In many cases, open source software can help companies save money. But will those applications introduce new security threats? 

IT security experts often disagree about the relative security of open source software. Some observers say many open source developers don’t have incentives to fix security vulnerabilities, so they often go unpatched.

However, others point out that the attention paid to security varies across different communities and that while some may not have a strong record with security, others have been very effective at delivering patches.

Also, some argue, open source applications are often less widely used than their commercial counterparts, so they aren’t attacked as often.

The debate has heated up recently as some researchers have pointed out the security deficiencies in some open source projects. For example, in a presentation at the recent RSA security conference, researchers from Sourcefire presented findings of a study of security vulnerabilities in open source and commercial software.

One finding: When all of the major distributions of the open source operating system were combined, Linux had more vulnerabilities report in 2012 (1,752) than all versions of Windows combined (1,114).

Also, when comparing web browsers, Sourcefire found that the open source Mozilla Firefox contained the highest number of critical vulnerabilities last year, with 433 — even more than Internet Explorer which is often considered a higher risk based on the number of attacks that the target the browser.

Plan open source implementations

In the end, all software is going to have vulnerabilities — whether it’s commercially sold or open source. However, the debate about open source security should make one thing clear for organizations: It’s important to take security into account when considering open source implementations.

Some questions IT should ask before choosing an open source application:

1. How active is the community? Take a look at discussion boards and the frequency of updates. That will give you an idea of how many people are developing the app and how quickly bugs get fixed.
2. Are there regular security patches? Find out if the project has established practices for identifying vulnerabilities and fixing them.
3. What kind of quality assurance process is there? Check the process being followed by developers for each release. If it’s not up to your standards, look somewhere else.
4. How have other businesses used it? The best way to see if an open source project will work for you? Tap into the community and find a business similar to yours that has tried it.

The post Is open source software secure? appeared first on Finance Tech News.

Go to Source
Author:

Small businesses are often at a disadvantage because they don’t have the same security budget as larger firms. However, a recent study shows there are even some simple IT security steps that small companies often fail to take. 

Often, leadership at small businesses may assume that smaller companies don’t face the same threats as others, so many of the precautions aren’t taken.

But that’s not the case, according to a recent report from the Ponemon Institute. For many small businesses, it would pay off to invest more resources in IT security.

Among the 1,200 SMB IT managers surveyed by Ponemon, more than half (55%) said their organization had suffered a data breach at least once in the past year. And of those, 53% have suffered multiple data breaches.

The bottom line: Small organizations face big security risks, and many of them need to take more steps to prevent and mitigate IT security incidents.

These were the top IT security mistakes made by the SMBs surveyed:

1. Failing to keep tabs on third parties

Especially as cloud computing becomes more common, many data breaches occur because of an incident at a third party business partner that handles sensitive company data. In fact, 20% of the breaches in the report were blamed on third parties, 70% of respondents agreed that data is more likely to be compromised when it’s outsourced.

However, most organizations (62%) don’t have contracts that require third parties to cover the costs associated with a data breach.

2. Being unable to detect breaches

One big problem: 70% of the companies surveyed said they would be unable to detect a data breach that did occur.

Those firms could help themselves by make greater user of network monitoring tools to help look for suspicious activity.

3. Neglecting to notify data breach victims

In addition to prevent as many breaches as possible, companies must be prepared to handle incidents and minimize the damage they cause. One key step: Getting ready to properly notify affected individuals that their data has been compromised. Doing so can help prevent legal and compliance costs, as well as reputational damage.

But among the organizations that suffered a breach, just 33% sent out those notifications, despite the fact that 46 states currently have data breach notification laws on the books.

The post Top IT security steps small businesses don’t take appeared first on Finance Tech News.

Go to Source
Author:

Download this kit to learn everything you need to know about IT Management. The iPad CTO Kit brings together the latest in information, coverage of important developments, and expert commentary to help with your IT Management related decisions.

Click here to learn more!  

The post iPad CTO Kit – including the iPad Tips and Tricks Guide for IT Executives and Managers appeared first on Finance Tech News.

