Security

WordPress Screencasts

/ , / , , , , / 0 comments

Now Producing WordPress Technical Screencasts

A few months ago I started producing a variety of screencasts for Sitepoint Premium  – a freemium collection of technical tutorials for developers and professionals in general to hone their skills. Below are some links to my free tutorials. If you’re interested in seeing the full collection, you can sign up using this link.

Watch: WordPress Theme? Check. Hidden Malware? Test!

The internet is filled with plenty of WordPress themes, yet the scary thing is that there’s almost no level of quality assurance with them. Yikes! What this means is, that fancy WordPress theme you’re considering… might have some malware hidden within it’s theme. That’s no reason for you to dump your theme shopping cart.

In this screencast I will show you a simple way to make sure that the themes you download are clean and you on longer have to fear the hidden malware

Watch: Backup Your WordPress Sites Manually and Easily

There are plenty of plugins to backup your WordPress site, yet the best way to ensure your backup works is… to do it manually! Yes it sounds difficult, but that’s only because you may not have realized that it only takes a few minutes to capture the basics. Watch as I demonstrate how to do this in less than 5 minutes.

Watch: Get the Right File Permissions in Your WordPress Site

Changing your WordPress permissions might seem trivial, but it’s a small step you can take to improve your website security. Learn how to set permissions yourself, confirm they’re correct, and also how to overcome the side effect. In just a few minutes with this video, I’ll show you exactly how to do that. Enjoy!

Top Technology Investment Trends

/ , , , , / , , , , , , , , , , , , , / 0 comments

Looking to Invest in Tech? Here are the Hottest Trends for 2015

Technology is one of the most attractive sectors for anyone looking to make money, however as it’s a vast field, it can be difficult figuring out the most profitable niches. Since venture capital is an extensive topic which we have covered here in multiple articles, rather than giving tips on setting up a portfolio, we’re going to dive right into the hottest technology trends for 2015 as discussed at the recent CEA Innovate event.

Internet of Things

Although many appliance and technology vendors are hyping up the Internet of Things (IoT) as the greatest thing since sliced  bread, IoT is just old technology packaged in a new design. As I discussed in this answer on Quora, home automation has been around since the early 2000’s through X10 (hint:  they’re the ones shilling spy cams via pop-ups on 99.999% of the internet back in their hayday). The only difference between then and now is that the capabilities have expanded and consumers are now finding valuable applications of these systems.

While IoT has many applications ranging from industrial automation down to consumer gadgets, it’s going to be hard to pick a winner until there’s a baseline standard in the market to ensure interoperability between devices. As virtually every major technology vendor is pushing their own proprietary standard for I0T communications, adoption in this space is going to be hindered for awhile.

Mobile Awareness

Another old technology which is only now catching on, mobile awareness first came about when Bluetooth phones became popular. Advertising companies had the idea of sending SMS advertisements to phones as they went past Bluetooth beacons in strategic locations such as movie theaters. As you can imagine, this didn’t go over well with the public and the field was relatively dormant until now.

Now that users are more comfortable with sharing their information, location awareness is starting to take off in retail and other sectors. iBeacons are allowing companies to track user behavior within the store to improve the shopping experience, while other companies considering offering opt-in discount programs fine tuned to account for the time a user spends in different departments.

Ultimately any app which triggers a feature based on user location falls under the category of mobile awareness however the biggest thing to keep in mind is that this should always be an opt-in feature.

Sensors and Wearables

As previously discussed on this blog,  although there have been many challenges to wearable technology and it has failed to live up to expectations, technology vendors are finally getting their acts together and pushing for novel uses in this field.

Healthcare is going to be a significant driver of innovation within the wearable space because the healthcare industry is in desperate need of disruption. By making it possible for doctors to monitor at-risk patients remotely, it’s possible for doctors to get a more accurate picture of a persons health than the current system which only allows 20 minutes per visit on average.

Wearables might take off in other sectors, but the key driver of  innovation always will be profit. If a user isn’t going to pay the costs, then monetizing the data is a possible option. Before pursuing this route, technology vendors need to consider the privacy implications as discussed later in this article.

