I discovered a third use for the iPad

Last fall I wrote that after six months of experimenting with the iPad, my conclusion was that it was primarily good for just two things — reading and Scrabble. But, in order to be fair and to make room for some of the other possibilities, I officially noted the two-fer as:

1. Reading and viewing
2. Multi-touch interaction

So, basically, reading and games. (Read the article The truth about iPad: It’s only good for two things for the full explanation.)

Well, in the second six months of using the iPad — leading up to the release of the iPad 2 earlier this year — I discovered a third use for the iPad. And, this one thing has unlocked a lot more value in using the iPad as a business tool.

The third use? Note taking.

As it turns out, the iPad makes a terrific notebook — in the traditional sense. For me , the iPad has completely replaced the need for a pen and a pad of paper in meetings. I now take all my notes electronically with the iPad and can quickly and easily do several different things with the notes afterward:

• Turn the action items into tasks or calendar items
• Sync the notes to a laptop or smartphone for later review
• Edit the notes into a recap to send to colleagues

The value of no longer having a bunch of notepads and loose slips of paper is obvious. And, the advantage of immediately having all of these these notes in electronic format — instead of having to convert some of them to electronic formats later — is easy to see. But, there are also a couple other factors that make it better to use an iPad for note taking.

First, while I could easily do the same type of note taking with a laptop or a netbook, there’s something a lot friendlier about doing it with a tablet. If you’re in a conference room or a 1-on-1 meeting and you flip open a laptop to take notes then you close yourself off from the other person(s) in the room. With a tablet, I can just flip open the tablet, lay it flat on the tablet, take my notes, and then flip it closed again. It feels about the same as taking paper notes while talking to someone in a meeting.

I could also accomplish this kind of note taking with a smartphone — and I occasionally do when I don’t have a tablet with me — but because of the larger display and larger on-screen keyboard, typing notes on a tablet is faster and usually has fewer typos. The tablet also allows you to thumb-type when holding the tablet in portrait mode or to put it in landscape mode and type like you would on a computer.

The other factor that can make this scenario better than either old style paper note taking or PC word processing is the cloud. Using apps and services like Evernote and Dropbox (with the help of iA Writer), you can take notes on your iPad and have them immediately sync back to your PC or Mac so that they’re ready for you to work on when you get back to your desk. The challenge with this, obviously, is security. You wouldn’t want to save sensitive company information on public services like Evernote or Dropbox. For sensitive information, I’d recommend using a program you can sync locally like Apple’s Pages word processor or the iPad’s built-in Notes app. Another option is to use the Mail app to take your notes in a mail message and then email it to yourself when the meeting is over.

However you prefer do it, note taking is now one of the leading business functions of the iPad. It’s one of the reasons why the iPad has become a preferred tool for many people who spend a large chunk of their time in meetings, especially executives, project managers, and sales people.

Resume tips for experienced IT pros

You’re an experienced IT professional. You’ve been around the block and done it all. You think your resume is packed full with great stuff because years ago, you read all the articles on how to build the perfect resume and you’ve been following most of that advice ever since. Any employer should take one look at your resume and hire you on the spot, right?

That’s what I used to think too. I’m not a resume expert, but I thought I had a killer resume. Then, three potential clients in three month’s time nixed me because they thought I was “light” in areas where I was actually a specialist.

If that isn’t a wake-up call, I don’t know what is. So I called a close friend of mine, who is an IT manager at a large company. He knows my abilities, he’s an IT geek at heart, and he’s seen a ton of resumes. He looked at my resume and said, “Yep, I’d have thrown it right in the trash.” I called a couple more friends in similar positions. “It could use some improvement,” one of them told me. Ouch. At least they were honest. Basically, I had a resume that would sell me as an administrator or engineer, but not as an architect or consultant, which was the type of work I was looking for.

I began gathering comments and suggestions from these guys and completely rebuilt my resume from scratch. What I learned in this process is that building a resume for experienced IT professionals who want to land higher-level IT jobs is quite different from building the average resume to land entry-level administrator jobs.

I am going to share eight resume tips that sum up what I have learned.

Resume pointers

Most of the standard rules for building a resume still apply: Make sure you have a readable format, proofread for spelling and grammar errors, keep it simple, etc. However, experienced IT pros need to follow some more specialized guidelines. A few of these tips may actually contradict your previous notions of what to include (and exclude) on your resume. They certainly contradicted mine.

