Seven Deadly Sins of Social Networking Security

To users of LinkedIn, Facebook, Myspace, Twitter or all of the above: Are you guilty of one of these security oversights? Some of you are using all of the above, and using them hard, even IT security practitioners who know better. While it's impossible to escape every social networking threat out there, there are steps one can take to significantly reduce the risks. CSO, a provider of news, analysis and research on a broad range of security and risk management topics (CSOonline.com) recently* checked in with dozens of IT security professionals (ironically, using more than one social networking platform to do so) to pinpoint seven typical security mistakes people make; and how to avoid them.

1. Over-sharing company activities
This is a sin of pride, when someone gets excited about something their company is working on and simply must tell everyone about it. Maybe you work for a drug company that is on the verge of developing the cure for cancer. Maybe the company is developing a new car that runs on curbside trash -- in other words, something everyone will want.

By sharing too much about you or your employer's intellectual property, you threaten to put it out of business by tipping off a competitor who could then find a way to duplicate the effort or find a way to spoil what they can't have by hiring a hacker to penetrate the network or by sneaking a spy into the building. To reign in the urge to share too much, it might be useful to repeat this saying, which has started to appear in the public domain: "Loose Tweets Sink Fleets."

2. Mixing personal with professional
This sin is closely related to the first, but extends beyond the mere disclosure of proprietary data. This is the case where someone uses a social network for both business and pleasure, most commonly on Facebook, where one's friends include business associates, family members and friends.
The problem is that the language and images one shares with friends and family may be entirely inappropriate on the professional side. A prospective employer may choose to skip to the next candidate after seeing pictures of you drunk or showing off a little too much leg at someone's birthday party. In sharing such things, you also stand a good chance of making the company you represent look bad. You have to understand what the objective of your presence on any given social network is. If it is for work, keep it for work only. If it is for personal/fun use, keep it for personal use only.

3. Engaging in Tweet (or Facebook/LinkedIn/Myspace) rage
For the person who has just been laid off or had their professional integrity called into question online, the urge to fire back with a stream of vitriol can be irresistible. Call this a sin of wrath.

Be mindful of what you say; any and all parties are listening, including your boss, spouse or future employer. Posting any content when angry is about as dangerous as sending flaming emails, if not more so. Think twice about clicking 'submit' because the world may be looking at your angry, immature rant for years.

4. Believing he/she who dies with the most connections wins
For some social networkers, it's all about accumulating as many connections as possible. Folks on LinkedIn are notorious for doing this, especially those in such LinkedIn groups as TopLinked and LION. This may seem harmless enough or, at the worst, just annoying. But when the name of the game is quantity over quality, it's easy to link or "friend" a scam artist, terrorist or identity thief.

Always verify the person who wants to get in contact with you. If you do not know the person, why are they trying to connect with you? Check if the profile of the other person is secured. If you can't retrieve a list of that person's connections, you have to ask yourself if you really want to go down that road. It is far better and safer to have 50 relevant contacts than 500 unknowns.

5. Password sloth
Another common sin is one of laziness, in this case picking passwords for your social networks that you're least likely to forget. In many cases, that means using the same password for LinkedIn and Facebook that you're using for your online bank account or work machine. If someone with malicious intent figures out the password for one social network, that person can now go and access everything else.

Using the same password on several sites is like trusting the weakest link in a chain to carry the same weight. Every site has vulnerabilities, plan for them to be exploited.

6. Trigger finger (clicking everything, especially on Facebook)
Facebook in particular is notorious as a place where inboxes are stuffed with everything from drink requests to cause requests. For some social networkers, clicking on such requests is as natural as breathing. Unfortunately, the bad guys know this and will send you links that appear to be from legitimate friends. Open the link and you're inviting a piece of malware to infect your machine. You should not click any link unless you're ready to deal with drive-by downloads and zero-day attacks.

7. Endangering yourself and others
All of the above tie into the seventh and perhaps most serious sin, which is that reckless social networking can literally put someone's life in danger. It could be a relative or co-worker. Or it could be yourself. Security experts advise extreme caution when posting birthday information, too much detail on your spouse and children, etc. Otherwise, they could become the target of an identity thief or even a kidnapper.

