Judge decides we don’t have any right to privacy – Naked Security

PrivacyIt seems we now live in a world where everyone is free to snoop on everyone else to their heart’s content.

If you connect your computer to the Internet, like billions of people, then you can’t expect any privacy. Or so says a judge in Virginia.

According to eWeek:

A federal judge for the Eastern District of Virginia has ruled that the user of any computer connected to the Internet should not have an expectation of privacy because computer security is ineffectual at stopping hackers.

So, does that mean we can’t expect privacy in our own homes because burglars can get in if they really try? If so, surely we may just as well just leave our front doors wide open?

Read More…


A Washington State News Show recently made good use of Microsoft’s Surface Hub and Power BI technology.

imageMicrosoft posted a blog entry that describes how KING 5 used some of their new technology “to usher in a new era in News Reporting”.

The station was able to drill down into the results of Washington state’s May 24 presidential primary and share insights county by county, as votes were tallied, by using Microsoft’s Power BI data visualization tool, displayed to viewers on a large Surface Hub touch screen as well as through an interactive report online. The new capability is a prime example of gains made in the accessibility of data and the technology to analyze and share it.

Want to see more?


Announcing Amazon Inspire

Announcing Amazon Inspire, a Free Service for Digital Educational Resources

Press Release

imageAn interesting blog note came across my desk from Tech & Learning eNews that Amazon had launched a new free service called Inspire that Amazon hopes will make it a major player in the tech education industry. It launched in late June with thousands of free education resources such as worksheets and lesson plans. This new service is meant to provide teachers with students anywhere from kindergarten to 12th grade a place to find and share free education materials.

Amazon Inspire Features

  • Smart search — With smart search, teachers can explore resources by grade level, standard or even from a particular district. Educators can filter search results using more than 10 criteria to find great resources that best fit their needs.
  • Collections — Educators can group resources into collections. They can describe the collection, curate the resources in it, recommend an order for going through the resources and share the collection with other teachers.
  • Simple upload — Amazon Inspire offers an easy to use and intuitive upload interface. Educators can drag and drop files they want to share, add basic metadata such as title, description, grade and subject, and publish the content on the service, all in a few minutes.
  • Customer reviews — Teachers can rate and review resources on Amazon Inspire, helping their colleagues around the country select the best resources for their needs.
  • Accessibility support — Amazon Inspire has built in accessibility features. For example, educators can navigate Amazon Inspire using popular screen readers and users are also able to indicate the accessibility features of resources they upload.

see additional information at EdSurge

Educators across the United States are invited to learn more about or join the Amazon Inspire beta at


Cozi has a fresh new look

Lists_MainImageMy wife and I have been using Cozi to help coordinate our home lives with each other for a number of years and have found it to be indispensible. Our two primary functions revolves around the calendar and shopping list functions. In one place we have the ability to coordinate our grocery shopping so we don’t have duplication in our store visits. It is also good as a reminder of what we need to do and so on. If there is any question of our plans all we have to do is look at the calendar and we know when and how to coordinate with each other without having to track each other down.

Now Cozi has updated its mobile app as well.

Here’s what’s new in the latest iOS update: They have refreshed the Cozi color scheme with a cool blue in place of the orange. You can also now choose from four different, free themes to personalize your Cozi app. Tap “Change Theme” in the More menu to choose from the new blue “Cozi,” “Anniversary,” “Bloom,” or the orange “Cozi Classic.”

Here’s what’s new in the latest Android update: We’ve refreshed the look of Cozi with a cool blue color scheme in place of orange. You can also now choose from four different, free themes to personalize your Cozi app. Tap “Change Theme” in the main navigation to choose from the new blue “Cozi,” “Anniversary,” “Bloom,” or the orange “Cozi Classic.”

There are some changes in the List function as well. Easily toggle between Shopping and To Do. All of your lists are now accessible in one place within the app under “Lists.” You can toggle between Shopping and To Do by tapping the buttons at the top of the screen, and then you’ll be taken to a screen that shows previews of your lists.


For Cozi’s primary functions it is free but they do have a Gold version that costs $19.99/year. Here is a comparison between the two products.


For more information go to:


It’s not all about ransomware – keyloggers are still alive and well!

imageRansomware gets a lot of attention these days, and understandably so.

It’s the digital equivalent of a punch in the face: there’s no doubt what’s happened, and the crooks leave no stone unturned to make sure you know it.

Some ransomware not only creates some sort of HOW-TO-PAY document in every directory where there are scrambled files, but also changes your desktop wallpaper so that the payment instructions are visible all the time.

You can argue, however, that less visible malware attacks are even worse, especially if you only find out about them days or weeks after they started, and they include some sort of data-stealing payload.

