Western Digitech

We Recommend Paperstreet.com for Website Design

westerndigitech — Fri, 20 Jul 2012 15:16:21 +0000

As an IT Service provider we needed a new website and Paperstreet.com worked with us to create an easy to use, easy to edit website with a modern look. If anyone is looking for a great group to work with on a new website I highly recommend these guys.

In fact… this blog I am posting is now a breeze. Next we will be having them do our search engine optimization (SEO) to generate a high volume of incoming leads.

_____________________________________

Paperstreet.com - Award-Winning Designs, Client-Winning Results.

PaperStreet has received numerous awards for design and Internet marketing excellence. Here are just a few of our most recent award-winning websites:

10 crazy IT security tricks that actually work

westerndigitech — Thu, 12 Jul 2012 15:38:40 +0000

Created 2012-07-09 03:00AM

Network and endpoint security may not strike you as the first place to scratch an experimental itch. After all, protecting the company’s systems and data should call into question any action that may introduce risk. But IT security threats constantly evolve, and sometimes you have to think outside the box to keep ahead of the more ingenious evildoers.

And sometimes you have to get a little crazy.

Charles Babbage, the father of the modern computer, once said, “Propose to a man any principle, or an instrument, however admirable, and you will observe the whole effort is directed to find a difficulty, a defect, or an impossibility in it. If you speak to him of a machine for peeling a potato, he will pronounce it impossible: If you peel a potato with it before his eyes, he will declare it useless, because it will not slice a pineapple.”

The world of network security is no different. Offer a new means for IT defense, and expect to meet resistance. Yet, sometimes going against the wave of traditional thinking is the surest path to success.

In that vein, we offer 10 security ideas that have been — and in many cases still are — shunned as too offbeat to work but that function quite effectively in helping secure the company’s IT assets. The companies employing these methods don’t care about arguing or placating the naysayers. They see the results and know these methods work, and they work well.

Innovative security technique No. 1: Renaming admins
Renaming privileged accounts to something less obvious than “administrator” is often slammed as a wasteful, “security by obscurity” defense. However, this simple security strategy works. If the attacker hasn’t already made it inside your network or host, there’s little reason to believe they’ll be able to readily discern the new names for your privileged accounts. If they don’t know the names, they can’t mount a successful password-guessing campaign against them.

Even bigger bonus? Never in the history of automated malware — the campaigns usually mounted against workstations and servers — has an attack attempted to use anything but built-in account names. By renaming your privileged accounts, you defeat hackers and malware in one step. Plus, it’s easier to monitor and alert on log-on attempts to the original privileged account names when they’re no longer in use.

Innovative security technique No. 2: Getting rid of admins
Another recommendation is to get rid of all wholesale privileged accounts: administrator, domain admin, enterprise admin, and every other account and group that has built-in, widespread, privileged permissions by default.

When this is suggested, most network administrators laugh and protest, the same response security experts got when they recommended local Administrator accounts be disabled on Windows computers. Then Microsoft followed this recommendation, disabling local Administrator accounts by default on every version of Windows starting with Vista/Server 2008 and later. Lo and behold, hundreds of millions of computers later, the world hasn’t come crashing down.

True, Windows still allows you to create an alternate Administrator account, but today’s most aggressive computer security defenders recommend getting rid of all built-in privileged accounts, at least full-time. Still, many network admins see this as going a step too far, an overly draconian measure that won’t work. Well, at least one Fortune 100 company has eliminated all built-in privileged accounts, and it’s working great. The company presents no evidence of having been compromised by an APT (advanced persistent threat). And nobody is complaining about the lack of privileged access, either on the user side or from IT. Why would they? They aren’t getting hacked.

Innovative security technique No. 3: Honeypots
Modern computer honeypots have been around since the days of Clifford Stoll’s “The Cuckoo’s Egg,” and they still don’t aren’t as respected or as widely adopted as they deserve. A honeypot is any computer asset that is set up solely to be attacked. Honeypots have no production value. They sit and wait, and they are monitored. When a hacker or malware touches them, they send an alert to an admin so that the touch can be investigated. They provide low noise and high value.

