload is a program which sets up a launch agent (i.e. another script or program that gets run each time you start your computer) which in turn does two things. One, it makes sure to keep itself in place and two, it grabs info like your username, MAC address (not to be confused with your Mac’s address), and possibly various documents and screenshots which it sends to a command and control server. It could conceivably run commands from that server but hasn’t done so yet.

This sounds scary, and if it ends up on your system, it would be. Sophos reportedly have updated their definitions to detect and remove it. So there’s that, too. However, and this is why this is “sort of” a mea culpa, the downloader does require user intervention to install. In essence, if you are not in the habit of installing untrusted software on your Mac, you are unlikely to become infected. Still, there are limits to how careful you can be. If a trusted site is hacked and you grab an infected installer as a result, that’s not your fault and it’s unlikely you could do anything to avoid that.

Malware Mea Culpa

I won’t remove the original article, though I will post a link on it to this one. I’ll alter my position and state that it’s actually a good idea to go ahead and protect yourself, even on your Mac. While there are still safety advantages to computing on the Mac, a few extra precautions won’t hurt. To that end, I would recommend installing an anti-malware package on your Mac, such as Sophos’ Anti-Virus for Mac Home Edition. Using the builtin firewall on your Mac is also a good idea though for additional protection you can download and install Little Snitch, which detects and blocks both inbound as well as outbound network requests. This can keep malware from potentially dialing home with your data even before you or your anti-malware software knows you are infected. In fact, this can be a good tripwire to know whether you are infected or not.

September 23, 2011 – 11:15 am Categories: Uncategorized | Comments Off

Tagged , , |

Malware on the Mac

From my updated article on the subject of malware on the Mac:

I’ll alter my position and state that it’s actually a good idea to go ahead and protect yourself, even on your Mac. While there are still safety advantages to computing on the Mac, a few extra precautions won’t hurt. To that end, I would recommend installing an anti-malware package on your Mac, such as Sophos’ Anti-Virus for Mac Home Edition. Using the builtin firewall on your Mac is also a good idea though for additional protection you can download and install Little Snitch, which detects and blocks both inbound as well as outbound network requests. This can keep malware from potentially dialing home with your data even before you or your anti-malware software knows you are infected. In fact, this can be a good tripwire to know whether you are infected or not.

 

Anti-Malware symbol with malware image alongside itCongratulations on the purchase of your shiny new Mac and welcome to a wonderful new era in personal computing. Okay, okay, maybe it’s not so shiny new. And you’ve probably been computing for quite awhile, perhaps on a Mac. And really, the nuts and bolts of computing on a Mac aren’t all that different from Windows, though the experience is an improvement in my humble opinion. But there is one thing that is not different, in spite of what you might have heard. Malware exists on the Mac.

Yes, it’s true! I know, you’ve heard it said repeatedly that there is no malware for the Mac, that it is so much more secure than Windows, that you are much safer on the Mac, etc. Well, I’m an avid Apple aficionado and I am more than happy to plug Apple products as I believe they are top quality products. But Apple has never stated they are malware free. So where then does this image of imperviousness stem from? Why does everyone espouse the bullet proof nature of the Mac? Because while it is not completely bullet proof, there do seem to be fewer bullets out there that work against it.

First, recall that all malware is, is a program that does something on your computer that you don’t want it doing. That’s it. Code that does something bad. “Bad” could mean almost anything, from stealing your data, to deleting it, to annoying you with popups, to emailing lewd messages to your grandmother. What the malware does is generally less important than how it gets onto your system in the first place. For both Windows and Mac machines (and really any other machine out there) malware attacks come in two forms, those that require you to participate in installing them and those that install themselves automatically.

The ones that require you to install them generally rely upon social engineering, that is convincing you socially to do something. It might be a really convincing looking browser popup that looks like some sort of security window telling you to download a fix or something. Or it could be a website that seems to be selling a really interesting new game that in fact installs the malware when you install the game. These infections don’t rely on a security vulnerability in the system. Aside from trying to fool you into installing them, there would be no difference between one of these and a program that clearly advertises “Install me and press the button to delete all of your important files”. You install it because you are fooled into thinking it is reasonable to do so, and you let it do something bad to your machine because you think it’s doing something good. Unfortunately there are no convenient methods to prevent this sort of attack and the Mac is just as susceptible to this type of malware as any Windows machine.

