If you think a promiscuous client is a scantily-dressed customer, you're in trouble. And I'm not talking about having an affair.

Think an evil twin is a horror-movie villain? Wrong again. The horror you should be bracing yourself for is not on the silver screen — and it's not from a rolling pin flung at you from across the kitchen, for that matter. Rather, the trouble is in the airwaves and targeted to Wi-Fi users.

Both the "Promiscuous Client" and the "Evil Twin" are two of the latest wireless threats to your small business.

If you haven't heard of them, you probably will soon.

"What would happen to your business if your strongest competitor gained access to all of your data?" asks Greg Phillips, chief executive for AirTegrity Wireless, Inc., a Stateline, Nev. wireless security company. "Unfortunately, it is a very real possibility if appropriate controls against these new threats are not exercised."

So what's out there?

The Evil Twin. One of the most popular new threats to Wi-Fi users is the Evil Twin, sometimes referred to as WiPhishing. It's a rogue access point that replicates another network name, such as that of a hot-spot or a secure network. "The Evil Twin waits for a user to mistakenly sign into the wrong access point and captures the user's network data or attacks the computer," says Mike Klein, chief executive of Interlink Networks, Inc, an Ann Arbor, Mich. Wi-Fi security firm for small businesses. Klein recommends using an application like the free LucidLink Wireless Client (www.lucidlink.com), which automatically detects the change of security settings and warns the user to prevent an Evil Twin attack. He says it's also best to stay away from any open, or unsecured, wireless networks.
* The New War Drivers. Basically, War Driving is an unauthorized person hacking your company's wireless network. That's a problem if your network is open or not adequately secured. (Is yours? This is probably a good time to check.) "The War Driving threat only affects businesses with unsecured wireless networks," explains Nicholas Miller, chief executive of Cirond Corporation, a Campbell, Calif., wireless security company. "It can affect the security of confidential business data that resides on users laptops." So what's new about this threat? War Driving used to be an obscure pastime for hackers, who would cruise around in their compact cars looking for open networks. But lately, the new war drivers can also be competitors or disgruntled employees, sitting in the parking lot and trying to penetrate your network.

The Promiscuous Client.
A close cousin to the Evil Twin, Promiscuous Clients are opportunistic hazards to your business. Instead of associating with an access point that is placed near a public hotspot intentionally, and for malicious purposes, the promiscuous client is simply there for one reason or another, offering an irresistibly strong signal. "802.11 wireless cards often look for a stronger signal to connect to as well as look to hook up with a common SSID name," says Michael Maggio, the president of Newbury Networks, Inc., a Boston IT security firm. (I actually encountered a Promiscuous Client on a recent trip — one offering a terrific signal and speed. Fortunately, my laptop and I both survived the meeting.) Maggio suggests using a wireless "sniffer" (Microsoft Windows XP has one) that can help you monitor and test your network airspace. "The more you know about your layout — inside your offices, across the hallway, on the floors above and below you, as well as outside your bricks and mortar (business) — the better idea you'll have about where security breaches might occur," he says.
Bluesnarfing and Bluejacking. Your Bluetooth-enabled wireless device can leave you open to a hack attack, too. For example, Bluejacking allows unauthorized users to send a message to your phone. Bluesnarfers can steal data from your phone. But that's only part of the problem. Perhaps the more troubling issue is that these crimes are often untraceable. "The newest threat is the inability to perform forensics on this new technology," says Mark Lobel, director of PricewaterhouseCoopers' security services group. "You can try to stop an employee from doing bad things, but with some of the newest wireless technologies, you can not yet perform the forensics to determine what actually happened." These attacks can really leave you with the "blues," many experts say, so heed this advice: Turn off Bluetooth until you need it.
The cell phone virus. In a recent column, I took a closer look at the growing threat of cell phone infections. Several of the experts I interviewed suggested the worries might be overblown. But in the weeks ince the column appeared, says Ted Demopoulos, an IT consultant with Demopoulos Associates, in Durham N.H., a number of new cell phone viruses were identified. "Experts disagree on how serious the cell phone threats are," he says. "But it is wise to take some simple steps to protect against threats." Demopoulos says most small businesses ignore the data on their cell phones. By backing up the numbers, you can assure that they won't be lost if your phone ever succumbs to a virus outbreak.
#

Wireless network viruses. There are viruses, and then there are wireless viruses. For example, the virus worm MVW-WiFi, which bores into a laptop through a wireless network, sends out wireless probe request packets to find other local wireless networks and then forwards itself to adjacent wireless networks, according to David Sandel, the chief technology officer for NetLabs, LLC, a St. Louis networking company. "Its destructive capabilities are exponential in nature." His advice? Run antivirus software — and keep it updated.