Like the range of malware that SophosLabs researcher Gabor Szappanos (Szapi) was reviewing recently while working on a paper about Word-based attacks.

Szapi was looking at a particular subset of Word-borne hacks: what are known as exploit kits.

Exploit kits are pre-packaged, booby-trapped files that automatically try to take over applications such as Word or Flash as soon as you open up one of the malicious files.

The idea is to bypass any pop-up warnings that would usually appear (such as “you need to enable macros,” or “are you sure you want to install this software”) by crafting the exploit file so it causes a controllable crash in the application that just loaded it.

Szapi noticed that all of the exploit kits he’d covered in his paper (going by names like Microsoft Word Intruder, AK-1, AK-2, DL-1 and DL-2) had been used at some time to distribute data-stealing malware known as KeyBase.

His first thought was along the lines that “KeyBase ought to be dead by now, because it’s been around for a while, it’s well-known, and the author himself took it offline long ago.”

read more…


Using Microsoft Edge Browser instead of other options may save you battery life

imageMicrosoft has been running some experiments testing battery life when using different browsers and Edge is coming up on top, of course. The primary reason was shown by measuring the battery draw when using each browser and the following results were reported by measuring the power draw of the Wi-Fi, CPU, and GPU during a test workload that cycled through some common sites including Facebook, YouTube, Wikipedia, and Amazon. This task drew:

  • 2.1W in Edge
  • 2.8W in Chrome
  • 3.1W in Opera
  • 3.2W in Firefox.

An article in ArsTechnica goes on to discuss how the new release of Windows 10 that is going to be available this month is making even more inroads into battery consumption when browsing the web and using the Edge browser. It will be interesting to see if this all holds up. I may have to jump back to using Edge more often when working on battery power.


Windows 10 Refresh Tool Will Sweep Away Bloatware on Your PC

imageOne of the things that we are constantly doing on machines coming in to us from distribution before we send them out to our customers is prep them. Besides loading them up with the applications that the client needs we also strip out the Bloatware that manufactures install on these machines. The Bloatware on these systems can seriously degrade the performance of a system. So why do you ask, do manufacturers add this to their systems? The reason is simple, they get paid a subsidy by the software manufacturers to install it. In most cases it is benign but in other cases it can open series holes in your security and compromise the speed of your system.

So Microsoft is planning on releasing a tool that will roll back the software bloat that hardware manufacturers put on their systems and give you a clean install of their Windows 10 operating system.

The Windows 10 Refresh Tool, which has just entered public testing as part of Windows 10 Build 14367 which was recently released to Windows Insiders in the Fast Ring, will perform a clean installation of Windows 10 and remove apps that came pre-installed on your device including support apps and drivers. As part of the clean install process it will also remove any apps and desktop programs you may have installed as well.

While Windows Insiders have several caveats relating to the testing of the new Refresh Tool for consumers it will be more straight forward once the Windows 10 Anniversary Update is released in July.

Read more about this here:


Build an On-Line Company-Wide Data Store

One of the ideas that I have been toying with is how an organization that has only a few users design their document storage around a cloud option rather than with an on premise server. There are several questions that come up when considering this and I would like to explore these in this post.

I am going to approach this with the thought of using Microsoft Office 365 has the core product and then explore other options that might enhance this total solution. In a smaller environment that has fewer than 150 users and doesn't have a need for Microsoft's Access Database Program, then Small Business Premium Subscription will provide each user with Microsoft Office desktop installations, hosted Exchange and on-line storage.


Each user license provides a personal storage using OneDrive of 1 TB and in a Team Site (SharePoint) an initial 1 TB plus 500 GB's per licensed group member. In a small group of 5 licensed employees, each employee would have 1TB personal storage and the group would have 3.5 TB's shared storage.

As you can see, the more people you have in the group your team shared storage will grow quite quickly. In a lot of cases, the cost of having this much storage on a local file server would increase the cost of the initial equipment and the cost of your backup of that data. If you wish to have cloud backup, you're going to have the cost and logistics of getting that data off-site as well.


Microsoft provides some limited backup of you data but doesn't have a true archival backup solution. Luckily we do. Using our Cloud backup program, we have the ability to back up the entire contents of your Office 365 site for just pennies per user per day. In the example of a five user office, $21.25 per month. This includes backing up all of your data including your SharePoint and your Exchange data. And it is

easy to setup and restore from as necessary.



In this example you see that I have several SharePoint sites setup on our system. The primary site is our Team Site which contains different kinds of list data, calendars, announcements and links to special information including tutorials, vendor sites and other special pieces of information. I have also created a subsite called PAconnect. This is a site's sole purpose is as a document holder for our on-line document storage. I have shared this site with everyone in our organization so everyone has access to the information here. The last subsite that I have here is a SharePoint site that has limited access. Only the admin group of people will ever be able to access the data located here. You see here that you want to put some thought behind how you set up your SharePoint sites, what their use is, in other words what kind of information you want to put there and lastly who you want to be able to access it. Your administrator of the account has the rights initially to set up the rights mask for the site so whomever is in control will be the one that can set this up.