At the CSO Executive Seminar on Data Loss Prevention in Chicago, last month, Motorola CSO Bill Boni expressed his reservations about using Twitter, calling it a great way to get one's self kidnapped. "Don't be a twit," Boni said to those who might feel the need to divulge every detail about their location and what they're doing.

* adapted from an article by Bill Brenner, Senior Editor, CSO June 30, 2009

And lest we forget…

On this day, 234 years ago, yes July 4th, 1776 this great nation, the United States of America, struggling for what was right and free, was proudly born.
May we celebrate that precious freedom for which our forbears fought and young men and women today continue to fight so bravely for...
the freedom that is inherent in the Stars and Stripes, our revered flag...

Celebrate Freedom this Fourth of July!

and remember

Freedom Is Never Free!

5 STEPS TO EFFECTIVELY REDESIGN YOUR WEBSITE

If it has been a while since you designed your website, or the site doesn’t seem to be attracting the same level of interest among customers and prospects, it may be time to refresh it. The following 5-step plan may help.

1. Determine who will lead the redesign effort. Look beyond your in-house Internet/Web technicians and/or consultants to advise you about your next redesign. For a redesign you may want to consider some more independent ideas from others in the field to get different and fresh ideas, not burdened with the ties to the past.

2. Consult Stakeholders. Your redesign should start by asking questions of others, especially customers, about how they would change the website if they could. By gathering ideas of others up front, you will have better insight in to what changes will benefit current as well as future stakeholders.

3. Set measurable and realistic goal. Because a single website can not be all things to all people, it is important to first determine what the primary purpose of the website is. Knowing this will help in setting appropriate goals for your redesigns.

Determine what you want the redesign of your website to accomplish. For example, do you want to improve the site’s stickiness (how long viewers stay on the site before clicking off)? Improve the site’s searchability (ranking with major search engines)? Add functionality (map and directions, printable coupons, contact forms, etc.)?

Once you have goals in mind, write them down. Undocumented, ill-defined goals provide no focus or direction for the redesign effort. You need enough detail for the effort to get started, allowing your web developers to bring their creativity and expertise to the task.

4. Get the talent from either in-house or an outside vendor. Graphics, web development, quality assurance, end-user interface, search optimization, and other factors should be considered. You need to ensure that the web development team has the skills necessary to accomplish your redesign goals.

5. Understand the latest technologies and how they can help. Technology is constantly changing. The current rage seems to be social networking, flash, audio, and video. None of these technologies were in the forefront two years ago and you can bet there will be other technologies on the back-burner that will be the buzz a year or two from now. Remember that there is accost to employing the latest technologies; costs involving money, time and performance. While your website may not need to employ expensive, top-of-the-line technologies, be sure it doesn’t appear to customers that your website is stagnant or outdated while your competitors’ sites are zooming past.

Know when not to redesign. If your stakeholders say your website is fine the way it is, you have had few if any complaints, and it is cost-effective and functional as is, then a redesign probably isn’t needed at this time. You should however, periodically check with key clients to determine the effectiveness of your website.

Usual Costs. As noted in a recent Info-Tech Research Group (an IT research and consulting company) report, an effective website redesign can cost upwards of $5,000 or more. Costs however vary widely depending on the type of redesign and technologies used. The report also noted to be wary of redesign bids that sound completely unreasonable for your requirements.

For many companies, their websites are their store windows and it is important that their websites convey the brand image desired. If it doesn’t, consider a well defined and expertly developed redesign, and reap the rewards.

Based on an 6/14/10 Phila. Inquirer article

PRACTICE WHAT YOU PREACH

Back in April of 2009, I posted an article entitled “Spring Cleaning Your Website” on this Blog. Well, I am here to say that I am finally practicing what I preach. When I started APT Web Design (AWD), one of the first websites that I produced was one for my own business (apt-webdesign.com); the site was launched in September of 2006. Well, that was three and a half years ago and only now have I finally gotten around to updating that website.

Since APT Web Design has been in business, about 50% of our clients had existing websites and for various reasons wanted a do-over. Interestingly, two clients actually wanted to drop eCommerce from their sites because they said it was more hassle than it was worth. Of the clients desiring a facelift for their websites, the look-and-feel of their sites had not been updated for an average of three to four years. That puts me right on average for a do-over.