That said, Apple products do have one advantage that Microsoft products don’t have (yet) and that is the App Store. App Store purchases are far less likely to contain malicious code as they are vetted by Apple before going on sale and Apple clearly has an interest in making sure they are clean before going up for sale. Microsoft will also have an app store of their own when the next version of Windows ships, which will also help. Of course, you can also get software outside of these app stores, in which case you are taking matters into your own hands. Regardless, this is still only partially helpful. Macs can be infected with this approach just as readily as Windows machines.

The second method of infection, where you don’t give permission and the malware is installed automatically, is somewhat less likely to occur on a Mac. For a variety of reasons, there are generally more difficulties involved with getting a system to execute something without the user’s permission on a Mac than on Windows, though the difference has shrunk considerably with the deployment of Windows 7 and will likely shrink further with Windows 8. Security has become of increasing concern to all OS vendors lately and they are doing more to protect you over time.

In summary, yes there is malware for the Mac, but no it isn’t of much concern because there just isn’t much out there yet and what there is essentially requires you to willingly install it and run it. So what about anti-malware applications? Well, they aren’t as needed and they aren’t as plentiful. I’ve written about a number of anti-malware applications for cleaning up malware after the fact as well as protecting you preemptively but that ecosystem is not as diverse on the Mac, mostly because it hasn’t been necessary. I have tried anti-virus on my Mac. It did, in fact, catch a malware laden email that I received. It was a Windows infection though, sent to me by someone else and having zero chance of actually doing harm to me. Still, I suppose it kept me from forwarding it to someone else and infecting them. I eventually uninstalled it. If you want to give it a try, you can download Sophos Anti-Virus for Mac Home Edition. It will affect some file operations as files are scanned before loading and will consume some bandwidth as definitions are kept up to date and so on. Essentially, it’s one more thing your Mac will constantly be doing. Running without it poses little risk at the present time. If it begins to become a concern, we’ll certainly change our tune, but for now enjoy the lack of malware.

September 17, 2011 – 10:07 pm Categories: Uncategorized | Comments Off

Tagged , , |

BIOS Malware in the Wild

In a blog post by Marco Giuliani it’s been revealed that a new type of malware targeting your computer’s BIOS is in the wild. Termed ‘Mebromi’ by researchers, it’s one of the rarer types of malware in that it digs to the deepest levels of your PC, making it extremely difficult to find and potentially dangerous to remove.

What’s the Big Deal?

The problem with BIOS malware is how deep it goes. Think of your computer like a stack of blocks. On top is what is called user space. This is where most of your programs sit. When you run Internet Explorer, Outlook, Photoshop or most any other program, it is running in user space. Think of this as “you”. It is where programs have only the abilities that you specifically have on the computer. Removing malware at this level can be irksome but is usually manageable. That’s not to say that user space malware isn’t dangerous. After all the most valuable items on your computer are your files and user space malware is fully capable of deleting all of your important data or shipping it off somewhere, so it’s best not to take it lightly. Still, it’s also among the easiest to detect and remove.

The next block down would be the operating system. If you are running Windows or OS X or Linux, this is where it runs. For the most part, anything run at the OS level is capable of altering pretty much anything on your system and can, as you would imagine, cause considerable damage. If malware is running as part of the OS, it is capable of masquerading as legitimate processes and altering system calls such that it can become very difficult to detect. Anti-malware vendors have developed sophisticated methods of detecting OS level malware but it can be very difficult to fully rid yourself of because of the power at its disposal.

Another block down we find MBR malware or rootkits. Each hard drive has a special location which is where the computer first looks for code to start running. When the computer starts, it finds this location, loads the code and starts executing it. This code typically will then direct the computer to search another spot, load that code and start booting the actual operating system (i.e. Windows, OS X, etc). If malware takes command of this boot sector, it will be able to make sure it gets loaded before the operating system is loaded. Moreover, even if anti-malware software cleans the infection from the OS or from user space, the next time the computer boots it will become infected again. Because of this ability to survive many types of cleaning and reinfect on reboot, rootkits are extremely difficult to detect and remove and will sometimes require additional effort to clean.