Here is a link that will help you get started with understanding SharePoint Libraries.


Synchronizing your Library

Once you have created the file structure of your library you will want to create your synchronization to it to your desktop This enables you use it just as you would any document folder you have on your computer. With synchronization setup you will be able to easily access, update current documents and store new documents to your shared area. The other benefit of SharePoint Libraries is versioning. This gives you the ability to restore your document to an earlier version if you make a mistake. Your site admin needs to setup this up and will enter how many earlier versions to keep available.


Turn on Versioning

By default, versioning is turned off. To turn it on and implement your versioning decisions, you must either have Full Control or Design permissions. The picture above shows you the options that are available when your edit the Library's Settings. A good overview of what all of these options are and what they allow you to do can be found here. This is a link to your on-line SharePoint Help site. Another great place to start looking at to learn how to use document libraries.


Users upset by Evernote price hikes & two-device limit for free Basic customers

imageThis is a bummer if you are still using Evernote and your prime note taking app. Especially  the two device limit. The whole reason for using Evernote, when I was, was to have one application that I could pick up any device on and access the data. Now if you wish to do this, you will have to migrate to their Plus or Premium version subscription. While the price is not significant:

The price of a Plus subscription is being hiked from $2.99 per month to $3.99 per month, although annually the cost is cheaper at $34.99. Premium is seeing a stepper increase, from $4.99 to $7.99 per month — a 12-month version of the plan is $69.99.

if you wanted to stay with their free version you will have to deal with the limitations. Here is a comparison list of the different versions of Evernote.


Collaboration in Office 365–The Possibilities

imagePosted out on Microsoft’s TechNet blog I found an article discussing things that you can do to within the Office 365 environment that allows for different kinds of data sharing with both internal users (those users who are part of your Microsoft Office 365 tenant) and external users (those that belong to other Office 365 tenants).

What is an Office 365 tenant?

The term “tenant” is purely technical. In an ideal scenario, a single company would sign up for a single Office 365 tenant. Imagine a tenant as an equivalent of a closed on premise setup within which you have all your services running.

A single tenant will have all your users, groups, resources, data, subscriptions, licenses etc.

But we have also seen companies going for multiple tenants – especially if they have entities that are (or need to be) “separate” either from an IT or legal perspective.

Even then we would normally recommend having a single tenant for a single company, wherever possible. Why? Because tenant boundaries limit collaboration capabilities and bring in (IT) barriers between two users that you would normally expect to have between users in two separate companies (or organizations). Your global IT administrator’s credentials are effective only within the tenant boundaries. And, if you own a vanity domain name (like “”) – you can only use it in a single tenant of Office 365, i.e. users in two separate tenants cannot have email addresses or login addresses ending with the same domain name.

The article provides a lot of insight and ideas on how to use your Office 365 account, and if you haven’t taken the leap yet, this may provide some ideas of why you should.


Ransomware that’s 100% pure JavaScript, no download required

SophosLabs just alerted us to an intriguing new ransomware sample dubbed RAA.

This one is blocked by Sophos as JS/Ransom-DDL, and even though it’s not widespread, it’s an interesting development in the ransomware scene.

Here’s why.

Ransomware, like any sort of malware, can get into your organisation in many different ways: buried inside email attachments, via poisoned websites, through exploit kits, on infected USB devices and occasionally even as part of a self-spreading network worm.

But email attachments seem to work best for the cybercrooks, with fake invoices and made-up court cases amongst the topics used by the criminals to make you think you’d better open the attachment, just in case.

In 2015, most ransomware arrived in Word documents containing what are known as macros: script programs that can be embedded in documents to adapt their content in real time, usually as part of your company’s workflow.

The problem with macros, however, is that they aren’t limited to adapting and modifying just the document that contains them.

Macros can be full-blown programs as powerful as any standalone application, and they can not only read and write files on your C: drive and your local network, but also download and run other files from the internet.

In other words, once you authorize a macro to run, you effectively authorize it to install and launch any other software it likes, including malware, without popping up any further warnings or download dialogs.

You can see why cybercrooks love macros!

Click here to read more…


How to stay protected against ransomware

imageHere is a Sophos Whitepaper describing ways to protect yourself and your organization against ransomware attacks.

This document explains how to react quickly and effectively to the threats posed by ransomware such as Cryptowall, TeslaCrypt and Locky.

It first details the mechanisms that these infections use to find their way into companies and why a large number of new infections continue to surface despite existing protective measures.