• Keep your list of “core skills” short and sweet. When you’ve worked with a lot of different technologies, you want to show the world all you’ve done. However, having a long list of core skills actually gives the impression that you know only a little bit about most of those things and that you’re a generalist, not the specialist that the potential client/employer needs. Keep this list to a handful of key skills or possibly eliminate the list altogether.
• Don’t list certification exams. At the very least, minimize the impact of this list. The average IT pro might want to list exams passed to build up a resume, but for the IT veteran, this actually marginalizes real-world experience and accomplishments.

• Quantify projects and results. For example, if you do an Active Directory implementation, specify how many sites, domains, and servers were involved. If you design an e-commerce system, specify the increased percentage of sales that resulted from the project. Tell the potential client/employer exactly how you helped a previous company that you worked for.
• Bullets, bullets, bullets. Don’t use paragraph style writing to describe your projects, tasks, and duties. Bullet-point every major accomplishment or project and leave out the minor things. (Your resume is already going to be too big anyway.)
• Include examples of work, if possible. For instance, maybe you’ve written articles for an online magazine, or perhaps you built an e-commerce site. Include links to pertinent examples so potential clients/employers can see firsthand what you do.
• Highlight major accomplishments. If you’re a high-tech consultant, you may have a lot of smaller projects and clients. Maybe you were hired as a “grunt” for a couple of short-term assignments but had a major project last year. You can’t exclude the small stuff, or potential clients/employers will question what you’ve been doing. But you can minimize the impact by focusing attention on the bigger things. Some ways of doing this include using a slightly larger font, boldface, or italics, or even drawing a thin border around the major accomplishments. But don’t go overboard-subtlety is still key.
• Seek advice from actual managers. Recruiters, agents, brokers, and human resource personnel are all different from managers. Managers want to see results, and they usually know how to spot a weak candidate. If managers think your resume reflects someone who can’t do the job, you’ll never get anywhere. Run your resume by some managers you know and have them critique it for you.
• Know when to stop. If you list all your experience from all the jobs, contracts, or projects you’ve handled, your resume will be more like a book. Find a place to stop listing your experience. If you feel you must at least acknowledge previous experience, try making a separate section and just bullet-point where you worked and what your title/function was. Of course, you’ll usually want to do this only for the less-accomplished jobs that you don’t want to highlight on your resume.

Five tips for freeing up PC hard disk space

Even though many PCs today come equipped with multi-terabyte hard drives, I am often amazed by how often I get calls from friends and family because they are running out of hard disk space. That being the case, I wanted to share some tips for freeing up some of that space. NOTE: Before you attempt to use any of these techniques, you should perform a full system backup.

1: Clear application caches

If you want to free up hard disk space, you should start out by clearing any application caches that might exist. Application caches can contain a lot of data. For example, some older versions of Internet Explorer are designed to consume up to 10% of your total hard disk space with temporary files. Newer versions use a default cache size of 50 MB.

A better example is a video editing application I frequently use. This application caches all source video files. The last time that I cleaned out the cache, I managed to recover almost 200 GB of disk space.

2: Look for signs of disk corruption and system upgrades

Hard disk corruption and operating system upgrades can both cause disk space to be wasted. I recommend opening a command prompt window and executing CHKDSK with the /F switch. This will cause Windows to scan the hard disk for corruption and repair any problems that it might find. (Be sure to make a backup first.) In certain situations, this can free up quite a bit of disk space.

Even if no corruption is detected, that doesn’t mean that no corruption has occurred in the past. When CHKDSK encounters files that can’t be repaired, it stores the file fragments in .CHK files. Unless you are attempting to recover lost data, you can safely delete any .CHK files you find on the system. While you’re at it, you might also look for temporary files (.TMP files) and log files (.LOG files), both of which can usually be safely deleted.

Another thing to check for is an old Windows installation. If Windows is reinstalled (or if a new version of Windows is installed) from outside the Windows operating system, Setup will attempt to preserve the previous operating system by creating a folder named Windows.old. As long as you don’t need anything from the previous Windows installation, you can safely delete the Windows.old folder.

3: Run Disk Cleanup

Desktop versions of Windows come equipped with a tool called the Disk Cleanup Wizard. It searches the system for unneeded files that are safe to delete (such as memory dump files). You can run the Disk Cleanup Wizard by opening My Computer, right-clicking on the drive you want to clean, and choosing the Properties command from the shortcut menu. When the drive’s properties sheet opens, click the Disk Cleanup button on the General tab.