The final block in the stack is the BIOS malware. BIOS malware infects the computer, not on the hard drive, but on a special chip called the BIOS. The BIOS chip actually gets invoked before the hard drive comes into play. As the boot or root sector is to the hard drive, the BIOS is to the whole computer. Why would such a critical piece of the computer be prone to overwriting with malware? Because sometimes bug fixes are needed. BIOS is just a program like any other, albeit a very low level program. It is critical to proper functioning of your computer though. If a vendor determines there is a bug, they can provide a BIOS update which can then be used to “flash” the BIOS and apply the changes. It is this mutability that leaves it open to tampering by malware. What makes BIOS malware particularly insidious isn’t just that it is loaded at such a low level that it is extremely hard to detect and counter, but that removing it could be very damaging to your computer. Overwriting your BIOS to eliminate the malware, if done improperly, could leave your computer unable to boot until your BIOS is reflashed with a properly functioning BIOS image.

How to Block this BIOS Malware

The way this malware infects your machine starts off just like any other malware attack vector. It has to be introduced to your system from somewhere else, perhaps in a download or attachment which you run, perhaps incidentally from an infected webpage you visit. The payload then has to get past any anti-malware applications you have running and defeat any security measures the operating system has in place. Only once those hurdles are cleared will it be able to do its dirty work. That said, those hurdles are only as high as you make them. If you use an old or unpatched operating system or do not keep your security measures up to date, you are leaving yourself open to attack. In all cases, your best line of attack is to compute responsibly and remain aware while using your PC.

Image by Salvatore Vuono
September 14, 2011 – 6:35 am Categories: Uncategorized | Comments Off

Tagged , , , , , , |

Computer Repair and Support, Things to Ask

Computer Repair and Support

If you are looking for someone for computer repair or support for your company, but you are too small to afford a full time IT staff (even one person), you’ll find yourself looking around for someone who will come in from time to time or as needed in order to keep things running smoothly for you. While we here at PNG Support are more than happy to help you out, even if you don’t choose us we’d like to help you by providing some things to consider when you are hunting for your Technical Advocate.

Consider Your Needs

First things first… what exactly do you need support for? For most small companies, it will amount to a handful of computers and maybe a server, some peripherals, some software, mostly standard stuff. There may, however, be some non-standard things. Do you have some customer software? Perhaps some legacy hardware? Make sure whomever you are considering is willing to handle any odd items that you are particularly in need of help with. Perhaps it’s not so much that you have a particular identifiable need so much as wanting the option to have a resource to lean on who you can direct to “go do this” and who will then take up your banner and get things done on your behalf. We call this “Technical Advocacy”, advocating on your behalf and dealing with other technical vendors for you, leaving you to focus on growing your own business. Some providers just want to be called for support on specific items and don’t or can’t handle dealing with things that are beyond that scope. Make sure you know which you are dealing with.

What about support availability? Naturally, you expect your support provider to be available during normal business hours, but will they be there for you when your internet provider shuts you off accidentally and it happens to be Friday evening just before a big sales event? While PNG Support would, I can’t speak for others and it’s something you need to know. When Hurricane Ike hit the Gulf Coast in 2008, it caused a considerable amount of damage. We worked extended hours with our clients before the storm arrived in order to secure data, provide remote work capabilities for employees that evacuated, maintain as much uptime as possible for their servers and afterward, helped those who had been hit to recover data and services as quickly as possible. Make sure whomever you are considering has the same dedication and focus on your needs.

In Person or Over the Phone?

Do you want site visits to be part of your contract? Just as do many support providers, we provide remote assistance for customers who contact us with a problem. Unlike some, we also provide on site service if the problem requires it. If you wish, we can also set up scheduled visits in order to perform whatever on site maintenance you want and also to “make the rounds”, checking up on your workstations and getting in touch with employees or office managers to make sure no problems have cropped up or to address them if they have.

Do you have or foresee having additional needs? Even if you don’t, it could still happen. Your phone system might end up needing replacement. You might end up requiring some specialized software development. Maybe you will want to upgrade to a larger network or grow to add more users and workstations. You’re going to need a support company which can grow with you. PNG Support provides a number of services and will work to either provide you the service ourselves or help you to find the best option available.