It then provides practical recommendations to protect against them, showing how these threats can be tackled using short-term and longterm technical
and organizational measures.

It also includes optimal configuration settings for Sophos solutions to protect against ransomware.


Get this Flash Update Now


Security update. Naked Security Published a flash update notification yesterday that you will want to update your computer with if you are using Flash. Here is a link to the article if you want more information…


SharePoint and OneDrive in the cloud

An important part of Office 365 is the ability to store, manage and share information from a central location in the cloud. Here is a brief video describing some of the enhancements Microsoft has made to these products recently.


SharePoint and Office 365

If you have subscribed to Office 365 with either Microsoft’s Small Business Essentials, Premium or any of their Enterprise Level products then you have SharePoint available to you. The following video gives you some insight into some of the things that you can use SharePoint for and make it another useful tool for your organization.


Have you thought about Cyber Insurance?

SophosHeartbeat_336x280When putting together all of the pieces that you need to be able to recover from a security attack have you left anything out? It might be Cyber insurance.

When we are designing a system to mitigate the harm from a Cyber Attack we look at multiple factors. First you need a solid firewall that is being updated to keep its security functions as current as possible. Secondly you need protection on your workstations with malware/antivirus protection (endpoint protection). If you choose the right vendor and the right products from the right vendor you can have these two security points synchronizing their support. This provides an extra layer of protection that you don’t find in other vendor’s products. Sophos is the only company out their that has this kind of synchronized security and the integration of all the products providing this is just on the horizon.

Second, you need a backup solution that provides a full image of your network. This allows you to dial back time to be able to restore to a point that dates prior to your attack/infection. If you don’t have this some of the attacks can cause you to do a full restore of the system and to then have to recreate your data if you don’t have it backed up.

So how do you pay for all of this labor to get you back to normal after an attack. Along comes Cyber Insurance. What is Cyber Insurance? I was reading an article from TechCrunch that defined it as follows:

Cyber insurance is a sub-category within the general insurance industry, offering products and services designed to protect businesses from internet-based risks. Although forms of cyber insurance policies have been around for the past 10 years, market awareness has recently increased exponentially, in part because of the headline-grabbing cyber breaches that have hit almost every industry.

Asking your Insurance Company about Cyber Insurance may cause you to look into increasing you front line defenses before they will cover you. You will need to comply with their basic security requirements before they write the policy. This will be an additional expense to you to become compliant. So it is important to choose the right products and be doing the right procedures to ensure that you are providing yourself the best security that you can.

This is why security has become one of our main focal points. It is really getting scary out there.

For more information on Sophos Synchronized Security down these papers:


How to keep up productivity with cloud computing.

imageWhile the article that I would appoint you to is actually “How to keep up productivity when freelancing, with cloud computing", I think we can all take bits and pieces of this and apply them to our daily work life as well. You don't have to be a freelance worker to see some of the benefits that you would have from leveraging cloud computing components. I think this is a great article to take note of to see how many of the new millennial members of our society probably be working in the future. They are more attuned to using the devices to be connected to each other and it is not a far reach make as part of their work life as well. This is a great lesson on how to be able to be working from anywhere, anytime that suits you. Something as I get older is part of my wish list. I'd love to hear what your thoughts are on this.


TechNet Blogs posts:Four ways to keep your kids safer online

imageIt is in the news all the time it seems that someone is bullied or some tragedy has occurred because of online bullying and abuse.

With a significant number of young people using the internet compared to their adult counterparts, and over 80% of teens regularly using a cell phone, chances are your children are vulnerable to online dangers.

Whether it’s your child joining the more than 50% that have experienced cyber bullying, or falling victim to malware attacks, being online can be a risky place for children.

Take a look at their article.


If you want to subscribe to Sophos’s Blog’s

RSS Reader

You may also subscribe in your preferred RSS/Atom feed reader, using the links below.


XG Firewall


Sophos SFOS 15.01.0 MR-3 Released

Our own Matt Shafer just posted to us that Sophos has just pushed out a new maintenance release for the XG firewall, including a number of fixes for open issues.

Please direct your customers to the Sophos Community Blog for XG Firewall to review the release notes and share their feedback.

As a reminder, our communications plan for all maintenance releases like this is to publish notifications and release notes on the Sophos Community Blog, so we encourage everyone, such as yourselves and customers, to subscribe to the blog – you'll get immediate notifications via email whenever an XG Firewall or UTM firmware update is available. Complete instructions on how to subscribe are located in this blog article.

Download full release notes: Sophos XG Firewall V15.0.1.0 MR3 Release Notes.pdf

If you’re wondering how to do firmware updates or roll-backs on your XG Firewall, we’ve got a new video for you, covering everything you need to know to keep your firewall up to date.

Page 1 ... 2 3 4 5 6 ... 57 Next 20 Entries »