4: Look for unneeded applications

Almost every new PC includes a ton of trial applications and nagware that are installed by default. I always recommend blanking the hard drive on a new PC and starting with a clean Windows installation, but often times I encounter PCs that are still running the factory configuration.

In these situations, you can go through the Control Panel and remove any of the trial applications that are not being used (as well as the nagware). While you’re at it, check for any other applications that might have been installed by the system’s owner but that are no longer used.

If the system contained a Windows.old folder, there’s a good chance that there are also application remnants in the Program Files folder. These remnants won’t appear in the Control Panel because the applications were installed on the old operating system. The only way to get rid of them is to manually delete them from the Program Files folder.

5: Remove manufacturer partitions

In addition to all the trial applications and nagware that manufacturers install on PC hard drives, PCs usually contain a recovery partition. This partition exists so that the PC can be reset to factory defaults in the event of a problem. In some cases, it may be possible to delete the recovery partition and then merge the empty space with another volume on the system. I prefer to just back up the system, delete all the partitions, create one big partition, and then restore the backup.

Of course, if you get rid of the recovery partition, you can’t use it to rebuild the system. As long as you have a Windows installation DVD, that shouldn’t be a problem (unless you actually want some of the applications that are loaded on the system by default). The recovery partition is often outdated anyway. For example, if a system shipped with Windows Vista but has been upgraded to Windows 7, the recovery partition will contain an outdated operating system (Vista).

Don’t forget to defrag

All of these techniques have the potential to recover quite a bit of lost hard disk space. Any time you manage to recover a significant amount of disk space, it is a good idea to defragment the system afterward.

Stop being duped by the 3D scam

The 3D gimmick has sadly infiltrated movies and television and is now threatening to infect video games and smartphones as well. There’s only one reason why the entertainment industry keeps relentlessly pushing this at consumers — it’s a transparent attempt to bleed more money out of people. And, while a lot of consumers have caught on to the scam, not everyone is doing enough to stop it.

3D is definitely NOT about innovation, as the industry would like you to believe. In fact, adding the current 3D effects to a movie or video of any kind subtracts from the picture. It muddies the colors and unsharpens the images, and it has to slow down the action shots because it makes people sick if things go too fast in 3D. In fact, optometrists estimate that up to 25% of people get headaches or nausea from simply watching 3D at all.

My first hint at the 3D scam was in October 2009 when Toy Story and Toy Story 2 were re-released in the theaters as 3D movies. My kids were excited to see Toy Story on the big screen for the first time so we gladly ponied up the extra money to see the 3D version of the double feature. We weren’t very far into the first movie before I realized that the quality of the colors and images were actually worse in 3D. That was a big disappointment. Even my kids said that the 3D wasn’t as exciting as they thought it would be. There went an extra $24 down the drain ($3 extra for 3D for four people for two movies).

Of course, the Toy Story movies were standard 2D movies that were converted to 3D (which is actually the way most “3D” movies are still handled). So, what about movies that are natively shot with special 3D cameras, such as Avatar? I’ll admit that when I first saw Avatar in the theaters I was impressed at how well it wove in the 3D effects. But, my admiration wore off once I saw it on Blu-ray on a 240Hz LED TV and quickly realized that all of the colors and action shots suddenly came to life and really popped off the screen. That’s when it fully dawned on me what a horrible scam 3D really is. They are making us pay more money for a gimmicky, inferior experience. Sure, there are a few neat moments in most 3D movies, but the novelty wears very off quickly and it’s certainly not worth the trade-off in picture quality or action sequences.

I had started to see this coming a little sooner, and I should have pounced on it. Back at the 2009 Consumer Electronics Show, I was dazzled by the new LED TVs that Samsung showed off at its big press conference. The images were so sharp and the colors were so bright that the picture almost felt three dimensional. Plus the TV themselves were amazingly thin.

The next year, at CES 2010, I was surprised to see all of the TV manufacturers including Samsung pushing TVs with 3D glasses. I immediately felt like this was a step backward. I didn’t want to mess around with watching TV with 3D glasses. I wanted to see more super thin TVs with amazing pictures (at even better prices) like the ones I had seen the year before. After consumers rejected 3D TVs in 2010, the companies tried to come back at CES 2011 and pitch “no glasses” 3D. I wanted to shake my head and do a face-palm every time one of these electronics vendors mentioned 3D.