Whether you're using a Bluetooth-enabled Personal Digital Assistant, a cell phone or a laptop, you can steer clear of most trouble by double-checking your security settings. That goes for your small business wireless network, too. Nearly two-thirds of all wireless users are on an unsecured network, according to several surveys. "That's pretty scary," says Scot Zarkiewicz, chief executive of SingleClick Systems, a Toms River, N.J., networking company for small businesses. "If there is one point that small businesses should know about wireless networking, it is that encryption is their best form of protection."

But the biggest wireless security threat, by far, isn't a virus or hacker attack. It is complacency, says Gary Morse, president of Razorpoint Security Technologies, Inc., a New York company that describes itself as "professional hackers." "We hear all the time, 'We're not a target,' or, 'We only need to secure the 'important machines,'" he says. "Awareness is the most critical point of fortification. If users are simply aware of what could take place, of what the true risks are, then everything else could be built on that."

-->Read more...

• 0 comments »

At first, the 802.11b hotspot I sprung for in 2003 seemed so frivolous that I didn't bother mentioning it to clients who visited my office. And since my PC remained wired to a high-speed land connection, I nearly forgot I had installed it.

Then one day I caught an editor who was visiting me as he tried to dial an Internet connection through the phone. I was horrified anyone would revert to dial-up in the 21st century, let alone my supervisor. "Why don't you use the Wi-Fi," I asked him.


It was nothing a wireless card and a password couldn't fix — but it did get me to thinking about the importance of having wireless Internet access in your office, and how that can help boost business.

A number of recent surveys link business productivity with wireless connections. But a 2004 Harris Interactive poll, in particular, caught my attention. It suggested that a quarter of all employees often work outside their regular office. It also said 14% of all office workers wanted more wireless networking tools.

Connect the dots on these two facts, and you could conclude that there's growing demand for wireless connections in small offices like yours. And not just by your own employees, but by visitors. According to industry studies, today's professionals are at their office desks only 30% of the time, and for frequent business travelers, the figure is even lower.

So how do you turn your wired office into a wireless workspace that's not only employee-friendly but also visitor-friendly? Here are six guidelines to follow.

1. Do your homework before you buy. The only thing worse than no wireless network is the wrong wireless network. "The most common mistake, when going wireless is not doing your homework or research before the equipment is bought and installed," says Larry Levy, a wireless troubleshooting expert based in Jacksonville, Fla. He's seen small-office managers pick wireless hardware that couldn't reach every part of the building, leaving big coverage gaps. Especially when it's a custom job using special hardware for encryption, it's important to pay attention to every detail.

2. Listen to your visitors. Are they asking for wireless access — or do they need speed? If your clients drop by your office with the intention of moving large files to and from their laptop computers, for example, then they may care more about bandwidth than convenience. "The assumption is that speed is the main determinant of access point quality," says Derek Kerton, a wireless expert and principal with The Kerton Group in San Jose, Calif. But that's not necessarily valid. An access point needs to be secure, interoperable with all client gear, and have long range, an easy user interface, and good instructions and support. "And if speed really is the goal, then string wire," he adds. "There is one-gigabit copper LAN equipment for sale at reasonable prices. So if speed is the metric, go for copper."

3. Don't confuse Bluetooth for Wi-Fi. Your visitors won't. In an effort to cut costs, some small businesses try to improvise by using Bluetooth as a cheap wireless network. "Bluetooth is designed as a cable-replacement technology, not as a way of linking multiple devices in a peer-to-peer network," says Robyn West, the vice president for small and medium business at Hewlett-Packard. Bottom line: In order to meet visitors' needs, you need both a reliable wireless network and at least a printer with Bluetooth capabilities.

4. Location, location, location. Where you put your access points is especially important when you want to be accommodating to your guests. Even if you've bought the right hardware, you have to put it in a place where it works best. And where's that? "Place your base station, gateway, or router near the center of your intended wireless network area," says Jim Caruso, chief executive officer of Telecom Alley, a technology consulting firm in Atlanta. "This will minimize the possibility of eavesdropping by neighboring wireless networks. Avoid placing wireless components close to electro-magnetic devices, especially those with frequencies in the 2.4-gigahertz range."

5. Remember: safety first. Your PC — and your visitor's PC — is twice as vulnerable to attacks on a wireless connection. It's an especially big problem for do-it-yourselfers, warns Gordon Bridge, president of CM IT Solutions in Austin, Texas. "None of the hardware providers offer on-site support," he says. "They try to make it easy to implement their products, but unfortunately, their products offer little security." Major breaches to the system wouldn't just affect your visitors — they'd affect you, too, since the outsiders would have access to your network. Bridge advises hiring a pro to fine-tune your wireless system.