Payments and Money

Cryptocurrencies such as Bitcoin, Litecoin and Dogecoin are all the rage today, however there’s more to the digital payment space than these applications. For many investors, the primary focus within this area is going to be around streamlining commerce to make it easier. For example, customers paying by phone can allow bartenders to serve more drinks every night rather than constantly closing out tabs.

Ultimately the innovation in this market is likely to be dominated by the enterprise vendors because they’re the ones who already control the infrastructure powering payments. Startups can focus on building out a quality product, however even if consumers want it, it’s up to the banks, merchant processors and retailers to green light it for adoption.

Privacy and Security

With all the previously mentioned areas, having the trust of users is crucial for successful implementations. Users are fine handing over information to Google because they get a significant value from the exchange. On the other hand, when the NSA harvests information from users (probably not as much as Google), there’s a backlash due to the lack of transparency. Just like any tool, technology can be used for good or evil. It all depends on the context.

While prior generations may have been uncomfortable handing over information, most younger generations are fine as long as they feel they are not being manipulated.

In general, this segment is going to be huge for investments because companies today need to protect themselves from data breaches in order to maintain the trust of users.

Thinking Ahead

As mentioned earlier in this post, before you make an investment in a company, you better make sure that your prospective portfolio company is bringing significant value to the market. Ask yourself, “Am I putting money into this company because of the industry, or is it because I believe in the entrepreneur?”

Even the greatest ideas are worthless if they have bad execution, while a bad idea can flourish if it has great execution. Ultimately these trends can help you figure out what areas to focus your search on, but it’s up to you to effectively assess the companies you invest in.

 

What do you think about these trends? What else do you think will be big in the years to come? Leave your thoughts in the comments!

Image source:  Freedigitalphotos.net

Bitcoin

/ , / , , , , , , , / 0 comments

Startups Fighting to Bring Bitcoin To The Masses

Bitcoin might seem like it is limited to a narrow niche,  however at this year’s Startup Debut in Las Vegas,  Nevada, a few startups have shown that the currency is something worth following.  In particular the startups all showcased practical services to help the average consumer better use the currency.

Store Your Bitcoins Securely in the Cloud

KryptoKitUp until recently one of the biggest pitfalls of using Bitcoins was a lack of portability.  Most notably the case of the IT professional who literally threw out $9 million in Bitcoin when he accidentally disposed of the hard drive which contained his Bitcoins.

The previously mentioned scenario is the problem KryptoKit aims to solve the problem by providing users with a straightforward wallet which automatically syncs with the cloud.  KryptoKit is a Chrome extension which users can install with one click. The most notable feature of this app is that it allows you to access your Bitcoin from any computer which has the app installed.

Meet the World’s Most Affordable Bitcoin ATM

Are you a store owner who wants to stand out from the crowd? If so,  you might want to take a look at Lamassu Ventures which created a Bitcoin ATM which sells for $5,000. While the company is based out of New Hampshire, the startup sports customers across the globe.

Rather than dispensing cash,  the initial version of the ATM allows customers to convert cash to Bitcoins which are instantly sent to their phone.  According to a rep from Lamassu Ventures they are working on a device which will convert Bitcoin to cash.  When asked if  they will develop an all in one device,  the rep said they intend to keep the functionality separate to offer merchants more flexibility.

Sure,  Bitcoin might be a narrow niche now,  but embracing this currency is a great way to gain attention with customers.






Using Bitcoin For Regular Shopping

Up until recently one of the biggest pitfalls of Bitcoin is the lack of merchants which don’t accept the currency. While the reasons for this are beyond the scope of this article, Bitcoin will likely not be accepted by most merchants anytime soon.

To solve this problem, BitCoinShop.us serves as a broker between merchants and Bitcoin users, allowing seamless Bitcoin payments for merchandise while the merchant focuses on serving the customer. The image to the right illustrates some of the most notable sales on the site.










bitangels –  a Syndicate for Bitcoin Startups

bitangelsBitcoin might be a niche area right now, however that doesn’t mean startups in this space have to go without funding.  Bit Angels is a global angel Syndicate devoted to funding worthwhile startups helping to make Bitcoin more mainstream. The group sports over 150 members and typically invest 250 to 5,000 BTC per startup.