This is a bad detour for the entertainment and electronics industries, and they stubbornly refuse to let it die. In fact, they keep trying to push 3D on us, since many of these new products have been in planning for a year or two (before consumers started catching on to the 3D scam). The movie industry and movie theaters try to force us to only be able to watch some of their top movies in 3D (and pay extra for it). TV makers are forcing 3D into all of their new top-of-the-line LED TVs (and trying to make us to pay extra for it). Content companies are now making their Blu-ray/DVD/Digital Copy bundles include 3D discs (and trying to make us pay extra for it). Game companies such as Nintendo are integrating gimmicky 3D into their new systems. Mobile computing vendors such as HTC and LG are even trying to put 3D into their smartphones and tablets.

There’s only one way to stop the madness. Avoid 3D whenever possible.

This is a bad experiment that the industry is forcing consumers to subsidize. And since they can’t create a better product, they’ve simply latched on to 3D as a marketing ploy that the entertainment and electronics industries can use to trick people into thinking that they are getting a superior experience. It’s only working because just enough people are falling for the scam to keep it alive.

A lot of smart people have already sniffed this out and are avoiding 3D entertainment. It’s time for the rest of the public to reject 3D and stop being cheated.

It’s not that we don’t want innovation in real life imaging. Of course, we do. We just want real innovation, and don’t want to pay for badly-overpriced gimmicks and half-baked experiments.

Resolving Conflicts Within The Team Successfully

It is quite understandable that a lot of conflicts arise among the team members every now and then. There are many disagreements in the team when they are working on a certain project and sometimes these disagreement can build into full fledge conflicts which end up affecting the performance of the entire team. An effective team manager and team member is one who can handle such conflicts calmly and successfully. When you are working in a team, the performance of every team member is under scrutiny and the boss will notice whether you were a part of the problem or the one who controlled the problem.

Conflict management is not as difficult as some people think and you can very easily learn to handle different kinds of people and conflicts if you follow these simple tips:

Avoid Pointing Fingers:

Most of the conflicts arise when there is a problem with the project and something goes wrong. In such a situation, most people start pointing fingers at the team members in order to avoid taking the heat for the mistake. Putting blame on others is the worst attitude in a team member and creates more problems rather than resolving any problem. Instead of pointing fingers at others, it is better to discuss what went wrong and then figure out a way to remedy it rather than wasting time in trying to pin the blame on someone else.

Don’t Be Bossy:

When you are working in a team, you need to treat each team member as an equally important colleague and listen to their advice and suggestions. When you act like you are the boss, you not only alienate them but also create a hostile working environment which is more prone to conflicts. So don’t be extremely pushy and bossy, instead be a good team member who is ready to listen to the suggestions of his team mates.

Be In Control:

While it is true that you should not be bossy when you are managing a team, it also goes without saying that you need to be in control of the situation and when a conflict arises you have to remain calm at all instances. Losing your temper and shouting on your team members will not only create a bigger problem but you will also lose the respect and trust of your team members.

Be Direct:

When there are problems and conflicts at work, it is best to be direct and address the real issue then and there. Beating about the bush gets you nowhere and complicates the issue more than it needs to be.

Don’t Run Away From The Problem:

When you face a conflict within the team, the best approach is to tackle it hands on. Some people try to run away from the problem and hope that it will fade away eventually. The fact remains that the conflicts have to be resolved and the sooner you start making amends the better. If you are hoping that it will go away by just ignoring it, you are in for a huge disappointment.

Pinpoint The Source:

Whenever a conflict arises within a team, it is the duty of the team leader or manager to identify the source of the conflict and then address the issue accordingly. Sometimes this source can be a particular team member who is not willing to cooperate and creates a lot of problems during the working hours. So a good team leader not only has to identify the problematic person but also deal with him and discusses the issue clearly.

Listen to Others:

Not only in conflict resolution but also in managing a team properly, it is important to make sure that you listen to the problems and suggestions of other people. If you act like you know everything and do not pay any attention to the ideas being floated by other people, you are bound to increase the level of conflict within a team and create more problems rather than solving any. In order to become an effective team manager, you should be able to foster trust and to do so you need to be able to listen to the problems that other people are having when they are working on your team.