6. Don't neglect the ongoing care and maintenance of your network. That's a surprisingly easy thing to forget when everyone else in your office generally works on a wired conventional network. But ignore the wireless access points at your own peril, says Todd Myers, the chief executive of Airpath Wireless, a hotspot provider based in Waltham, Mass. He recommends appointing one employee with oversight responsibility for the wireless network. But, he adds, give that person clear marching orders. "Open the network up to the visiting guests — but have it managed and also have it secure for employee network access," he says. "This can be accomplished by segmenting the private network and the public guest network."


For more tips on wireless networking for small offices, see this page.

If most of the employees in your small office remain connected to a conventional network, you might have second thoughts before investing in wireless technology. After all, why shell out perfectly good money for something only your guests are going to use? But that approach is shortsighted, according to Josh Radlein, a technology specialist with CDW Corp. in Vernon Hills, Ill. "We hear frequently that return-on-investment comes from productivity gains and the flexibility to shift people and resources around quickly to optimize available space," he says.

That long-term approach is what Sparkspace, a small business that offers conferencing facilities in Columbus, Ohio, took when it redesigned its office spaces. "I've noticed a high percentage of our guests now have wireless cards in their laptops. It seems like this trend took off almost overnight," says Mark Henson, who manages the facility.

The result? Not only do clients benefit from Wi-Fi. So have Sparkspace's employees. They have more freedom of movement within the office, which has revved up productivity. "And it adds a coolness factor, which fuels the perception of Sparkspace as a hip, cutting-edge kind of place for our guests," he adds. "That's good for PR."

-->Read more...

• 0 comments »

You probably know what a server can do for your office. But do you know what it can do when you're out of the office?

A 2003 survey of Small Business Server users conducted by Lawrence Associates LLC offers a clue. It found that employees were able to perform an average of 20% more revenue-producing tasks, thanks in no small part to functions that allowed them to stay connected to their office computers while they were away.

Ann Westerheim knows about these productivity gains firsthand.
As the president of Ekaru, a Westford, Mass., small-business technology adviser, she's seen the benefits in client after client.

One of her customers is a small law office in which the principal attorney's home is linked to the main office through a server's remote-connectivity features. Another small-business client is a marketing firm with employees constantly on the go.

"Thanks to the server," Westerheim says, "the connection between employees is seamless."

Ask any small-business owner about server technology, and you may get an earful about the complexity of deployment — the costs of hiring a computer guru to pull a network together, buying the right hardware, and so forth. But many server experts today say that's not the problem. Quite the opposite: A product such as Windows Small Business Server 2003 is relatively easy — and painless — to install, they say.

No, they say, the trouble is that today's server software tends to be so rich in features that there's a real chance that some of the best tools for productivity gains might be overlooked — or underused. So if you already have a server, or are considering one, here are a few connections in Windows Small Business Server 2003 you might have missed:

1. You get the mobility features of Exchange. If you're already using Windows Small Business Server 2003, you've probably discovered that it incorporates Microsoft Exchange Server's mobile-office friendly functions, such as its scheduling, contact, and task management. But did you also know that Exchange supports mobile devices such as Pocket PCs and Smartphones? It also allows users to access their e-mail remotely through a simple Web browser, via Outlook Web Access.

Exchange also comes with a few lesser-known benefits that will affect your productivity, like anti-spam and virus protection features. (For more Exchange features, see this overview.)

2. Hey, there's a VPN in there too. The Remote Web Workplace, a robust Web resource for remote users, offers access to e-mail, remote desktops, and your company's internal Web site, and is one of the key connectivity features in Small Business Server. But what you might not know is that the program also includes advanced virtual private network (VPN) capabilities that are easy to turn on. (Incidentally, setting up a VPN is remarkably simple, all things considered. No, you can't do it in three easy steps, but the document available at this page will show you how to do it in 11 steps. See "Manual Configuration of a VPN Remote Access Connection.")

3. Collaborate and share with SharePoint.

You may have also noticed that Small Business Server 2003 uses Windows SharePoint Services, which enables you to collaborate among employees and business partners. For instance, users can post documents into shared libraries and peruse a company's vacation calendar to make sure they're not overlapping with a co-worker's off-time. For mobile workers, Windows SharePoint Services also allows you to synchronize data in Microsoft Office Outlook 2003 with data from SharePoint, so you trade and update leads with a team of co-workers even while you're away. (Here's more on how to do it.)