It was not that I was unhappy with the look and feel of the AWD website, I just knew it was time to make some changes and in doing so, provide, as minimal as it is, a somewhat different look and feel. I retained the same basic color scheme, but went from a rounded-corner layout to a bordered-box format. Since I started thinking about a website refresh, other changes came to mind. I also broke out my blog-link and affiliate links from being buried on the About Us page to a link in the main menu on every page. And, I added an FAQ page to hopefully make more information about websites and how AWD operates to both current and prospective clients.

So now, having completed my modest website make, I have both a sense of accomplishment as well as the satisfaction that I indeed have practices what I’ve preached.

Take a look: apt-webdesign.com

      :~) Les..

It’s a scary world out in the World Wide Web

Here Are the Top 20 Shocking Scam Tricks:

• Email scams: One in 304 emails that are sent to us contains a virus and one in 404 is a phishing message.


• A scan of 22 million PCs by security firm Panda Labs in the second quarter of 2009 showed that just short of 12 million of them were infected. There's no way of knowing, but if the same proportion applies elsewhere, that means over half of PCs worldwide could be infected with viruses, Trojans, spyware and other malware. The biggest single category of infection is by banking Trojans and password stealers.


• The most phished organizations (that is, those who were targeted or used in phishing scams) are, not surprisingly, banks and credit unions. But this year, according to a spam/scam study called Project Honeypot, the social networking site Facebook, currently in second slot behind J P Morgan Chase, is predicted to become the biggest single vehicle for phishing.


• According to the Consumer Federation of America, one third of all adults have at some time been approached with scams (as distinct from, say, having their identity stolen). Lottery cons are the most common, followed by bogus grants and work-at-home schemes.


• The typical victim of a lottery money scam loses around $3,000, usually for supposed tax, administration or Customs fees, while those who fall for advance fee scams lose, on average, up to $4,000. The average identity theft victim gets taken for $5,000.


• Scammers profile their victims -- they know who makes the best target. For instance, a woman aged 70-plus is the most common target for a lottery scam, while a man in the 55-61 age range is the most common investment fraud victim. However, the age group that attracts the most scams is the 30-39 year olds.


• Almost two-thirds of people incorrectly believe a check is valid if a bank pays out funds on it. (It's not, and if the check subsequently bounces, the account holder is responsible for repaying any money they withdrew.)


• On average, 3,500 new sites harboring malware are set up every day. Online security experts McAfee reckon there are now more than 1.2 million different types of Internet malware.


• Up to 45,000 people contact the Federal Trade Commission -- the US agency responsible for preventing and halting consumer fraud -- with complaints every week.


• In 2008 -- the last year for which full records are available -- 275,000 Americans told the FBI's Internet Crime Complaint Center they had been scammed out of a total of $265 million. Non-delivery of merchandise and auction fraud accounted for 60% of this.


• However, this is only the tip of an iceberg. 10 million people were said to be victims of identity theft, losing more than $48 billion -- yes, that's "billion" -- a year. According to the Federal Trade Commission (FTC), a total of 30 million Americans ages 18 and older, or 13.5% of the U.S. adult population, were victims of consumer fraud of one type or another during a one-year period.


• Half of all identity thieves in a recent study came from a middleclass background, had a college education and an otherwise conventional lifestyle. Most of them had jobs and their main motivation was to buy luxuries. In other words, they're not all serial crooks or drug addicts.


• More than 3,000 fraudulent IRS tax agency websites were taken offline by law enforcement action last year. And, in 2005, before Hurricane Katrina even made landfall, there were 200 phony Katrina aid websites. In a recent intervention, the Nigerian Government shut down 800 fraudulent sites.


• 79% of all email in the US is spam. But the nation is only Number 7 in the spam league. Britain comes top with 94%, then China (90%), Hong Kong (89%), Australia (88%), Japan (86%), and Germany (83%). The Netherlands is 8th (78%) followed by Canada (77%).


• China is the world's biggest spammer, accounting for more than 11% of messages, followed by Brazil, the US and Turkey. Most spams are sent out by compromised "zombie" PCs whose owners are unaware they are being used -- up to 400,000 zombie machines are activated every day. In the US, California is the most prolific state as a source of spam.


• An estimated total of 125 trillion spam messages have been sent out in the past five years, says Project Honeypot. Monday is the busiest day for spam, and Saturday the least busy. 8am EST sees the highest volume during any day.