Act to Solve Problems:

Most of the problems arise when you fail to take action as soon as issue comes up and resolve it instantly. If you want to resolve the conflicts that are arising in your team, you need to address the issues without any delay and make sure that you are doing this in such a manner that everyone is satisfied with your decision. It is understandable that being a team leader you might have to take some tough decisions but you can do so without offending anyone in the team and by making them understand why you took a particular approach.

Avoid Being Defensive:

When you are a team leader or even working in a team without being the leader, you need to make sure that you are open minded and relaxed. You should be able to listen to criticism and be able to handle the criticism very well. Some people get extremely defensive when they are criticized for something and fail to take the high road. You need to keep in mind that being defensive will only create more problems for you and your team members and will eventually reflect badly on the outcome of the team. So whatever you do make sure that you remain calm and are able to take criticism with a pinch of salt. You need to analyze the criticism and see how much of it was fair and what can you learn from such criticism.

Conclusion:

By following these simple tips, you can make sure that your team performs well without any problems and if there is any conflict within the team, you can resolve it without getting into much trouble.

How to kill innovation, in five easy steps

This is especially true in the technology industry, but it’s also true to varying degrees in most other industries since new technologies and new discoveries are pushing civilization forward at a rip-roaring pace. At some point, the pace will settle down a bit and there will be time to consolidate and wring out efficiencies, but it’s not happening anytime soon.

If you’re in an industry or an organization that needs innovation to survive and thrive, then you’ll only succeed by letting go of control-freak tendencies and operating according to a different set of principles that will unleash people to think creatively and act independently.

Unfortunately, it’s easier to mess it up than to get it right, and the result is that employees end up confused, frustrated, and stifled. Here are five things that a lot of leaders and companies do to stifle innovation. Keep in mind that a lot of these things are done for good reasons — organization, systemization, and efficiency. Nevertheless, the effect is the same.

1. Don’t give ownership of projects

It’s no secret that a lot of companies are not organized to succeed. They are organized to maintain the status quo or to consolidate power for the people who set up the organization — and if the people in charge are nincompoops, then nothing gets done. In these types of organizations, projects are often handled by a committee rather than establishing a project leader. Different people or teams have to generally all agree on the same course of action for the project, and then each has to do their part to carry it out. That sounds wonderful and egalitarian and all, but it usually breaks down because smart people are naturally going to have different ideas for how to do things, and if everyone isn’t pushing in the same direction, then projects stagnate and falter. The better thing to do is to put a single person in charge of a project (companies like Apple call this the “directly responsible individual” or DRI) and designate a set of team members to be part of the project and give them clear goals and objectives for their piece of it.

2. Create too many layers of management

There’s a tough balance to maintain between too much management and not enough. One one hand, lots of studies have shown that the job satisfaction of most employees is closely tied to their relationship with their manager, so you need to have enough managers for people to get plenty of 1-on-1 attention and direction. On the other hand, if you have a ton of middle managers running around, then employees feel too far removed from the organization’s true leaders, which hurts morale, slows down communication, and adds too much overhead to simple processes. If you want to create a culture of innovation, then you have to find ways to flatten your organization and create less hierarchy, while making sure every employee still gets a little bit of time with the boss on a regular basis in order to stay energized and on target.

3. Ignore brainstorming rules

The basic rules of brainstorming have been around since Alex Osborne coined the phrase in 1939, as part of his method for creative problem solving. However, it’s amazing how many organizations attempt to engage in brainstorming without following the rules and end up killing some of the best ideas because of it. Osborne once said, “It is easier to tone down a wild idea than to think up a new one.” In that spirit, true brainstorming should be always be a negativity-free process that encourages people to throw out their wildest ideas without fear of them being quickly shot down or ridiculed. Some of the craziest ideas could morph into something amazingly useful. You can find lots of variations of the brainstorming rules on the web, but my favorite are the ones that the Walt Disney World “imagineers” use:

Rule 1 - There is no such thing as a bad idea. We never know how one idea (however far-fetched) might lead into another one that is exactly right.
Rule 2 - We don’t talk yet about why not. There will be plenty of time for realities later, so we don’t want them to get in the way of the good ideas now.
Rule 3 - Nothing should stifle the flow of ideas. Not buts or can’ts or other “stopping” words. We want to hear words such as “and,” “or,” and “what if?”
Rule 4 -  There is no such thing as a bad idea. (We take that one very seriously.)

