Category: Security


WhyMicrosoftThe moment I almost forget what a pain Windows 10 is, this message pops up on my PC.  Why did you have to ask me this question again, Microsoft?  Why must you remind me of my suffering?  All the details of what I have experienced are too much to cover in a single blog, so I will do my best to focus on the big issues.  As such, I won’t be whining about Windows 10 not consistently recognizing my finger, but that is a common theme here.

Nor will I spend the time rehashing various feature disruptions associated with forced updates to the degree that they deserve.  Most notably, Bitlocker comes to mind, but I cannot bring myself to go there in any significant detail. Suffice it to say that when I lost access to my encrypted Bitlocker drive due to an update, the documented fix required reinstalling an older version of Windows 10 to recover my data.  I chose to buy another hard drive since it was less complicated and time-consuming.

At one point in January of this year, I estimated that the combined dysfunction of Windows 10 and Office 365 had cost me at least two full days of productivity for my own system, never mind other people that I provide support to.  In that month alone, I personally spent over an hour a day on average dealing with issues that you would never see on a Windows 7 PC running a non-365 version of Office.

As an IT professional with thirty years of experience, I can honestly say that the Windows 10 operating system (OS) may be the most intrusive and unreliable OS ever created by Microsoft.  Computers and operating systems are intended to make our work lives more efficient and less challenging, not less efficient and more challenging.  On a regular basis, Windows 10 and its cohort, Office 365, thwart productivity through seemingly incessant and meaningless updates performed in the almighty name of compliance and security.

artificial-intelligence-155161_640

Even the most basic functionality of turning off your computer is challenged by the HAL-like behavior of this OS.  On my way out for a recent Thanksgiving road trip, I attempted to shut down my PC (four times).  Each time, my PC appeared to shutdown it came back on again.  It was clearly going to do this ad infinitum, which led to a few expletive laden Google searches like, “Windows 10 will not $&%#ing shut down!”

This is not the first time I have seen this particular issue in Windows 10 or similar quirky bugs like the black screen issue, so my patience was tested.  Eventually, I rediscovered and used the “hold the left-shift key and shutdown” method to wrestle my insubordinate PC into submission, then for good measure I actually unplugged it too.  Let’s see you restart now, Windows 10!  Thankfully, it didn’t.

Sure, this OS looks good on the surface, and in some ways it is better than its predecessor, but there are some major drawbacks.  For example, trying to use an app arbitrarily deemed as “not stable” or “incompatible” results in Windows 10 uninstalling that app without users’ permission.  Windows 10 won’t necessarily remove the app as soon as you install it, but when Windows applies updates again, it will remove the offending app and does not notify users.

Want to postpone an update or set the time updates are supposed to occur? … Go ahead.  There are settings for that, but whether you go through the exercise of configuring those settings or not, Windows 10 pretty much seems to do whatever it wants to do when it wants to.  I feel like I have lost control of my computers that run Windows 10.  Microsoft is in charge of them now and decides when and how I can use them.

If you have a critical online meeting, work that needs to be done right now, or a plane to catch, you can almost count on Windows 10 attempting to update or do some other thing that doesn’t need to be done at that exact time.  I don’t know how it does this, but it does.  It could just be that it is always doing an update.  In a nutshell, if you are familiar with the printer in the movie Office Space, Windows 10 is that printer.

Given my experiences, recommending this OS to anyone before they felt that they truly needed to move to it would be willfully irresponsible.  That said, I suspect there is a small contingent of users that Windows 10 helps stay out of trouble.  I know some of those people, but the masses should not have Windows 10 on their computers when there are other more reliable – as defined by computers that do what you want them to do when you want them to do it – alternatives.

Many of my financial services customers have likely moved to Windows 10 or plan to move to Windows 10 in the future.  For those businesses where compliance and security are paramount, staying the course on an aging OS like Windows 7 will become more difficult, given that Windows 10 is widely perceived as being more secure.

Understandably, for corporate use Windows 10 may just be a desktop environment that is used to gain access to a more secure and redundant cloud environment.  As such, the pain points I describe related to Windows 10 could be less of an issue for these users.  However, consigning users to Microsoft’s decisions about how they can use their PCs at any given time is scary.