 

Key areas of interest for the syndicate include:  Colored Coins, Mass Adoption, Developing World, Exchange / Financial Services, ASIC Mining, Friendly Jurisdictions, and Wallets.

 

2014 Trends and Analysis

/ / , , , , , , , , , , , , , , , , , , , / 0 comments

Technology Predictions for 2014

Love it or hate it, 2013 was a notable year in technology with many notable events in the tech space. Although not all of these were the most positive, the events have established a baseline for the innovation to come in 2014. The experts at Living in Digital Times have recently released a report outlining several key areas of innovation which will likely come about during the coming year. Of course before taking the report at face value, it is important to note that not all the experts quoted in the report are neutral within the industry and as such there are a few key areas which should be examined.

Expect Innovation With Some Turbulence

Some of the most notable pieces of innovation from 2013 include 3D printing and increased use of the cloud- and while these inventions have positive sides, we also witnessed the dark side of many. For example Business Insider reported on how a couple of individuals created a 3D printed AR-15 rifle – the same gun which was used by Adam Lanza in Sandy Hook (UPDATE:  A reader sent over a report from the Independent Journal Review stating Lanza only used pistols during Sandy Hook although authorities found an AR-15 in his car

On a related note, in Janary of 2013 we saw the creation of an auto aiming sniper rifle which integrated with the iPad. Unfortunately these inventions are just the beginning and in 2014 the floodgates will be open for much more crude content such as this.

In 2013, cloud technology became one of the hottest areas in the IT sector – between the rise of Software as a Service (SaaS), Platform as a Service (PaaS), and Infrastructure as a Service (IaaS) – companies have been pouring data into the cloud at a nominal cost, but when the Edward Snowden incident came about, many businesses learned that their “secured” data wasn’t as secure as originally planned.
For those wondering which vendors have been protecting user privacy, the Electronic Frontier Foundation has released a helpful guide. Even with the backlash against the NSA, don’t expect this area of technology to improve anytime soon. Ultimately security is a tough area of information technology and unfortunately many businesses find it easier to mop up the mess after a disaster rather than to implement safeguards to protect users. Don’t expect lawmakers to improve this situation anytime soon.
This is why before putting anything in the cloud, you should make sure that you take proper precautions to protect yourself from data breaches.

Will Wearable Technology Come Into Vogue?

Wearable technology is one of the hottest things which came about in 2013. The Pebble and the Galaxy Gear ushered in the era of the smartwatch while Google Glass confirmed the fears of many that Google is on track to take over the world. Despite the innovation brought about by these devices, do they actually produce enough value to justify their existence? Smartwatches are merely a 2nd screen for smartphones which is worn on the wrist, while privacy concerns and other social taboos are crippling the social acceptability of Google Glass.

When it comes to sensors for health and related matters – Stacy Burr, VP Wearable Sports Electronics at Adidas sums things up perfectly with the statement “…We need to give context to data in order for the wear-experience to be meaningful and valuable.” As mentioned earlier on High Tech Realm, with any invention – the focus needs to be on adding value to the end-user.

Would you purchase a smart-bra? As ridiculous as it sounds, Mashable reports that Microsoft is working on that technology so that EKG sensors can more efficiently monitor heart rhythms.  On the other hand, another report from Mashable profiles a dress which turns transparent when the wearer is aroused. This probably is one of the less ideal ways for someone to use wearable technology.

Conclusion

Overall expect 2014 to user in an era where the little guy can easily take on established firms. This trend has been happening since the dot-com bubble however thanks to Moore’s Law, technology is advancing exponentially year after year. Thanks to crowdfunding, Samsung managed to be knocked out in the smartwatch space by an average engineer with nothing but a computer and an idea. Despite not having a multi-million dollar marketing campaign, and a significant R&D bankroll, as reported by VentureBeat, the Pebble has been running laps around the Galaxy Gear smartwatch.

Aside from hardware, thanks to open platforms and the increased popularity of programming, expect to see many software startups overtake established players. The demise of RIM (formerly Blackberry) and the rise of Android has proven that just because something is free doesn’t meant that it is a subpar offering which cannot be monestized.