4. Rely too heavily on data and dashboards

The ability to track the performance of all kinds of things — from sales to inventory to assets to processes — has revolutionized business since the rise of the computer. It has enabled workers to make faster and better decisions, and it has driven major productivity gains and made business processes far more efficient. However, it’s also easy to use data as a crutch and to go too far with the business dashboards that we use to monitor the latest reports. If you’re paralyzed to the point of not being able to make decisions because you can’t get enough data or the data is inconclusive, then it’s a problem. Beyond some of the basic data, such as sales and customer traffic, a lot of the data requires sophisticated analysis (because it’s so ambiguous) and many of the truths it contains are relative — or worse, they hide other truths. The best leaders still trust their gut, no matter how much data they get, and know how to balance the objective numbers with a certain amount of emotional intelligence, especially when it comes time to make the tough decisions.

5. Under-resource your hidden opportunities

I’m never a believer in unlimited budgets — even for huge opportunities or things that absolutely must be done. Having too many resources makes people sloppy. When you have to get something done with fewer resources than you think you need, it often sharpens your wits, forces you to hustle, and leads you to break through barriers. However, there are also times when a lack of resources can simply strangle a promising project or product. This is where good leaders earn their pay. They don’t just keep throwing the same amount of resources at the same stuff out of habit. They look at the whole portfolio and regularly realign resources in order to chase new opportunities — even ones that may seem to be obscure long-shots — and see if there are parts of the organization that can outperform the status quo, if given a shot.

 

 

The Explosion of Cybercrime

Cybercrime is broadly defined as any crime involving a computer or a network. In the last decade, the amount of cybercrime has grown substantially resulting in significant losses to businesses, and lining the pockets of criminals. This article presents some information about some of the common cybercrime activities and it helps emphasize the value of IT security for any organization.

It also helps to emphasize the value organizations place on employees with IT security awareness. The (ISC)2 CISSP has become one of the top IT security certifications and many organizations seek employees with this certification for both IT jobs and managerial positions. Lower level security certifications such as CompTIA’s Security+ and the (ISC)2 SSCP are also valued by organizations. For example, the U.S. Department of Defense requires anyone with an administrative account to have at least a Security+ certification.

Cyber Extortion

In high-crime areas, extortionists have demanded payments from businesses for “protection.” If the businesses refused, the business was attacked, robbed, employees harassed, and in extreme cases, the business was burned. Of course, the extortionists actually attacked the businesses when the protection money wasn’t paid.

Extortion has made it to the cyber community. Attackers use distributed denial of service (DDoS) attacks to show they can cripple Websites and corporate networks. They then demand protection payments to stop the attacks. Ron Lepofsky wrote in 2006 that the U.S. and FBI receive at least 20 new cases of cyber extortion a month. Blackmailers use various types of denial of service attacks to cripple Websites and corporate networks. They then demand protection payments to restore the service. Extortionists have demanded ransoms of more than 1 million dollars to stop the attacks. Some companies quietly pay. Others attempt to fight back.

A smaller form of cyber extortion is in the form of rogueware, or fake antivirus software. A user visits a Website and sees a popup indicating their system is infected, and encouraging them to download free software to clean their system. After the user downloads and installs the software, the rogueware reports several serious infections, but then states that the free version only scans the system, but won’t clean it. If they want to clean their system, they must pay between $49.95 and $79.95 for the full version. PandaLabs reported in 2008 that criminals were extorting approximately $34 million dollars a month from unsuspecting users. While this is bad enough in itself, the rogueware provides zero protection against actual malware, leaving the user with a false sense of security.

Additionally, many rogueware criminals include additional malware in the rogueware. For example, an added keystroke logger can capture a user’s keystrokes (such as capturing passwords for online banking accounts) and periodically send the data to the criminal. Many versions also include software to convert the computer into a zombie as part of a botnet.

Botnets

Botnets have grown to astronomical proportions over the past few years, and despite some successes, they’re still stealing money from people every day. As an example, NBC reported in 2004 how a small business in Miami was attacked. Specifically, their computer was infected with the CoreFlood virus (used in the COREFLOOD botnet) and someone transferred $90K out of their Bank of America account without their authorization to a bank in Latvia. Before this, the COREFLOOD botnet was primarily known for DDoS attacks.