4. Work safe and secure. The security features in Small Business Server 2003 are pretty impressive. You may have heard that because the program is based on Windows Server 2003, it can mitigate attacks against the server by 60%. You may also know that Small Business Server 2003 includes internal firewalls and that it supports external firewalls. But the security also extends to you and your employees when you're out of the office. Small Business Server 2003 helps make it easy for your entire office to share files across the network, from anywhere, without having to worry so much about security. You also can easily do regular data backups, via the Backup Configuration Wizard. (See this demonstration of Small Business Server's security features.)

For advanced security and Internet connectivity needs, Small Business Server's premium edition includes Microsoft Internet Security and Acceleration (ISA) Server 2000. (For more information about Small Business Server 2003's standard and premium editions, see this page.)

But do you need a server? Not necessarily. Mike Landman, the president of 3rd Wave, an Atlanta-based information-technology solutions provider, says every business isn't a candidate for a server. But most of them are.

"We would recommend a file server for every company over two people," he says. Not only does it offer advanced connectivity features, but it also allows you to perform advanced centralization and backup tasks, he notes. "The productivity gains are quite high."

-->Read more...

• 0 comments »

Many small-business owners shell out big bucks for high-speed Internet access. The savings in time are usually rewarded with higher productivity.

If your high-speed system happens to be running slower than a clogged drain, don't complain just yet. Before you pay for an expensive in-office visit from your Internet service provider's tech support, here are four things you should consider.

1. Know your speed. You can sit at your computer with a stopwatch to see how long it takes to connect to your favorite Web site. But this is not a very good indication of download speed. Believe me, I've tried it. There are too many variables involved. I suggest you call the ISP and ask. The ISP probably can check download speeds on your line remotely. The number you get from the technician will probably be a best case figure; real-world Internet traffic can be bogged down.Or, you can also easily check your speed online, through MSN Tech & Gadgets' Internet speed test. Two other good sites are at BroadbandReports.com (formerly DSLReports) and Bandwidthplace.com. All three sites send data to your computer. The tests calculate the connection speed based upon the elapsed time it takes to download and upload the data.You may receive different results based on which test you use and where that test's server is located. For example, BroadbandReports offers servers throughout the world, while Bandwidthplace's test server is located in Texas. The further away you are from a server, the greater chance you'll encounter bottlenecks.The speed tests can give you a baseline speed. To establish that baseline, test your connection speeds throughout the day and keep a log. If there is a noticeable difference during specific times of the day, you'll be able to troubleshoot better.

2. Start at the source. You could have one of the fastest connections in the world. But if your computers are old, it won't matter much. When surfing the Net, you are downloading information. Some Web sites are simple and don't require much processing power. But most are heavy on graphics and code. A modern, fast chip will process and display the pages quickly.Memory is crucial, too. A Web page is loaded into your computer's memory. If there's not enough memory, some data is saved as a swap file on the hard drive. This can really slow things down, especially if you are running multiple applications. If you are using Windows XP or Windows 2000, you need a minimum of 256 megabytes of RAM. Windows 98 and Windows Me require 64 MB. Don't worry about purchasing a separate video card for your company's computers. Video cards are great for processing intense graphic images you'll encounter in games and video editing. When it comes to the Net, you won't see much difference between a system that uses an integrated video card and one with a video card separate from the motherboard.

3. Clean the cache. If you have the latest and greatest processor with plenty of memory, your Web browser may be causing the slowdown. After weeks spent on the Internet, your Web browser can get bogged down from temporary files. It's time to do some spring cleaning.Go into your Web browser and clear out your history and temporary files. To do this in Internet Explorer, click Tools and Internet Options. On the General tab, click Delete Files (place a check mark next to Delete all offline content) and Clear History.In Netscape, click Edit and Preferences. Under Navigator, find History. Click Clear History. Under Advanced, click Cache. Click Clear Disk Cache.If you're using Apple's Safari, click Safari and Empty Cache. Reboot the computer.

4. Tweak your settings.

You may need to configure your computers' settings to take advantage of broadband. BroadbandReports has a "Tweak Test" that will examine your computer's configuration (from the BroadbandReports home page, click on "Test & Tools" at left). After the test, enter the service you have (cable, DSL, etc.), advertised speed, operating system and connection type. Click recommend.You'll find a series of settings that can be changed along with notes and recommendations. Recommendations are broken into five categories, ranging from "something good" to "big problem." If your computer is not optimized to maximum, you'll probably find that DrTCP is recommended. This is a small, free program at BroadbandReports that acts as a GUI interface into your registry. Before changing any of your settings, I recommend you read the FAQ on the program at the BroadbandReports' site (www.dslreports.com/faq/578). If you are still experiencing unusually slow speeds, you might have to call in an expert. Your ISP's small-business tech support might have to come to your office to evaluate the situation. There may be an internal hardware issue (your router, modem, networking wires, etc.) causing the creeping service. Lagging service can also be caused by the lines outside your company's walls. There are many outside influences that can cause slow-surfing problems. The Internet is a system of countless networks. When delays occur, it's not necessarily your fault.