Go to Source
Author:

Many businesses are concerned about the security of sensitive data when it’s held by a third party cloud computing servcie. However, a new survey says those worries might be exaggerated to some degree. 

There’s a significant difference between the concerns of organizations that aren’t using cloud computing services and the experiences of those that have made the move to the cloud, according to a recent report from healthcare research firm KLAS.

When asked about their biggest concerns regarding cloud computing, 66% of the healthcare providers survey that are not currently using any cloud services listed security. That was the top concern of survey respondents by a significant margin, ahead of:

• Reliability and up-time (cited by 38% of providers)
• Loss of control over applications and data (17%)
• Costs (9%), and
• Integration with current infrastructure (2%).

However, the organizations actually using cloud computing services had far fewer worries about protecting data in the cloud. On average, those healthcare providers gave their cloud computing vendors a 4.5 out of 5 when asked to rate them in terms of IT security.

Questions to ask cloud computing vendors

Of course, that doesn’t mean ever cloud computing vendor gets high marks for security. When companies choose a cloud computing service, it’s important to thoroughly vet the vendor before signing a contract.

Here are some of the questions organizations can ask cloud vendors to see how their security practices stack up against the competition:

• What policies and procedures are in place to protect the physical data center, and how does the company vet employees who have access to clients’ data?
• What technology is used to keep one client’s data separate from others’ on multi-tenant servers?
• What encryption protocols does the vendor use to protect data in transit and at rest?
• What’s the procedure for notifying customers of a data breach?
• What availability guarantees are offered and what penalties are assessed if they aren’t met?

The post Cloud users give vendors good marks for IT security appeared first on Finance Tech News.

Go to Source
Author:

We’ve discussed telecommuting before as a key benefit to offer employees and a way to boost productivity and morale. However, some big-name companies apparently disagree. 

Yahoo made headlines late last month when management put an end to the company’s telecommuting program and ordered remote workers to return to the office. The decision was especially surprising to some observers, because it came from Marissa Mayer, who became CEO while pregnant and was expected by many to make the workplace more hospitable for working parents.

According to the company, the goal for the policy change is to increase face-to-face contact among employees and foster creativity and innovation.

Another big policy change was recently made by Best Buy, which got a lot of attention for adopting a Results-Only Work Environment (ROWE). Under the ROWE program, corporate employees were only judge on their work, with little control over when or where it was completed. However, the company recently announced it was ending the program and expecting those employees to put in traditional 40-hour work weeks in the office.

Most firms keeping telecommuting

Despite those big names leaving telecommuting behind, not all businesses agree that letting employees work from home is a bad idea. Telecommuting is a perk that a lot of employees want, and offering the opportunity can help companies recruit and retain talent when budgets for compensation are tight.

In addition, the majority of employees report that they’re more productive when they work from home.

Due to those benefits, most companies with telecommuting programs don’t plan to follow the lead of Yahoo and Best Buy, according to a recent survey from Challenger, Gray & Christmas. Among the 120 HR executives surveyed, 80% said they allow employees to work from home to some degree, and 97% of those have no plans to eliminate telecommuting.

The benefits of telecommuted cited by survey respondents included increased productivity, better morale, increased loyalty and fewer unscheduled absences.

However, businesses do seem to agree that there’s also value in being present in the office. Just 9% said they offer a telecommuting option across the board to all employees. Many (40%) give the option to a select group of workers, while others (31%) don’t offer full-time telecommuting but let people work from home occasionally at the manager’s discretion.

Does your company let people work from home? Any plans to change that? Let us know by leaving a comment below.

The post Yahoo, Best Buy eliminate telecommuting – should you? appeared first on Finance Tech News.

Go to Source
Author:

Here’s some good news for the CIO, IT Manager and other tech leaders in your company: A new study says that IT budgets are expected to rise in the coming year. 

On average, companies say their IT budgets will be 2.07% higher in the 2013 than they were in 2012, according to a recent report from the Hackett Group.