Other losses from the COREFLOOD botnet include $115K from a real estate company in Michigan, $78K from a law firm in South Carolina, $151K from an investment company in North Carolina. The list goes on and on. Don’t think they’re only attacking businesses though. It’s just that when an individual’s $1,000 in savings is stolen, it isn’t as newsworthy as a loss of tens of thousands of dollars. Still, the loss of $1,000 by an individual can be devastating.

Interestingly, a report in June 2008 by Joe Stewart (Director of Malware Research, Dell SecureWorks) showed this same botnet was still in operation and the bot herders had shifted their activities from DDoS attacks, to full-fledged bank fraud. After all, they found they could get quick paydays with much less effort. At that time, they had infected over 378,000 computers and had at least one database with over 50 Gigabytes of data on hapless users around the world. The botnet had captured keystrokes and recorded bank passwords, credit card data, email passwords, social network passwords, and more.

As of February 2010, this botnet had grown to over 2.3 million infected computers with 1.8 million of the computers in the United States. Thankfully, the U. S. Department of Justice took several steps in April 2011 to take over the botnet’s command and control servers and may have succeeded in shutting this botnet down. We’ll see.

The point is botnets are thriving. Even though experts are shutting down some of the large botnets, it’s like a game of whack-a-mole. They keep popping up. In years past, malware was used to cause damage to systems such as corrupting a hard drive or system files. Today, malware is a tool often used by criminals to steal identities and hard cash from regular people just like you and me.

Morphing Malware

Malware is increasingly difficult to detect, mostly because attackers are constantly developing new methods and strategies. One common method used today is polymorphism. Malicious code within a single virus can be run through a mutation engine to create thousands of different versions of the same virus. While one version may be detected by a malware detection signature, thousands of other mutations may get past this signature until another signature is developed to detect the mutated versions.

At one point, it was recommended that you update your antivirus definitions on a weekly basis. Some experts now suggest you update it hourly. Malware vendors are constantly working on detecting new variants, updating signature files, and publishing them.

It’s also worth noting that all antivirus (AV) software is not created equal. Virus Bulletin publishes a monthly report on the effectiveness of AV products that is quite enlightening. You may think that malware products can consistently detect close to 100 percent of malware in the wild, but that is not the case. For example, this graph shows a wide scattering of products in the 60 percent to 80 percent effectiveness ranges. This equates to a grade somewhere between a B and a D. For me, I don’t want the D student protecting my bank accounts and identity.

It’s also worth pointing out that criminals have discovered the power of malware when used effectively for criminal activities. While malware was previously used to take down systems or networks just for the fun of it, criminals don’t do that today. Instead, criminals use malware to enlist zombies into their huge botnets. These zombies then engage in activities allowing the criminals to steal money from people and organizations on a grand scale.

Zero Day Vulnerabilities

Zero day vulnerabilities are those that are known to attackers, but either not known to the vendor, or the vendor has not developed and released a fix yet. While this implies that a zero day vulnerability lasts only a single day, it can actually last months before a fix is written, tested, and released.

In other words, even if you are taking steps such as keeping a system up-to-date, running AV software, and regularly updating signature files, you are still at risk from zero day vulnerabilities. Defense-in-depth procedures within an organization include a variety of other security practices to protect systems and networks to help protect them from zero day vulnerabilities.

Online Fraud

Cybersource publishes an annual fraud report on online fraud. Online fraud is fraud occurring through the Internet, such as charges on stolen credit cards, and chargebacks required by a credit card’s issuing bank. In the 2011 Online Fraud Report, Cybersource reported that losses from online fraud was about 2.7 billion dollars in 2010.

The good news is that online fraud appears to be declining. Online revenue losses due to fraud were estimated at 3.3 billion in 2009 and a peak of 4 billion in 2008. While this may look like criminals are trying less, that’s not actually the case. Instead online retailers have dedicated more and more resources to blocking cybercrime and are enjoying some success. That is if you want to call an annual loss of 2.7 billion dollars a success.

Conclusion

If you’re studying IT security certifications (such as CompTIA Security+, or the (ISC)2 SSCP or CISSP), expect your skills and your knowledge to be in high demand. Organizations using computers, and especially organizations with an online presence, are recognizing the risks to IT systems and networks. More and more organizations value individuals that understand these risks.