Ultimately, the path Microsoft is on with Windows 10 is either headed toward total authoritarian rule over personal computer systems, or toward the eventual demise of Microsoft’s stranglehold on the PC OS market in favor of a more agreeable and obedient operating system.

lord-of-the-rings-the-one-ring_800

By way of disclaimer, I am using Windows 10 Professional, but know that Windows 10 Enterprise LTSB, which will soon be renamed to LTSC in 2019, follows the more traditional release policy and is not updated with the frequency of Microsoft’s other versions of Windows 10.  Based on my experience to date with Windows 10 Professional, the Enterprise LTSB product would probably be a much better user experience.  Also, related to Windows updates, my advanced options are set to Semi-Annual Channel (Targeted) with the option to defer feature updates by up to 180 days and security updates by up to 30 days.  I realize that I could gain a greater level of reliability and reduce the problems I experience by changing to the straight Semi-Annual Channel, which would delay feature updates by an additional 4 months.  My opinions are the result of using Windows 10 as both my primary desktop and notebook OS for the past two years.


About the Author: Kevin Shea is the Founder and Principal Kevin Shea Impact 2010Consultant of Quartare; Quartare provides a wide variety of technology solutions to investment advisors nationwide.

For details, please visit Quartare.com, contact Kevin Shea via phone at 617-720-3400 x202 or e-mail at kshea@quartare.com.

HourglassWindows XP was a mainstay at many financial services firms for nearly a decade.  In keeping with the Microsoft Lifecycle Support Policy, support for Windows XP and similar aged software must eventually end.  You can learn more about the policy here.

According to Microsoft, extended support for Windows XP is scheduled to end on 04/08/2014.  If your office is using Windows XP, you should be working on plans to phase out XP by replacing those systems with new PCs or upgrading the PCs to a more recent workstation operating system in the next six to nine months.  There is no good reason to wait until or beyond April 2014 to perform these upgrades.

Why should you care?

Most security standards – for instance, 201 CMR 17.00 – require that you apply security patches on a regular basis.  It is the extended support from Microsoft that allows you to do this.  After extended support has ended, there is no guarantee that any security patches will be released for these systems.  In order to stay compliant with security standards, firms using Windows XP will need to upgrade to other systems.

Hasta la vista, Vista!

androide

Currently, we are recommending that business users implement Windows 7 Professional on workstations.  Windows 8 makes sense for home users with touch screens, but we prefer not to implement operating systems before they have become mainstream in the workplace; Windows 8 just isn’t there yet.

Vista extended support is good through 04/11/2017, but Vista has always been a dog, and any business users still using Vista should strongly consider moving to Windows 7 Professional immediately.

Server-based systems affected by the Microsoft Lifecycle Support Policy

Windows 2003 Server extended support is good through 07/14/2015.  Nevertheless, Windows Server 2008 R2 will likely be the most widely used network operating system among investment advisors by the end of 2013.  Windows Server 2012 was released on 09/04/2012 and hasn’t yet been widely implemented among SMBs we are familiar with.

Exchange Server 2003 extended support also ends on 04/08/2014.  The implications of this related to security updates are the same as those detailed above regarding XP.  If you know which version of Exchange is in use at your office, you can check Microsoft’s site here to determine when the end of extended support for Exchange will affect your firm.

Like Vista, extended support of Exchange Server 2007 is good through 4/11/2017, so there is no need to upgrade in the near term future.  Exchange 2010 adds OWA support for Firefox and Chrome.  In addition, Exchange 2010 makes better use of lower-cost disk subsystems, allowing you to get a performance boost over 2007 without spending a premium.  Those are nice features, but not nice enough to push an Exchange upgrade before a normal IT lifecycle replacement demands it.

Exchange Server 2003 will be phased out by many advisors this year, and most will move to Exchange Server 2010.  Though Exchange Server 2013 was technically released in November 2012, it may be premature for the SMBs that dominate the investment industry to adopt Exchange Server 2013 over Exchange Server 2010.  Presently, there is no direct migration path from Exchange 2003 to Exchange 2013.  A number of small investment advisors will move to hosted Exchange solutions and no longer keep Exchange servers at their offices.

With this many possible changes slated for the next ten months, now is a good time to make sure your firm has addressed the issues or has a plan to upgrade any systems affected.

About the Author: Kevin Shea is President of InfoSystems Integrated, Inc. (ISI); ISI provides a wide variety of outsourced IT solutions to investment advisors nationwide.

For details, please visit isitc.com, contact Kevin Shea via phone at 617-720-3400 x202 or e-mail at kshea@isitc.com.

iStock_000009182001XSmallIn a day where security threats are constantly evolving and your business is reponsible for keeping confidential information secure, your clients’ computer systems may seem an unlikely place to prod your nose, but unfortunately, an increasing number of security threats are originating from the clients of investment advisors.