The increase in the average budget is especially high considering how budgets in other parts of the organization are faring. For example, among the companies surveyed, Finance budgets are expected to drop by 1.22% on average. Decreases are also being seen in HR (0.79%) and Procurement (0.4%).

Despite the budget increase, companies actually plan to cut the size of the IT staff by 0.33% in 2013. Where is the extra IT budget being allocated?

With the rise in cloud computing, mobile technology, Big Data and other new trends, organizations’ priorities are changing.

According to respondents to the Hackett Group’s survey, the top goals for technology spending are the same as in previous years: increase operating margins and help the company grow its revenue.

However, the priorities that saw the biggest increase in importance compared to previous surveys were:

1. Improving customer service and satisfaction (cited as a top priority by 88% of respondents in 2013)
2. Reducing overhead costs (83%), and
3. Increasing operation agility and flexibility (82%).

And in line with those priorities one of the objectives companies have for using the IT budget is to roll out more cloud computing services.

In addition companies are also planning to invest in more data analytics tools and other Big Data-related technologies.

The post IT budgets are increasing – where are companies investing? appeared first on Finance Tech News.

Go to Source
Author:

BYOD is not a single product, service, or application. It is a situation where IT does not own or distribute the endpoints. It is a user-driven phenomenon that IT must embrace and manage. The enterprise has to gain control of BYOD, or risk business anarchy that affects the enterprise’s productivity, security, privacy, regulatory compliance and reputation. Creating BYOD policy and enforcing it can be a headache for IT. There are no right or wrong policies or procedures. Each enterprise must develop its own decisions based on the business benefits, technology requirements, regulatory, security and privacy issues, and employee expectations and benefits.

Click here to read the free whitepaper!  

The post Fifteen Steps to Conquering BYOD appeared first on Finance Tech News.

Go to Source
Author:

Cloud computing is all the rage right now, and investing in cloud services can boost companies’ bottom lines. But for those investments to pay off, organizations must strategically plan what they should and shouldn’t move to the cloud. 

Planning a cloud computing strategy isn’t just IT’s job. As companies have moved more applications to the cloud, management in other areas is getting a greater say in the company’s decisions. In fact, 37% of IT pros said that non-IT managers are among the most influential decision makers when it comes to the company’s cloud computing strategy, according to a recent CDW survey.

For Finance, the role will most often be helping determine whether investing in cloud computing will pay off for the company. And a big part of that will be determining what the company should — and shouldn’t — move to the cloud. Some applications and services are well-suited for the cloud, while others may end up costing the company a lot if they’re moved away from the in-house infrastructure.

The cost of cloud computing

One important consideration, of course, is whether or not a cloud computing service will save the company money. That’s not as simple as comparing subscription fees with the cost of software licenses — there are many factors that affect how much both cloud services and in-house systems cost.

When it comes to cost, these were the top factors the 1,242 IT pros said their companies considered when deciding what to move to the cloud:

• Software management costs (cited by 65% of IT pros)
• Software licensing costs (63%)
• IT labor costs (52%)
• Cost of capital to the organization (41%)
• The cost of powering in-house operations (21%), and
• Real estate costs (12%).

However, the survey shows that most businesses fail to gather all of that information before making a decision. Just 37% of the survey respondents said they had all the data about costs that they needed.

What to keep out of the cloud

Aside from costs, there are a few other reasons an application or service may be better run on the company’s own network. When asked about their biggest concerns with cloud computing:

• 46% of IT pros said they were worried about security of data held in the cloud
• 32% were concerned about the performance of applications in the cloud
• 25% were worried about integrating cloud apps with legacy systems, and
• 20% had concerns about software licensing.

Due to those concerns, many experts recommend companies think twice about using cloud computing for running mission-critical applications or storing sensitive data, or for applications that need to interact with older in-house systems.