Once you know for sure the company you are considering will provide computer support for the things you need help with, will be there when and how you need them, and can grow with you, you should then consider price. Why consider price last? Because no matter how inexpensive the contract is, if you aren’t getting what you need, you won’t be satisfied with what you’re getting. Of course, if the final figure is still outside of your budget, consider reducing your level of need a bit or ask what options are available which might cut back on the final figure. A good computer repair and support service provider will work with you to get to the right service level at the right price or will let you know quickly if it’s not going to work out.

We’re Here To Help

PNG Support is available to assist you with excellent service at reasonable prices. If you’d like to discuss your needs, please contact us. We’ll be happy to go over the details of your business and determine what you need and how we can help.

September 13, 2011 – 2:01 pm Categories: Uncategorized | Comments Off

Tagged , , , , |

Small Business Network Setup (Part 2)

Your Windows Server

Picking up from where we left of in Part 1, you’ve got your new office, wired it up with ethernet, installed a killer firewall and wireless network. Now it’s time to buy the server. We are going to assume you will be using this server to hold and secure files, run your own email server, manage your printers and share your accounting application between several users. If you have some serious database apps or the need to store massive amounts of data then you may need more than what we are suggesting here today. The important qualities of a server are the speed and number of processors, the amount of memory and the size and type of hard drive storage. Most servers have options for multiple processors. For some small businesses a single processor server is enough but if you’re going to be hosting your own email and have any plans for growth at all I suggest getting a dual socket server. Memory is another expense where it is best to get as much as you can reasonably afford in your server. For our scenario I recommend 8 gigs of RAM or more. The next issue is disk space, an issue which is more complicated that it seems at first glance. Yes you want a lot of disk space and big hard drives, but you also want your hard drives setup in a way that protects your data.

RAID and You

So let’s talk about RAID. Raid is an acronym that stands for REDUNDANT ARRAY of INDIVIDUAL DISKS. In a nutshell the server can take more than one hard drive and assemble them in a single logical drive so that it appears to your server that it’s a single drive but in actuality its multiple hard drives storing your data in multiple locations. It does this so that if any single hard drive physically fails, you do not lose data. RAID, along with a good backup policy, ensures that your valuable company information is safe in the event of catastrophe. There are several levels of RAID. You will see things like RAID 1 or RAID 0 or RAID 5 or even RAID 10. These are all different setups for the multiple hard drives and each has its own level of speed, and safety. For our purposes the most common and useful RAID is level 5. This level requires at least three hard disks where you can afford to lose one of those disks completely without losing any data or even any downtime on the server if it fails. For a company our size RAID 5 with three hard drives is a good setup. The speed of your hard drives are another consideration before we even start talking about how big your hard drives will need to be. There are different types of disks and different speeds as well. Currently there are 2 major types of server hard drives, SAS and SATA. To keep it simple, SAS drives are faster and more expensive while SATA drives are more like the hard drives in your personal computers. I would recommend SATA for our current application, you get more bang for your buck and you will not need the added performance that SAS drives offer. SATA drives typically can be purchased with varying speeds. For a layman, the speed of a hard drive can best be estimated by the RPM rating. A RPM of 5400 is the slowest you can usually find in a SATA drive with most being around 7200 RPM and for an extra price, 10000 or higher RPM can be acquired. As it suggests, the faster the hard drive can spin the faster it can read and write data. For a small business server, an Array of three 7200 RPM SATA hard drives is a good compromise of speed, cost, and safety. Now we finally get to how much disk space. Currently SATA hard drives can be purchased anywhere from 250 Gigabyte to 2 Terabyte. I like to find the best bang for my buck as far as cost goes. For our purposes I’d recommend 1 Terabyte drives. So with 3 Terabytes of hard drives, that gives me 3 Terabytes of disk right? Man that’s a lot. But wait, all that RAID business has a price, and its price is in total usable disk space. In order to protect your data a certain amount of overhead is required. For example 3, 1 terabyte hard drives in a RAID 5 array will give you only 2 terabytes of usable disk space. You take about a 1/3 hit when you use RAID 5 to protect your data. Now you have a server, Dual Processor, 8 gigs of RAM and 2 terabyte in a RAID 5. What’s next? Tomorrow we talk about the Evil Empire and what we need from it. Microsoft.

September 12, 2011 – 8:48 pm Categories: Uncategorized | Comments Off

Tagged , , , , |