The shops that use honeypots get notified quickly of active attacks. In fact, nothing beats a honeypot for early warning — except for a bunch of honeypots, called a honeynet. Still, colleagues and customers are typically incredulous when I bring up honeypots. My response is always the same: Spend a day spinning one up and tell me how you feel about honeypots a month later. Sometimes the best thing you can do is to try one.

Innovative security technique No. 4: Using nondefault ports
Another technique for minimizing security risk is to install services on nondefault ports. Like renaming privileged accounts, this security-by-obscurity tactic goes gangbusters. When zero-day, remote buffer overflow threats become weaponized by worms, computer viruses, and so on, they always — and only — go for the default ports. This is the case for SQL injection surfers, HTTP worms, SSH discoverers, and any other common remote advertising port.

Recently Symantec’s pcAnywhere and Microsoft’s Remote Desktop Protocol suffered remote exploits. When these exploits became weaponized, it was a race against the clock for defenders to apply patches or block the ports before the worms could arrive. If either service had been running on a nondefault port, the race wouldn’t even begin. That’s because in the history of automated malware, malware has only ever tried the default port.

Critics of this method of defense say it’s easy for a hacker to find where the default port has been moved, and this is true. All it takes is a port scanner, like Nmap, or an application fingerprinter, like Nikto, to identify the app running on the nondefault port. In reality, most attacks are automated using malware, which as stated, only go for default ports, and most hackers don’t bother to look for nondefault ports. They find too much low-hanging fruit on default ports to be bothered with the extra effort.

Years ago, as an experiment, I moved my RDP port from 3889 to 50471 and offered a reward to the first person to find the new port. Two people discovered the port right away, which was no surprise; because I told them what I did, it’s easy to discover the right spot. What blew me away is that tens of thousands of hacker wannabes, scanning my system for the new port using Nmap, didn’t realize that Nmap, if left to its own defaults, doesn’t look on nondefault ports. It proved that by doing a simple port move you significantly reduce your risk.

Innovative security technique No. 5: Installing to custom directories
Another security-by-obscurity defense is to install applications to nondefault directories.

This one doesn’t work as well as it used to, given that most attacks happen at the application file level today, but it still has value. Like the previous security-by-obscurity recommendations, installing applications to custom directories reduces risk — automated malware almost never looks anywhere but the default directories. If malware is able to exploit your system or application, it will try to manipulate the system or application by looking for default directories. Install your OS or application to a nonstandard directory and you screw up its coding.

On many of my honeypots, I install the OS to nondefault folders — say, in C:/Win7 instead of C:/Windows. I usually create the “fake” folders that mimic the real ones, had I installed the software and taken the defaults. When my computers get attacked, it’s easy to find complete and isolated copies of the malware hanging out in the C:/Windows/System32 folder.

Changing default folders doesn’t have as much bang for the buck as the other techniques mentioned here, but it fools a ton of malware, and that means reduced risk.

Innovative security technique No. 6: Tarpits
My first experience with a tarpit product was LaBrea Tarpit. It was developed during the outbreak of the Code Red IIS worm of 2001. Worms readily replicate to any system that matches their exploit capabilities. LaBrea worked by answering connection attempts for addresses not already assigned to legitimate machines. It would then answer and tell the worm to connect, then spend the rest of the time trying to slow down the worm, using various TCP protocol tricks: long timeouts, multiple retransmissions, and so on.

Today, many networks (and honeypots) have tarpit functionality, which answers for any nonvalid connection attempt. When I penetration-test these networks, my attacks and network sweep scanning attacks slow to a crawl — they’re unusable, which is exactly the purpose. The only downside: Tarpits can cause problems with legitimate services if the tarpits answer prematurely because the legitimate server responded slowly. Remember to fine-tune the tarpit to avoid these false positives and enjoy the benefits.

Innovative security technique No. 7: Network traffic flow analysis
With foreign hackers abounding, one of the best ways to discover massive data theft is through network traffic flow analysis. Free and commercial software is available to map your network flows and establish baselines for what should be going where. That way, if you see hundreds of gigabytes of data suddenly and unexpectedly heading offshore, you can investigate. Most of the APT attacks I’ve investigated would have been recognized months earlier if the victim had an idea of what data should have been going where and when.