Here are some items organizations might twice about before moving to the cloud:

1. Stable, legacy applications — Apps that have been around for a while, are stable and predictable, and don’t require a lot of updating typically won’t use many resources when kept in house compared to newer, unfamiliar apps. Therefore, they often offer less benefit when they’re moved to the Cloud.
2. Highly integrated applications — Some software relies too much on other in-house applications so moving it to the Cloud could cause a lot of complications. That might include ERP systems or finance applications — if they’re already set up to run in-house, companies may want to keep them that way.
3. Data with regulatory requirements — While security is a concern, some companies have decided to put some sensitive and critical data in the hands of properly vetted cloud computing providers. However, organizations should be careful about any data with regulatory requirements regarding how it’s stored and protected. In many cases, the company is better off keeping that information on the office network.
4. Bandwidth-intensive activities — Cloud computing requires data to be sent back and forth using an Internet connection — therefore, companies are often better off keeping applications that require a lot data to be moved or have I/O needs in house.
5. Highly customized applications — Cloud computing providers sometimes allow for certain degrees of customization. But often if something needs a lot of tweaking to meet very specific specifications, it’s better kept in house.

What to migrate?

What applications belong in the cloud? These were the top cloud computing services respondents to CDW’s survey have adopted or are planning to adopt:

1. Conferencing and collaboration (cited by 68% of IT pros)
2. Storage (65%)
3. Office and productivity suites (65%)
4. Messaging (62%)
5. Compute power (59%)
6. Business process applications (57%)
7. External hosting for internally developed applications (55%), and
8. IT governance applications (51%).

Those choices also depend a lot on what industry the company’s in. For example, when respondents were divided by industry, storage was a top choice for cloud migration in every industry except for government and health care.

The most likely explanation is that those groups need to store more sensitive data than other organizations, and therefore aren’t comfortable using cloud-based storage services. Healthcare organizations and governments were likely to have moved to cloud computing for conferencing and collaboration software, office and productivity suites, and messaging applications.

The post What to move to the cloud? Keys for a cost-effective strategy appeared first on Finance Tech News.

Go to Source
Author:

Cloud computing is all the rage right now, and investing in cloud services can boost companies’ bottom lines. But for those investments to pay off, organizations must strategically plan what they should and shouldn’t move to the cloud. 

Planning a cloud computing strategy isn’t just IT’s job. As companies have moved more applications to the cloud, management in other areas is getting a greater say in the company’s decisions. In fact, 37% of IT pros said that non-IT managers are among the most influential decision makers when it comes to the company’s cloud computing strategy, according to a recent CDW survey.

For Finance, the role will most often be helping determine whether investing in cloud computing will pay off for the company. And a big part of that will be determining what the company should — and shouldn’t — move to the cloud. Some applications and services are well-suited for the cloud, while others may end up costing the company a lot if they’re moved away from the in-house infrastructure.

The cost of cloud computing

One important consideration, of course, is whether or not a cloud computing service will save the company money. That’s not as simple as comparing subscription fees with the cost of software licenses — there are many factors that affect how much both cloud services and in-house systems cost.

When it comes to cost, these were the top factors the 1,242 IT pros said their companies considered when deciding what to move to the cloud:

• Software management costs (cited by 65% of IT pros)
• Software licensing costs (63%)
• IT labor costs (52%)
• Cost of capital to the organization (41%)
• The cost of powering in-house operations (21%), and
• Real estate costs (12%).

However, the survey shows that most businesses fail to gather all of that information before making a decision. Just 37% of the survey respondents said they had all the data about costs that they needed.

What to keep out of the cloud

Aside from costs, there are a few other reasons an application or service may be better run on the company’s own network. When asked about their biggest concerns with cloud computing:

• 46% of IT pros said they were worried about security of data held in the cloud
• 32% were concerned about the performance of applications in the cloud
• 25% were worried about integrating cloud apps with legacy systems, and
• 20% had concerns about software licensing.

Due to those concerns, many experts recommend companies think twice about using cloud computing for running mission-critical applications or storing sensitive data, or for applications that need to interact with older in-house systems.