Sure iOS from Apple is still big, however the walled off garden created by Steve Jobs will prevent iOS from being used in the same ways as Android. While the possibilities of open source software are too many to mention, a client of CJC Digital is aiming to replace proprietary educational platforms with open source software to save the districts tens/hundreds of thousands of dollars in software licensing costs.

/ , , / , , , , , , , / 0 comments

Don’t Trust,Trust Seals

Image: chanpipat / FreeDigitalPhotos.net

With the rise in the numbers of identity theft and hack attacks on numerous corporate websites, website security has become one of the hottest internet-related topics for consumers and businesses alike. Despite the validity of the topic, however, as with anything with a huge demand, a new breed of scams geared towards business owners have sprung up and grown through marketing tactics analogous to a mafia shakedown for “protection.”

While many online merchants are familiar with Payment Card Industry (PCI) Scanning – the industry standard of security for e-commerce –  “trust seals” have recently sprouted as a more attractive security measure. By promising to increase conversions, and also providing a false sense of security, many business owners have fallen victim to the services.

Although PCI scans are required quarterly for virtually any merchant accepting credit cards online, trust seals have gained appeal because they give the illusion of ongoing security audits at a fraction of the cost of a security firm retainer. Additionally, many services also include an icon boasting the site as being “hacker proof,” which in theory increases shopper confidence. While PCI scan packages start around a couple hundred and go up to over a thousand, the trust seal vendors push their plans from as little as $4/month to $50/month.

Although such alternatives might sound attractive, in reality it is a case of “buyer beware” since most of them are snake oil as they do not conform to industry standards. Rather, many of them are poorly coded programs, which aside from providing a false sense of security, also can get your website blacklisted by your webhost, or even lead to security breaches.

For insights into reputable scanner products offered by professional “white hat” hackers – industry jargon for good guy hackers – I interviewed Bill Pennington, chief strategy officer at WhiteHat Security, to gain information on how legitimate scanners check for vulnerabilities.

Before continuing, a quick note is in order:  There is no such thing as a fully secure website, and while having an expert promise invincibility against hackers, such promises should always be red flags, which cause you to turn the other way. Additionally, depending on where you host your website, your host might already handle PCI scanning on your part, meaning that you don’t have to pay an additional fee for scanning unless you have a significant reason to justify the investment.

Before picking a security vendor, especially as a small business, it is best to contact your web host and ask if their servers are PCI compliant. For the most part, unless you are running your own hardware, the host will say they do handle the PCI compliance on your behalf. Additionally, if you happen to be running a dedicated server, or you collocate (meaning you fully control the hardware), you might be able to get scanning at a discounted rate.

As PCI vendors such as Comodo, McAfee, and others charge sums from $250 to over $1,000 per package, contacting your host can save you from paying for services already provided to your company.

Going back to Whitehat Security, sometimes it pays to have additional audits done to ensure the integrity of your website. Although PCI covers a significant part of website security for the average merchant, audits typically occur quarterly instead of in real time, and they are limited to a fairly generic overview of the “average” way businesses sell items online. If you have a heavily customized system, a high volume site, or your company is the target of opposing groups, retaining a security provider might be worth the investment.

In my interview with Pennington, I asked how an automated scanner stacks up to their services. As a very simple analogy, automated scanners are similar to how Google and other search engines scan sites. If they hit a password protected page or form requiring human intervention (such as a checkout process, registration, etc) the scanners are immediately thrown off. Additionally many automated scanners are “dumb,” meaning that some tests can flood your company email accounts and databases with thousands of dummy records, plus in some cases your web host might shut your site down due to a false hacker alert from the tests.

In contrast to the automated scanners, Pennington discussed how most white hat security firms have expert teams who handle the majority of auditing, and when it comes to automated portions, they monitor the numbers of errors so if a section is breached, rather than constantly hammering it, they choke off that specific test.

Additionally, while automated scanners can bring down websites due to hogging resources, Whitehat and most other reputable firms employ intelligent automation, which ensures it is friendly for up and running websites, so that business can continue while testing occurs. Additionally, for online stores, experts check the forms by hand since it currently is not practical for computers to fully process an entire checkout process.