• In a survey by the Messaging Anti-Abuse Working Group, one third of North American Internet users admitted they've replied to spam. The most common excuse is that they did it in error but some confessed either interest in the product or just wanting to see what happened.


• An estimated 40% of Internet users enter the same password for every protected site they visit.


• The scam ratio for work-at-home jobs posted online is 59:1. In other words, out of every 60 advertised jobs, only one is genuine.


• Almost 200 million phone numbers are listed on the "do not call" register but last year alone more than 7 million people complained that telemarketers called them anyway. Arizona has, proportionate to the population, the highest level of complaints and Colorado has the highest proportion of registrations.
  To register or for more information, visit the Do Not Call site.

Not a pretty picture is it? But it's not all gloom and doom. Thousands of organizations, including Scambusters, official government agencies and crime fighting groups have joined the battle against online fraud.

Taken from ScamBusters,org Report Issue #375, 02-17-10

Some Tips to Get Repeat Visitors to your Website

Getting traffic to your website is hard work and can be expensive. So it's cost-effective to get repeat visitors not only first time visitors. Getting repeat visitors is all about giving value to your visitors. You need to give them what they ask for, what they are searching for, and then dazzle them when they get to you. That way, they will come back for more time and again.

So how can you please your visitors so they return to your site?

Here are a few suggestions:

1. Keep your site fresh; update the content on your frequently. Dormant sites are dropped by some search engines as well, which will reduce all your traffic anyhow.

2. Offer extra value to your visitors; you can identify related complementary sites and put links to these additional products and services. Ask those sites to do the same for you. You can also advertise books and videos that relate to your business and are not in competition with your own offers. And, you can offer printable discount or special offer coupons that your website visitors can use.

3. Encourage your visitors to bookmark your site; provide a button that will pre-fill an “Add to Favorites” on your visitors’ PC.

4. Add a link to your blog or other social networking site. Blogs or other social networking sites can draw visitors if you are willing to provide content to these.

5. Brand your website with a friendly, attractive scheme, so that visitors always recognize when they are on your site's pages. Use a clear logo and consistent 'look and feel'. Always include a 'Contact Us' link in your navigation bar.

6. Create a 'Terms and Conditions' page that clearly defines your business principles. Have a privacy policy too, so visitors know what happens to their data on your site and that they are secure from spam when they opt-in.

7. Create a Frequently Asked Questions page which answers most of the concerns about your business, product or services that people generally ask. This helps to allay the main doubts people have when they first visit your website.

8. Use clear titles and keywords and a clear navigation so that your visitors can find their way back to your site if they lose their bookmark.

Visitors will come back if they like your products and see that your site is fresh and even more so if there's a different offer from time to time.

Based on info from Jay Allyson - Pro Marketing Consultant

PROVERBS /For some levity after a tough winter/

Half of those reading this will probably believe only a third of what they read)

1. A day without sunshine is like night.

2. On the other hand, you have different fingers.

3. 42.7 percent of all statistics are made up on the spot.

4. 99 percent of Politicians give the rest a bad name.

5. Remember, half the people you know are below average.

6. He who laughs last, thinks slowest.

7. Depression is merely anger without enthusiasm.

8. The early bird may get the worm, but the second mouse gets the cheese in the trap.

9. Support bacteria. They're the only culture most people have.

10. A clear conscience is usually the sign of a bad memory.

11. Change is inevitable, except from vending machines.

12. If you think nobody cares, try missing a couple of payments.

13.. How many of you believe in psycho-kinesis? Raise my hand.

14. OK, so what's the speed of dark?

15. When everything is coming your way, you're in the wrong lane.

16. Hard work pays off in the future. Laziness pays off now.

17. How much deeper would the ocean be without sponges?

18. Eagles may soar, but weasels don't get sucked into jet engines.

19. What happens if you get scared half to death, twice?

20. Why do psychics have to ask you your name?

21. Inside every older person is a younger person wondering, 'What the hell happened?

22. Just remember -- if the world didn't suck, we would all fall off.

23. Light travels faster than sound. That's why some people appear bright until you hear them speak.

24. Life isn't like a box of chocolates. It's more like a jar of jalapenos. What you do today, might burn your butt tomorrow.

--= Source: Unknown =--