-->Read more...

• 0 comments »

Mention the words "battery life." The first gadget that comes to mind is probably the energy-consuming laptop computer — particularly if you're on the go a lot.

If not, it should be. There never seems to be enough juice to run your portable PC, as I griped about in a previous article. Ah, but if laptop PCs were the extent of your battery blues, you might not feel so, well, powerless.

But power problems plague other mobile devices. For example, a 2003 In-Stat/MDR survey found that long battery life ranked as the most important feature to business users when selecting a wireless handset. Users of personal digital assistants (PDAs) are just as concerned about a possible energy crisis. I know because I am one and I never seem to stop worrying about running dry.

So, what about mobile gadgets?

How do you make sure your batteries last as long as possible? Here are four tips.

1. Follow instructions and use them right — right from the start. "All batteries should be properly conditioned prior to first use," says Larry O'Connor, chief executive of Other World Computing, a Woodstock, Ill., developer of battery solutions and computer enhancement products. "You must properly prepare the battery by following the first charge and use instructions." And what if you don't? O'Connor warns that failure to follow can shorten the life or runtime of your battery. "Follow the instructions to the letter and that battery will give you a lot more," he says.

2. Don't overcharge them. When it comes to batteries for small devices such as PDAs, cell phones or Tablet PCs, the single biggest mistake users make is leaving them plugged in to the charger for lengthy periods after they've been fully recharged. "Leaving the batteries, at least those types associated with these devices, on charge for endless periods will reduce the overall life of the battery," warns Paul Klatt, a quality assurance engineer for Batteries Plus, a Hartland, Wis., commercial-battery distributor. He says battery chargers normally taper down when the battery is fully charged. "However, enduring weeks of even a 'trickle charge' creates heat buildup and will eventually cause premature battery failure," Klatt says. How do you avoid overcharging? Remove the charger right after the battery is fully charged.

3. Use them at regular intervals.

This is a problem that affects spare batteries, but it can also be a factor on a backup unit, such as a second cell phone. O'Connor says batteries have to be used in order to get the most out of them. "If you have spares, cycle them at least once every six months — or even better, every three months," he says. "This will go a long way in keeping your batteries maintained to properly perform."

4. Stay away from cheap-o replacements. "Quality is very important when it comes to replacement batteries," says Stefan Betesh, vice president of product development for Sakar International, an Edison, N.J., consumer electronic products manufacturer. Many lesser-known but cheaper brands cut corners when they make their batteries. That can affect the overall life expectancy and performance of the battery. Worse, the batteries may be defective because "most low-end batteries are refurbished or just not working with quality control," he says. His recommendation? Go with a recognized brand and buy from a reputable source.

But let's be honest: Keeping your batteries at peak performance is a lot like taking care of an infant. Lots of "dos" and "don'ts" to remember — change this, stay away from that, follow the directions, etc.

Does anyone expect you to do all of this?

Well, not really.

I leave my cell phone charger plugged in overnight from time to time (OK, more than that) and I've never cycled my batteries. Is there a solution for those of us who really couldn't be bothered?

I spoke with Bill Acker, president and CEO of MTI Micro Fuel Cells, an Albany, N.Y., battery manufacturer. He tells me that fuel cells will soon become alternatives to today's high-maintenance lithium-ion batteries. The new technology can hold up to 10 times more of a charge than conventional batteries. "For the first time," he says, "wireless and other electronic hand held devices will be truly wireless." But fuel cell technology and other innovations like it are still a few years away from being widely available. Until then, these four tips can help you stretch your power supply to the limit.

-->Read more...

• 0 comments »

With the growth of online collaboration suites such as GoogleApps, protecting data and sign-on credentials across public networks needs to be a priority.

In 2007, logon details for my personal e-mail account were compromised and used to send spam. While the consequences were minimal (see “User Name and Password Compromised,” below), in a business scenario, a similar incident could lead to lost revenue, breach of trust and even running afoul of the law. The e-mail service was hosted by a third party, but was there anything I could have done to better protect myself?
Never Assume You’re Secure by Default

The use of notebooks on open networks in airports and cafes poses a threat to information security, starting with users’ sign-on credentials. While it would be prudent to use smart card or certificate-based, two-factor authentication, user-name and password-only combinations are still commonplace in many small and medium-size businesses.