Innovative security technique No. 8: Screensavers
Password-protected screensavers are a simple technique for minimizing security risk. If the computing device is idle for too long, a screensaver requiring a password kicks in. Long criticized by users who considered them nuisances to their legitimate work, they’re now a staple on every computing device, from laptops to slates to mobile phones.

I remember one time leaving my smartphone in a cab, right after an argument with the cab driver over the bill (he had taken me on a much longer, more circuitous route than necessary). I immediately considered that phone long gone. I was worried because I had just chatted with my wife, so the phone was open and exposed. I store my passwords and other personal information on the phone, although slightly modified so that anyone reading it directly wouldn’t know the true passwords or numbers. I was more worried about the contact information for my wife, daughters, and other loved ones. Luckily, I knew my screensaver would kick in momentarily. I never found the phone, but I didn’t get any weird calls or charges either.

Innovative security technique No. 9: Disabling Internet browsing on servers
Most computer risk is incurred by users’ actions on the Internet. Organizations that disable Internet browsing or all Internet access on servers that don’t need the connections significantly reduce that server’s risk to maliciousness. You don’t want bored admins picking up their email and posting to social networking sites while they’re waiting for a patch to download. Instead, block what isn’t needed. For companies using Windows servers, consider disabling UAC (User Account Control) because the risk to the desktop that UAC minimizes isn’t there. UAC can cause some security issues, so disabling it while maintaining strong security is a boon for many organizations.

Innovative security technique No. 10: Security-minded development
Any organization producing custom code should integrate security practices into its development process – ensuring that code security will be reviewed and built in from day one in any coding project. Doing so absolutely will reduce the risk of exploitation in your environment.

This practice, sometimes known as SDL (Security Development Lifecycle), differs from educator to educator, but often includes the following tenets: use of secure programming languages; avoidance of knowingly insecure programming functions; code review; penetration testing; and a laundry list of other best practices aimed at reducing the likelihood of producing security bug-ridden code.

Microsoft, for one, has been able to significantly reduce the number of security bugs in every shipping product since instituting SDL. It offers lessons learned, free tools, and guidance at its SDL website.

This story, “10 crazy IT security tricks that actually work,” was originally published at InfoWorld.com. Follow the latest developments in security at InfoWorld.com. For the latest developments in business technology news, followInfoWorld.com on Twitter.

Law Firms must follow new email filing rules by September 2012 – Florida Supreme Court

westerndigitech — Wed, 11 Jul 2012 15:46:31 +0000

New Court Rule Regarding Legal Filing/Service Is your firm ready?

Detailed info: http://stephenssquibs.info/2012/07/06/everything-you-need-to-know-service-by-email-rule-of-judicial-admin-rule-2-516/

All email attachments sent or received cannot be larger than 5MB… the court mandated file size.

Many of you have asked us about the new Florida court rules governing e-filing and service by email. There is a lot of confusion surrounding the new requirements and about solutions for making compliance easier. In our experience, the company that has this figured out is Copitrak. Their workflow solutions group has developed some easy-to-use and affordable solutions. Contact Tami Cooper (information below) for more information, or contact me directly.

And if your IT consultant hasn’t presented you with a solution for this, or if you feel like you are being left behind (or not getting the attention you deserve), call me for more information about my company, Western Digitech. We’ve been serving the Florida legal community for over 15 years We have a client list of nearly 100 firms, including some of the most successful and most respected practices in the State.

Copitrak – www.copitrak.com

All email attachments sent or received cannot be larger than 5MB. The Copitrak solution enables firms to scan documents and automatically split files into the court mandated file size!!!

Preview all the great benefits of the new Workflow Solutions:

OCR
Bate Stamping
Scan directly to Client Profiles, NetDocuments, iManage/Filesite, ProLaw, TrialWorks, Worldox
Scan to Court feature splits documents into court mandated file sizes

We also provide traditional cost tracking, copies, prints & scans!

Tami Cooper

Business Development Strategist

Ph: 561-361-9900 ext226

Cell: 786-223-8264

Tami.Cooper@Copitrak.com

Copitrak – www.copitrak.com

____________________________________

Peter Stebbins

Account Manager

Western Digitech, Inc.

Office: 786-433-6935

Email: peter@wdigitech.com

Web: www.WesternDigitech.com

Calling all ILTA and ALSP members! Please join us for this networking event July 19th

westerndigitech — Mon, 09 Jul 2012 14:30:41 +0000

Miami ILTA/ALSP Social

Don’t miss this Miami Area Event!

Calling all ILTA and ALSP members! Please join us for this networking event, where you’ll enjoy good conversation, some light refreshments and a welcome cocktail (compliments of Western Digitech). This event will be held at the Chophouse in downtown Miami. You won’t want to miss this one!

Date: July 19, 2012

6:00 p.m. – 8:00 p.m.

Location: Chophouse Miami

300 S. Biscayne blvd.
Miami, FL 33131

(305) 938-9000

Hosts: Danette Shaifer from ILTA

Beverage sponsor: Western Digitech

REGISTER online here.

Are law firms investing in the wrong IT resources – if they are investing at all?

westerndigitech — Mon, 09 Jul 2012 13:39:15 +0000

Are law firms investing in the wrong IT resources – if they are investing at all?

WRITTEN BY JOANNA GOODMAN | 01 JULY 2012

A new survey conducted by business technology services provider Avanade and The Lawyer magazine revealed a worrying disconnect between business and technology strategies in many UK law firms. The survey, which included half the UK’s top 50 firms, asked 74 law firm decision makers about their strategic IT investment priorities. While nearly two thirds of respondents cite client and resource management as their firm’s main business focus, and half mention finance and billing and business growth, a clear majority – 65% in total and 76% from top 25 firms – state that their next technology investment would involve outsourcing.

Yet 56% of respondents agree that client pressure on fees represents the greatest threat to their business with 45% citing client demand as their top reason for investing in new technology.

As Daryn Edgar, senior director at Avanade, explained at a round table debate on 29 June, the findings indicate that law firm technology investments are focused on cost cutting rather than addressing the issues that concern their clients. Are law firms investing in the wrong IT resources – if they are investing at all?

This is particularly relevant in the changing face of competition. “New market entrants, such as retail brands, are historically more focused on consumers. Client-focused firms are investing in new IT systems that are consumer-savvy and efficient”.

Although some law firms offer their clients online access to case information and knowledge resources, the majority fail to address clients’ need for business agility when it comes to fees and billing.

“It is vital that law firms concentrate on their critical, client-centric technologies to help deliver the best service and run a smooth cost-effective practice,” adds Edgar.

Corporate legal departments are increasingly buying into sophisticated e-billing technology (internal or third-party) and require their suppliers – including law firms – to submit bills in the requisite format. This often involves a more detailed breakdown than many firms are accustomed to providing. The information facilitates like-for-like comparisons between different firms.

Enterprise resource planning (ERP) systems give firms the business agility that their corporate clients expect. But only 15% of respondents are considering investing in ERP. Customer relationship management (CRM) systems fare better, with 37% considering investing.

Effective resource planning
Simmons & Simmons is implementing Avanade AX Legal, an ERP solution that brings together workflow, compliance and business intelligence to provide a single data set across all practice areas, departments and offices. Based on Microsoft Dynamics, it offers seamless integration with other Microsoft products.

Finance director David McLaughlin explains the rationale behind the decision to replace the firm’s entire practice management and HR systems. “Whereas most businesses are organised by geography, law firms tend to run a global common profit sharing model,” he says. “Professional services are about people and ERP provides a single software platform that brings together the information about all our people and all our clients across all our offices.” He adds that having fewer systems that need to interface with each other significantly reduces both complexity and cost of ownership.

Finance and HR have different priorities and concerns, and bringing together all the information in one place improves efficiency and productivity and facilitates innovative billing arrangements. For example, it can help identify the right people for a particular piece of work in terms of skills, experience, training and location. Clearly, this type of decision has financial and billing implications. Because the system is implemented globally across the business, there is less risk of lost revenue, under/over utilised resources and poor customer experience.

The roundtable discussion turned to confidentiality. Avanade AX Legal includes the ability to create different views for different users, by seniority, responsibility and geography. For example, practice heads can view both team and fee-earner information and senior management can access a helicopter view of the entire firm and then drill down to more specific information. Client accounts and billing can include – and share via a client portal – the appropriate amount of detail.

The secret is not just enterprise resource planning, says McLaughlin. It is effective resource planning. And the right technology can make an enormous difference.

Law requires mandatory service of documents between attorneys by email.

westerndigitech — Mon, 25 Jun 2012 19:54:43 +0000

New Florida Rule Requiring Email Service as of July 1, 2012/E-Filing on April 1, 2013

The Supreme Court has amended the rules of court today to require mandatory service of documents between attorneys (and pro se parties who opt in) by email. http://www.floridasupremecourt.org/decisions/2012/sc10-2101.pdf You do not have to mail hard copies if you have served by email, but you can (but still have to email). They amended all rules (except criminal, juvenile, and traffic), including Fla. R. Civ. P. 1.080 (pages 12-15), to require it by referencing to new Rule of Judicial Administration 2.516. The rule takes effect almost immediately: July 1, 2012. (See below regarding the new rules on electronic filing, not mandatory in civil or appellate proceedings until April 1, 2013).

Relating to how service by email is to be accomplished, the Court explained (page 6):

1. Service by e-mail is deemed complete when the e-mail is sent.

2. Additionally, e-mail service is made by attaching a copy of the document to be served in PDF format to an e-mail.

3. The e-mail must contain the subject line “SERVICE OF COURT DOCUMENT” in all capital letters, followed by the case number of the relevant proceeding.

4. The body of the e-mail must identify the court in which the proceeding is pending, the case number, the name of the initial party on each side, the title of each document served with that e-mail, and the sender’s name and telephone number.

5. The e-mail and attachments together may not exceed 5 megabytes in size; e-mails that exceed the size requirement must be divided into separate e-mails (no one of which may exceed 5 megabytes) and labeled sequentially in the subject line.

6. Originals must be filed before or immediately after service by email. I assume (but don’t know) that mailing the original to an out of town court will suffice as “immediately”. Eventually the courts will all be going to e-filing anyway, as the First DCA has done.

7. Service by email is deemed service by mail, so you will always get the extra 5 days to respond.

8. If you know that a party did not receive the email, you have to immediately re-email it, or serve it by other means (by hand, by mail, or by fax and one of the other means, as now for faxing).

9. Upon motion or sua sponte, a court can modify the requirements, such as by allowing service on less than all counsel in cases with a lot of lawyers.

10. At the outset of an action, all attorneys must designate their email addresses for service, and up to two others (e.g., secretaries or alternate email address for the attorney). If an attorney does not so designate, you must use the address on file with the Florida Bar, which is usually on the website (www.flabar.org) when you do an attorney search by name or bar number. I assume we will be expected to do this in all pending actions as well.

11. Documents served by email can be electronically signed with a “s/” as is done already in the First DCA and in federal court via PACER, but you can also just sign and scan the original (which I prefer so there is no doubt). The original filed with the clerk still must be physically signed by the lawyer.

12. I suspect this will be tweaked over time. Pages 12-21 contain the amendments to the Rules of Civil Procedure, and many rules are amended (including the Summary Judgment rule pertaining to serving summary judgment evidence and the Proposals for Settlement rule), but not Rules 1.340 or 1.350. So I do not yet know if it applies to discovery which is not filed with the court, though I assume so.

13. Courts may, but do not have to, serve papers by email.

14. You still have to serve the initial pleading (complaint, petition, etc.) by normal means, including the initial document in appellate matters (see pages 78-80, amending Fla. R. App. P. 9.420).