One recurring example that we have witnessed over the past year, is the hacking of email accounts.  In this scenario, your client’s email account with Google gets hacked because their password is “patriots1” or perhaps their PC has been infected with a keylogger virus.  In any event, a hacker somehow discovers your client’s password and now has access to their historic email records.

In the past, hackers might have been satisfied to use that account to SPAM everyone on earth, but today’s hackers are more sophisticated.  Apparently, they’ll actually take the time to read through your client’s emails in search of financially sensitive information.  Based on the content of previous communications with your firm, they can compose a similar looking email to one that the client might have sent in the past to ask your staff about total holdings or even request a check.

Here are some tips your clients should follow to keep their email and other accounts secure:

  1. Don’t enter your passwords in kiosks and other systems available to the public.
  2. When you get the option to store the password for various accounts and websites on your PC, don’t do it.
  3. Never send your passwords in an email.
  4. Use encrypted email connections.
  5. Institute complex passwords.  I know it’s a pain, but so is having your identity stolen.
  6. Don’t use the same passwords for multiple accounts.  Yes, this is a pain too, but there are some programs like eWallet that can help.
  7. Run up-to-date versions of security software that include protection for spyware, malware and viruses.  Don’t ignore messages from your Antivirus program.
  8. Stay up-to-date on operating system and application security patches.
  9. Be cautious of which sites you browse.  A program like openDNS can help you keep your computers clean by limiting access to potentially harmful websites.  The home version of OpenDNS is free.  You can find it at www.opendns.org.  Antivirus programs like AVG and Symantec can filter websites too, but do it with less specific controls.

Here is what your clients should to do if they do get hacked:

  1. Contact a computer professional or the email provider to help determine how you got hacked.
  2. Alert your investment advisor and other vendor relationships that hackers could try to take advantage of.
  3. Resolve any issues that may have led to the hack, such as: simple passwords, malware, spyware, and viruses.
  4. Change your passwords and any hints from a computer system, smart phone or the original system once the threats have been removed on the following: the hacked site, any other sites where you used the same username and password and any sites whose information you stored in the hacked account.
  5. If you determine that you have been a victim of spyware or malware, you will need to change all your passwords for your online accounts and follow the procedures for recovering from identity theft.
  6. If you cannot follow any of these steps because your account credentials have been changed, you will need to contact the company providing that account in order to regain control of your account.
  7. Implement better security provisions going forward.

There is only so much you can do to protect your clients.  Ensuring that email communications are secure should be at the top of the list. Your firm can implement a product like Zixmail to encrypt selected emails, but at the point where your client’s computer system has been compromised, this may only provide an additional deterrent, and should not be seen as the solution to the problem.

The best course of action is a combination of staying vigilant, educating your clients, implementing best-practice email security, and instituting additional internal controls aimed at how your firm handles client communications, such as balance and check requests.

About the Author: Kevin Shea is President of InfoSystems Integrated, Inc. (ISI); ISI provides a wide variety of outsourced IT solutions to investment advisors nationwide.

For details, please visit isitc.com, contact Kevin Shea via phone at 617-720-3400 x202 or e-mail at kshea@isitc.com.

Unless you live in a cave, you have probably heard lead-ins to the story from reporters,  “Enjoy the Internet while you have it.”  These reports make reference to Monday, July 9th, 2012 as Internet Doomsday.

Here is what you should know about the threat:

  1. It isn’t new.  This malware has been around for a while.
  2. If your PC is serviced regularly, and your antivirus program is active, it is unlikely to be a problem.
  3. There is no impending attack.  Potential outages will actually be caused by the FBI taking temporary DNS servers offline.  If your PC is infected with this malware, then you will lose Internet access until the malware is removed and the proper DNS settings are restored.
  4. According to current reports, 360,000 PCs worldwide and 64,000 PCs in the United States (US) are still infected.  Per census data (July 2011) there are over 311 million people living in the US.  So there are a relatively small number of infected PCs here.
Nonetheless, you can go ahead and check whether your system has been compromised using the following link: http://www.dns-ok.us/

 

Since servers in the corporate environment typically provide DNS information to the connected workstations in an office, your office DNS servers should also be checked. For more details on this issue, refer to the FBI article.

About the Author: Kevin Shea is President of InfoSystems Integrated, Inc. (ISI); ISI provides a wide variety of outsourced IT solutions to investment advisors nationwide. For details, please visit isitc.com, contact Kevin Shea via phone at 617-720-3400 x202 or e-mail at kshea@isitc.com.