It’s often assumed that cloud-based e-mail and collaboration tools are secure by default. Read on to learn about the standard security provisions of popular cloud-based collaboration and e-mail services — Google Apps and Microsoft Office Live — and what you should know before using their services.

Microsoft Office Live Workspace

As you might expect, Office Live Workspace uses Windows Live ID for authentication. Users will be familiar with this system if they’ve ever used Hotmail (now Windows Live Mail) or other services from Microsoft. Previously known as Microsoft Passport, Windows Live ID was intended to provide authentication for all manner of online services against a central database held by Microsoft. However, the concept of any single vendor maintaining such a system, which if breached could give access to multiple sites through a single set of credentials, didn’t go down well with users or service providers. Passport eventually evolved into Windows Live ID, which gives access only to Windows Live and other Microsoft services.

Signing in to Office Live is essentially the same as for Google Apps, but users should be aware that sometimes Office Live defaults to standard security sign-in, meaning that IDs and passwords are transmitted in plain text. Enhanced security mode (Figure 1) uses HTTPS to encrypt IDs and passwords as they’re sent over the wire. Once signed in to Office Live, there is no encryption when viewing or uploading documents over the web interface, but Microsoft is hoping to add Secure Sockets Layer encryption in the future.


Figure 1
Windows CardSpace

One advantage that Office Live has over Google Apps is that Live ID integrates with Windows CardSpace. Part of the .NET Framework and built into Vista, CardSpace manages information cards, which can be created by the user as a form of identification. Information from the card and a site-specific card ID is exchanged with Live ID to be used on a particular site. Once configured, a personal information card (Figure 2) can be used to sign in to Office Live without having to provide a password every time.


Figure 2

A single card can be used to sign in to several sites — for instance, a Windows Live Mail account and an Office Live Workspace (Figure 3) — saving users from having to remember different passwords. Information cards use advanced cryptography to ensure the security of information over the wire. They are used to safeguard against phishing attacks.


Figure 3

The Microsoft Office Live Add-in and Outlook Connector, both applications that integrate Office desktop apps with Office Live services, are not compatible with CardSpace and don’t transfer data using HTTPS after a secure sign-on.

While information cards may not be very portable, it is possible to export cards and transfer them to another machine, and they can be additionally protected with a personal identification number (Figure 4). Live ID support for CardSpace is still in beta, but CardSpace is compatible with any site that works with Open ID.


Figure 4

Microsoft is currently working on the next version of Active Directory Federation Services, code-name Geneva, which will incorporate a new CardSpace identity selector and allow organizations to provide single sign-on facilities that extend to cloud services.
Google Apps

Out-of-the-box sign-on to Google Apps is by user name and password, but unlike Office Live, is not compatible with Windows CardSpace. Nevertheless, Google Apps has a well-supported marketplace where it’s possible to buy third-party authentication services. On the flip side, Google Apps offers data security through HTTPS, ensuring that the contents of e-mail and documents are encrypted over the wire (Figure 5). Be aware that this feature is not enabled by default.


Figure 5

The Premier edition of Google Apps allows sysadmins to enforce the use of SSL connections to protect session data, and there are password management features along with single sign-on capability in the Premier, Education and Partners editions.
E-mail in the Cloud

POP3 and SMTP were around long before the cloud-computing revolution, and there are still advantages to using a mail client, such as Outlook, to manage cloud e-mail, calendaring and contacts. Most web-based access to cloud services will automatically default to securing sign-on credentials using HTTPS, but this is not necessarily the case when using a desktop application. If you’re using SMTP, POP3 or IMAP to connect to Windows Live Mail or Gmail, be sure to follow the instructions carefully for setting up secure connections.

Outlook supports secure IMAP, POP3 and SMTP (Figure 6). These secure protocols can be used to protect both passwords and session data. Secure Password Authentication (SPA), more commonly known as Microsoft NTLM, can be enabled to secure credentials but does not encrypt session data.


Figure 6
IT Takeaway

While large enterprises may be able to afford all the trappings of multifactor security solutions and identity management, small businesses and self-employed entrepreneurs are vulnerable if they don’t understand the implications of exchanging credentials and data across open networks. If your business is also subject to regulatory compliance, you should think twice before sending e-mail or plain-text files when away from the office.

If all these technical details are mind-boggling, a simple solution might be to route Internet traffic through an encrypted virtual private network when using an open network, either to your corporate LAN or to a trusted third party, to ensure that your data and credentials are kept secure.
User Name and Password Compromised

In December 2007, I began receiving an unusually high amount of spam, addressed from myself, on my POP3/SMTP mail. After ignoring this situation for a few weeks, I found myself unable to retrieve POP3 mail. My provider informed me that they’d disabled my account due to the unusually high amount of traffic it was generating on their SMTP servers.

As a user name and password were required to send SMTP mail using my account, I decided to take my password security a little more seriously, disabled all POP3 and SMTP services from the previously compromised account and switched to Gmail, which provides secure IMAP and SMTP/TLS. This way, I could ensure that not only were my sign-on credentials safeguarded, but all information contained within e-mail would be protected when using public networks.


How the Apps Stack Up

Office Live Google Apps
Secure browser sign-on via HTTPS Yes Yes
Secure browser session data No Yes
Enforce session data HTTPS n/a Yes (Premier edition)
Password management features No Yes
Windows CardSpace support Yes No
Secure IMAP No Yes
Secure POP3/SMTP Yes Yes
Outlook integration Yes (Secure credentials but not session data via DeltaSync) No (but Outlook does have secure IMAP for mail only support)
Microsoft Office integration Yes (Secure credentials but not session data) No

-->Read more...

• 0 comments »

Fundamental changes to the migration strategy in Small Business Server 2008 have made the migration process more flexible and less disruptive to end users than in previous versions. While migration to SBS 2008 still requires detailed planning and testing, Microsoft provided a three-week window in which administrators can stage the migration, relieving the pressure to move all applications and user data in one shot.

SBS 2003 and SBS 2008 can now coexist in the same domain for up to 21 days, solely for purpose of easing the migration process. Once migration is complete, the source server is demoted, leaving only one SBS server in the domain per the standard licensing requirements. Because SBS client computers no longer need to be moved from old domain to new, the migration process can be completed during office hours without interruption to end users.

The Active Directory Migration Tool (ADMT) and Exchange Migration Wizard (used for migration to SBS 2003) are gone, and standard Active Directory (AD) and Exchange administration tools can be used to perform migration tasks once the new SBS 2008 server has been joined to the domain. Microsoft supports migration from Windows Server 2003 and SBS 2003, providing extra help for those migrating from SBS 2003 with a wizard that guides sysadmins through post-migration tasks.
Preparing for Migration

SBS 2008 does not include Internet Security and Acceleration Server (ISA) in any form, so before migration you will need to change your network infrastructure to support an Internet router and configure SBS 2003 to use just one network interface.

The SBS 2008 installer will run in migration mode and check for service packs on the following components if they are installed on the source server: Exchange 2003 SP2, Windows Server 2003 SP2, SBS 2003 SP1 and Windows SharePoint Services 2.0 SP3.
Here is a pre-migration checklist:

1. Minimize the amount of data that will be transferred to the new server by asking users to delete all unnecessary e-mail and empty their Deleted Items folders.
2. Make sure that the date, time and time zones match across source and destination servers. On the destination server, check these details in the BIOS.
3. Back up the source server.
4. Install the latest service packs for all server components.
5. Install the .NET Framework 2.0 (or later) on the source server. This is required by the migration tools.



Preparing the Source Domain

The domain and forest functional levels must be raised before running the Source Server Migration Tool. To raise the domain functional level to 2003 on the source server, log on as administrator:

1. Open Active Directory Domains and Trusts from Administrative Tools on the Start menu.
2. Right click your SBS domain in the left pane and select Raise Domain Functional Level from the menu.
3. Windows Server 2003 is the only functional level available, so it already will be selected. Click Raise and then OK to confirm the operation. Click OK once more to complete the task.

Repeat this procedure to raise the forest functional level, right clicking instead on Active Directory Domains and Trusts in the left pane and selecting Raise Forest Functional Level from the menu. Before proceeding, run the SBS 2003 Best Practices Analyzer, which can be downloaded here [http://go.microsoft.com/fwlink/?LinkId=113752], and correct any problems that the tool reports.

Now run the Source Server Migration Tool from the SBS 2008 disk on the source server:

1. Log on with an administrator account that is a member of Enterprise Admins, Schema Admins and Domain Admins.
2. Insert SBS 2008 DVD 1 into the source server and run SourceTool in the tools folder.
3. Confirm that you have made a backup of the source server and click Next.
4. Wait while the tool updates the AD schema, updates licensing and modifies Exchange to run in Native mode. Click Finish once the process has completed, and reboot the server.