To my read of the rule, emails for serving documents should look like this:

To: [all parties’ counsels’ email addresses]
From: [you]
Date: [self-explanatory]
Re: SERVICE OF COURT DOCUMENT Case No. 12-12345
————————
Dear counsel:

In Alpha v. Zeta, in the Circuit Court of the 11th Judicial Circuit in and for the State of Florida, Case No. 12-12345, attached is Plaintiff’s [document].

Name

305-373-0708
———————–
If you are attaching multiple pdfs over 5MB in size, the subject line should read like this:

Re: SERVICE OF COURT DOCUMENT Case No. 12-12345 (1 of 4)

Also today the Supreme Court ordered clerks to accept documents by e-filing by April 1, 2013, in civil and appellate courts.

The opinion is found here: http://www.floridasupremecourt.org/decisions/2012/sc11-399.pdf

Fla. R. Civ. P. 1.080 (amended already as to service by email) was re-amended as well (page 27) to define filing of orders and what is a writing. I will give $5 to the first lawyer to get a published appellate opinion interpreting those obscure amendments.

The new Rules of Judicial Administration/amendments thereto are at pages 33-40.

The amended Rules of Appellate Procedure are at pages 53-85. I think the rule for e-filed briefs relates back to the new rule of judicial administration 2.516 to provide for e-filing of briefs in pdf format, so this may finally put the stake in the heart of us WordPerfect users having to fight with conversions to Word (hurrah!).

I hope this is helpful.

Millions of LinkedIn passwords reportedly leaked online

westerndigitech — Thu, 07 Jun 2012 15:27:27 +0000

A hacker says he’s posted 6.5 million LinkedIn passwords on the Web — hot on the heels of security researchers’ warnings about privacy issues with LinkedIn’s iOS app.

A user in a Russian forum says that he has hacked and uploaded almost 6.5 million LinkedIn passwords, according to The Verge. Though his claim has yet to be confirmed, Twitter users are already reporting that they’ve found their hashed LinkedIn passwords on the list, security expert Per Thorsheim said.

LinkedIn revealed through its own tweet that it’s looking into reports of stolen passwords, and it advised users to stay tuned for more information.

Many of the hashes include the word “linkedin,” which The Verge believes lends credibility to the reports.

LinkedIn passwords are encrypted using an algorithm known as SHA-1, which is considered very secure. Complex passwords will likely take some time to decrypt, but simple ones may be at risk.

Sophos security expert Graham Cluley is advising LinkedIn users to change their passwords as soon as possible, at least as a precaution. If the report is true, then hackers are undoubtedly working hard to decrypt the hashed, or unsalted, passwords.

“Although the data which has been released so far does not include associated email addresses, it is reasonable to assume that such information may be in the hands of the criminals,” Cluley added.

The report of the leaked passwords comes hard on the heels of word from security researchers that LinkedIn’s iOS app is collecting information from calendar entries — including passwords — and transmitting it back to the company’s servers without users’ knowledge.

A LinkedIn spokeswoman told CNET that the company does not use account password information for the calendar feature of its iOS and Android apps and that the initial report may have been referring instead to passcodes that are sometimes stored for dial-in meetings.

But in response to concerns over this collection of data, LinkedIn yesterday tried to explain how and why it captures this information.

The company acknowledged that it picks up information from the Calendar app on your iOS device to try to sync any appointments listed with fellow LinkedIn users. The feature is opt-in, so users of the LinkedIn IOS app can turn off the ability to “Add Calendar” in the Settings screen.

The details sent to LinkedIn’s server include the e-mail addresses of the people you meet with, the meeting subject, the location, and any meeting notes. The calendar data is sent securely using SSL encryption and isn’t shared or stored, LinkedIn added.

But in a concession to concerned users, the company has promised two tweaks to the feature. It will no longer pick up meeting notes from your calendar. And it will add a “learn more” link to explain how your calendar data is being used.

To change your LinkedIn password, log onto your account. Click on your name in the upper right corner and then click on the link for Settings. In the Settings section, click on the Change link next to Password. You’ll be prompted to to enter your old password and then create a new one. Aim to pick a complex password that’s not easy to decipher. Then click on the Change Password button.