In general, the majority of reputable web hosts out there will already handle the majority of security for you, however the key piece of information to keep in mind is that when shopping for a security firm – if a deal is too good to be true, it probably is, and also if something is fully automated chances are the service is ineffective. Also, when it comes to PCI scanners, make sure your vendor of choice is on the official list of approved PCI scanners.

This article was originally written for SmallBizTechnnology.com – Original Post

/ , / , , , / 0 comments

Securing Your Files with EncryptStick

USB Drives are a staple of modern society. However the convenience of those small devices also come with the risk of losing the drive and data, or worse — a thief going through your files.

Fortunately, there’s a solution which allows you to store even the most sensitive files, knowing that the technology securing your files is theoretically more secure than the Advanced Encryption Standard (AES), which is the encryption primarily used by the United States government To combat issues such as the ones mentioned above, many USB drives feature pre-installed security software, or you could download free encryption programs. However many of those programs are rushed to distribution, meaning the programs may be subject to varying levels of breaches, or programs could be hard to use.

In today’s day and age, you need security which you know will stand the test of time, because even with encryption, once a person has a file, it’s only a matter of time before they are able to breach the security (provided they have the determination), be it a matter of days, years, or even decades. Despite the previously mentioned shortcomings, there is hope.

While attending the Web 2.0 Expo at the Javits Center in New York City during November of 2009, I interviewed Mark Smail, who is the Chief Technology Officer of Onix International, which is the maker of EncryptStick (encrypt-stick.com), which is an encryption program made for USB drives that uses a 512 bit polymorphic encryption algorithm.

The encryption algorithm stands out from others, such as the US Government AES algorithm, because the encryption keys are twice the size of the highest grade AES implementation, and the algorithm is dynamic meaning rather than having a single code to crack EncryptStick uses a dynamic algorithm.

During my interview with Smail, he mentioned that the EncryptStick algorithm is based on code created by a company partner, who after development, was seized by the German government and made a state secret; however the code was later declassified and therefore made available for product development.

For those who are really interested in the technology,the makers of the algorithm are so confident in its security to the point that they allow virtually anyone to inspect the source code, provided they sign a non-disclosure agreement. The details can be found by visiting pmc-ciphers.com and clicking the dollar bill on the right side.

Moving on from the technical to the practical, let’s focus on the features of EncryptStick. Starting off, the program is fairly simple to install. Just purchase a license from the website which costs $39.99 and download the file directly to your USB drive.

After downloading the file, you run the install file. However unlike many other programs, EncryptStick require users to access the internet for a registration code. This is an important feature I’ll get back to shortly. After getting the code, you continue with the installation and then you’ll be free to create “vaults” for your files on both your USB drive and on the computer you are working on. This means that aside from placing files on the drive, you also can create a folder on the computer you are working on which will only appear when your USB drive is connected. Otherwise, the folder will be undetectable.

Now the files/vaults you create on your computer will be hidden, provided Windows is set not to show hidden files. If hidden files are set to be shown, users can see the files; however the names and contents are scrambled so they would be inaccessible without your key. According to Small, the reason for this is so copies of your files can be backed up.

The program also has a password manager built in, which aside from storing your passwords, also provides protection from keyloggers. The protection works in that after entering your passwords into the password manager, when you need to log into a site, you simply select the website from your password list and then select the copy option. Unlike traditional copy/paste which would show the password in plain text, passwords copy/pasted using the secure option only show up to key loggers as ********’s so abc123 would show up as ****** to a keylogger.

Finally, going back to the serial number, EncryptStick has a vault recovery feature, so if you ever lose your USB drive, you simply purchase a new copy of EncryptStick and submit your prior key. From there your new drive will be able to access vaults created on other computers, provided you also remember your prior password. However, you won’t be able to access files on your USB drive, as EncryptStick only keeps track of your encryption keys and not your files.

This article can also be found with the paper I write for, The Stony Brook Statesman here.

*Update* This article was corrected as of January 31, 2010 to correct the following error:  The last name of Mark Small is spelled Smail and not Small