The built-in administrator account is disabled by default in SBS 2008, so it’s best practice to create an account for migration purposes. Create a new user account on the source server called migration and make sure that it’s a member of the Domain Admins, Enterprise Admins and Schema Admins groups. Now you’re ready to create an answer file to install SBS 2008 in migration mode:

1. Run sbsafg.exe in the tools folder on the SBS 2008 DVD 1.
2. Select Migration from existing server (Join existing domain).
3. Set the time zone by checking Use the following time zone and select the appropriate zone from the menu.
4. To simplify the process in this walkthrough, uncheck Windows Live OneCare and Forefront Security under Trial security services to prevent them from installing on SBS 2008.
5. Fill out your company, source and destination server information as appropriate (Figure 1).
6. Once all the information is complete, save the file to the root directory of a removable USB drive as sbsanswerfile.xml.


Figure 1
Install SBS 2008 in Migration Mode

1. Boot the SBS 2008 hardware from the SBS 2008 DVD 1 disk.
2. Select your language and regional settings, and click Next to continue.
3. Insert the removable USB drive that contains the answer file and click Install Now.

Follow the setup process for a usual installation of Windows Server, selecting the partition on which to install the operating system, etc. The server will restart twice, and if sbsanswerfile.xml is successfully detected after installation, setup will log on using the migration user specified in the file and continue with an automated setup of the SBS components, using the information provided.
Post-Installation Tasks

Once setup is complete, you’ll be prompted to address any problems detected during installation (Figure 2).


Figure 2

What happens next depends on whether the source server is Windows Server 2003 or SBS 2003. The SBS Console’s Migration Wizard (Figure 3) is only supported if the source server is SBS 2003. The Migration Wizard serves as a guide for sysadmins of what to do and in what order.


Figure 3

While there is no need to migrate user accounts or groups, they do not appear in the SBS Console by default. To remedy this problem, follow the steps below to set the msSBSCreationState attribute on AD user and group objects:

1. Run adsiedit.msc from the Start Search box on the Start menu.
2. Right click ADSI Edit in the left pane of the MMC console, select Connect to from the menu and then click OK to accept the default connection settings.
3. Expand Default Naming Context in the left pane and browse for the group(s) or user(s) you want to add to the SBS Console. Right click the user(s) or group(s) and select Properties from the menu.
4. Select msSBSCreationState on the Attributes Editor tab and click Edit. Change the value to Create, with a capital C, and click OK (Figure 4).


Figure 4
5. Additionally, for groups, you need to set the groupType attribute to define the group as either a security or distribution group. Set the value to –2147483640 for security groups and 8 for distribution groups.

Note that if you upgraded from SBS 2003, you should use the above procedure for groups only, and follow instructions in the Migration Wizard for migrating users. If the source server is Windows Server 2003, the SBS Console can be used to assign roles to migrated users.
Once your users and groups are in order, you should move Exchange mailboxes to the new server, which is an easy task with the Exchange Server 2007 Management Console:

1. Open the Exchange 2007 Management Console on the destination server from All Programs > Microsoft Exchange Server 2007 on the Start menu.
2. Expand Recipient Configuration in the left pane and then click Mailbox.
3. Select all mailboxes in the central pane that display as Legacy Mailbox and click Move Mailbox in the right pane (Figure 5).


Figure 5
4. Click Browse on the first screen of the Move Mailbox Wizard, select the default mailbox database on the destination server and click Next.
5. Configure move options to skip mailboxes with corrupted messages and set the Global Catalog and Domain Controller to be the destination server (Figure 6). Click Next to continue.


Figure 6
6. Opt to begin the move operation immediately and click Next.
7. Review the details on the summary screen and click Move.
8. Check that the move was successful on the completion screen and click Finish.

Mailboxes can be moved to the new server during office hours, but be aware of the extra workload this will put on both source and destination servers. Users can continue working while their mailboxes are being moved; they will be prompted to restart Outlook once the operation is complete. No reconfiguration is required.

The final step is to decommission or repurpose the source server. You should uninstall Exchange and then demote the source server, using dcpromo.exe to change its status to a member server, rather than simply reformatting the disk.
IT Takeaway

Though many of the steps required to migrate to SBS 2008 are still manual, the ability to join the new server to an existing SBS domain helps to ensure that end users will not be disrupted during the migration process, and enables sysadmins to stage the migration over several weeks, minimizing the risk that something could go wrong. With both source and destination servers in one domain, migration tasks are easier and less prone to errors than in previous versions of SBS. SharePoint and SQL databases will also need to be moved if they exist on the source server.

Russell Smith is an independent consultant based in the United Kingdom who specializes in Microsoft systems management.

-->Read more...

• 0 comments »