CNET contacted LinkedIn for further details and will update the story when we get more information.

Photocopiers: The newest ID theft threat

westerndigitech — Thu, 07 Jun 2012 15:21:43 +0000

Computerworld - Photocopiers are the newest threat to identity theft, a copier maker said today, because newer models equipped with hard drives record what’s been duplicated. At tax time, when Americans photocopy tax returns, confidential information may be easily available to criminals.

“Consumers and business owners will photocopy highly confidential tax forms containing Social Security numbers, employer identification numbers and other sensitive information in places outside the home, leaving them vulnerable to digital theft,” Ed McLaughlin, president of Sharp Document Solutions Company of America, said in a statement.

At issue are the hard drives embedded in most copiers and intelligent printers manufactured in the past five years. Data is stored on the drive before a document is copied or printed; unless security provisions are in place, the data is stored unencrypted and remains there until the drive is full and new data overwrites old.

Sharp, a major copier maker, commissioned a survey that found 55% of Americans plan to photocopy or print out copies of their tax returns and supporting documents this year. And almost half of that number will do so outside the home, using copiers and intelligent printers at their offices or public machines at libraries and copy centers.

“Everyone forgets that there’s data in there,” said Avivah Litan, an analyst at Gartner Inc. “Copiers and other intelligent devices like multifunction printers are very exposed in the enterprise. They’re open to attack via modems, and people forget about changing the default passwords.”

Sharp’s survey also indicated that 54% of those polled had no clue that digital photocopiers store an image of what’s duplicated and that a majority believed running off returns on copiers or printers is a safe practice. When told of the security threat posed by unsecured hardware, however, two-thirds of the people surveyed said they were less likely to copy their financial information on a public digital photocopier.

“I’ve not heard of any cases of ID theft [from photocopiers],” said Litan. “But there is certainly ID theft in public places like Internet cafes and from kiosks, so I don’t see why it couldn’t happen at someplace like a Kinko’s.”

Sharp was one of the first photocopier makers to offer a security kit that encrypts data on the hard drive and “shreds” each copied document by overwriting the image after it’s printed. Rival Xerox Corp. introduced similar features on its machines last year.

“We’ve told enterprises that they should change the password from the default on copiers and [multifunction printers],” said Litan. “They should disable all services that they don’t need and make sure that the data modem is separate from the fax modem.”

Read more about Security in Computerworld’s Security Topic Center.

Apple Mac virus, dubbed ‘BackDoor.Flashback,’ infects 600,000 systems running Mac OS X, reports say

PaperStreet Web Design — Fri, 11 May 2012 20:08:55 +0000

Apple’s Mac computers have popularly been lauded as “virus-free” systems compared to their PC competitors, but that could be changing.

According to Time.com , Macs are not bulletproof or impervious to viruses. Over 600,000 Macs may have recently succumbed to a “Flashback Trojan,” according to the Time report.

The Trojan, now dubbed, “BackDoor.Flashback,” has potentially infected more than 550,000 systems running Mac OS X, most of which were located in the U.S. and Canada, according to Time.

Time reported that 56.6 percent of affected Macs are in the U.S. (303,449), 19.8 percent in Canada (106,379), 12.8 percent in the U.K. (68,577) and 6.1 percent in Australia (32,527). In any other country, the estimated number is less than 1 percent.

According to the Daily Mail, the virus is delivered via infected web pages and infected computers can be controlled by cyber criminals and ‘told’ to download new malicious software.

Just visiting a web page with the virus is enough to infect your machine, according to the Daily Mail report.

Apple has issued a “Java for OS X” fix to thwart the virus. The fix should be there for you to download when you perform a manual “Software Update.”

If you think you’ve already been infected… contact us.

A spotlight on Law Firm Security

PaperStreet Web Design — Fri, 11 May 2012 20:08:44 +0000

As the rest of the world and industries tighten their security, it places law firms in the unenviable position of being viewed as the weakest link So prevalent is the view, that the FBI convened a meeting of the top 200 law firms in New York City to deal with the increase in law firm cyber attacks.