Here are some items organizations might twice about before moving to the cloud:

1. Stable, legacy applications — Apps that have been around for a while, are stable and predictable, and don’t require a lot of updating typically won’t use many resources when kept in house compared to newer, unfamiliar apps. Therefore, they often offer less benefit when they’re moved to the Cloud.
2. Highly integrated applications — Some software relies too much on other in-house applications so moving it to the Cloud could cause a lot of complications. That might include ERP systems or finance applications — if they’re already set up to run in-house, companies may want to keep them that way.
3. Data with regulatory requirements — While security is a concern, some companies have decided to put some sensitive and critical data in the hands of properly vetted cloud computing providers. However, organizations should be careful about any data with regulatory requirements regarding how it’s stored and protected. In many cases, the company is better off keeping that information on the office network.
4. Bandwidth-intensive activities — Cloud computing requires data to be sent back and forth using an Internet connection — therefore, companies are often better off keeping applications that require a lot data to be moved or have I/O needs in house.
5. Highly customized applications — Cloud computing providers sometimes allow for certain degrees of customization. But often if something needs a lot of tweaking to meet very specific specifications, it’s better kept in house.

What to migrate?

What applications belong in the cloud? These were the top cloud computing services respondents to CDW’s survey have adopted or are planning to adopt:

1. Conferencing and collaboration (cited by 68% of IT pros)
2. Storage (65%)
3. Office and productivity suites (65%)
4. Messaging (62%)
5. Compute power (59%)
6. Business process applications (57%)
7. External hosting for internally developed applications (55%), and
8. IT governance applications (51%).

Those choices also depend a lot on what industry the company’s in. For example, when respondents were divided by industry, storage was a top choice for cloud migration in every industry except for government and health care.

The most likely explanation is that those groups need to store more sensitive data than other organizations, and therefore aren’t comfortable using cloud-based storage services. Healthcare organizations and governments were likely to have moved to cloud computing for conferencing and collaboration software, office and productivity suites, and messaging applications.

The post Decide what to move to the cloud: A cost-effective strategy appeared first on Finance Tech News.

Go to Source
Author:

Companies can put a lot of work into protecting their own networks and avoiding costly data breaches. But breaches that occur at third-party vendors and other business partners can cost organizations just as much. 

When adding up the costs of a data breach, it doesn’t matter much which company’s “fault” the incident was. While some service providers assess penalties for security issues, the company could still be subject to costly legal action, a diminished reputation and whatever damage is done with the stolen information.

That’s the lesson Bank of America learned recently after an attack from the hacktivist group Anonymous.

The group claims it has 14 GB of data belonging to the bank — as well as Thompson Reuters, Bloomberg and a service provider called TEKsystems — that hackers stole from an unsecured server in Tel Aviv. Based on emails included in the stolen data, the group has surmised that Bank of America had contracted with TEKsystems.

The bank didn’t confirm that — but officials did say the data breach was the fault of third party and that it’s own network was never compromised.

Protect data from third-party breaches

Regardless of where a breach takes place, companies need to protect their data. And checking on the security of third parties is becoming even more critical as cloud computing becomes more common.

As more organizations turn to cloud services, more data is being held outside of the in-house network and on the networks of third parties.

To protect that data, here are some of the key security-related questions IT pros or others should ask cloud computing vendors before signing up for a service:

1. What are the policies and procedures in place to protect the physical data center, including the process for vetting employees who have access to clients’ data?
2. What’s the vendor’s privacy policy? Which employees have privileges to access sensitive customer data? What controls are in place to keep clients’ data safe from internal violations of the company’s privacy policy?
3. What technology is used to keep one client’s data separate from others’ on multi-tenant servers?
4. What encryption protocols does the vendor use to protect data in transit and at rest?
5. What authentication protocols does the vendor use to prevent access by unauthorized users?
6. Does the vendor properly handle data to comply with government regulations concerning privacy and security that your company must follow?
7. What are the vendor’s own audit procedures? Is it possible for you to audit them?

The post Protect against costly third-party data breaches: Key questions appeared first on Finance Tech News.

Go to Source
Author: