Author: simonmackay

Introduction

Alastair MacGibbon – Centre For Internet Safety (University of Camberra)

I have been invited to do an interview with Alastair MacGibbon of Centre For Internet Safety (University Of Canberra) and Brahman Thiyagalingham of SAI Global who is involved in auditing computing service providers for data security compliance.

This interview and the presentation delivered by Alastair which I attended subsequently is about the issue of data security in the cloud-driven “computing-as-a-service” world of information technology.

Cloud based computing

We often hear the term “cloud computing” being used to describe newer outsourced computing setups, especially those which use multiple data centers and servers. But, for the context of this interview, we use this term to cover all “computing-as-a-service” models that are in place.

Brahman Thyagalingham – SAI Global

These “cloud-based computing” setups are in use by every consumer and business owner or manager as they go through their online and offline lives. Examples of these include client-based and Web-based email services, the Social Web (Facebook, Twitter, etc), photo-sharing services and online-gaming services. But it also encompasses systems that are part of our everyday lives like payment for goods and services; the use of public transport including air travel; as well as private and public medical services.

This is an increasing trend as an increasing number of companies offer information solutions for our work or play life that are dependent on some form of “computing-as-a-service” backend. It also encompasses building control, security and energy management; as well as telehealth with these services offered through the use of outsourced backend servers.

Factors concerning cloud-based computing and data security

Risks to data

There are many risks that can affect data in cloud-based computing and other “computing-as-a-service” setups.

Data theft

The most obvious and highly-publicised risk is threats to data security. This can come in the form of the computing infrastructure being hacked including malware attacks on client or other computers in the infrastructure to social-engineering attacks on the service’s participants.

A clear example of this were the recent attacks on Sony’s online gaming systems like the PlayStation Network. Here, there was a successful break-in in April which caused Sony to shut down the PlayStation Network and Qriocity for a month. Then, a break-in attempt on many of the PlayStation Network accounts had taken place this week ending 13 October 2011.

The attack on data isn’t just by lonely script kiddies anymore. It is being performed by organised crime; competitors engaging in industrial espionage and nation states engaging in economic or political espionage. The data that is being stolen is identities of end-users; personal and business financial data; and business intellectual property like customer information, the “secret sauce” and details about the brand and image.

Other risks

Other situations can occur that compromise the integrity of the data, For example, a computing service provider could become insolvent or change ownership. This can affect the continuity of the computing service and the availability of the data on the systems. It also can affect who owns the actual data held in these systems.

Another situation can occur if there is a system or network breakdown or drop in performance. This may be caused by a security breach; but can be caused by ageing hardware and software or, as I have seen more recently, an oversubscribed service where there is more demand than the service can handle. I have mentioned this latest scenario in HomeNetworking01.info in relation to Web-based email providers like Gmail becoming oversubscribed and performing too slowly for their users.

Common rhetoric delivered to end-users of computing services

The industry focuses the responsibility of data security for these services on to the end-users of the services.

Typically the mantra is to keep software on end computers (including firmware on dedicated devices) up-to-date; develop good password habits by using strong passwords that are regularly changed and not visible to others; and make backup copies of the data.

New trends brought on by the Social Web

But there are factors that are being undone by the use of the Social Web. One is the use of password-reset questions and procedures that are based on factors known to the end user. Here, the factors can be disclosed by crawling data left available on social-networking sites, blogs and similar services.

Similarly, consumer sites like forums, and comment trees are implementing single-sign-on setups that use credential pools hosted by other services popular to consumers; namely Google, Facebook and Windows Live. This also extends to “account-tying” by popular services so that you are logged on to one service if you are logged on to another. These can create a weaker security environment and aren’t valued by companies like banks which hold high-stakes data.

The new direction

As well, it has been previously very easy for a service provider to absolve themselves of the responsibility they have to their users and the data they create. This has been through the use of complex legalese in their service agreements that users have to assent to before they sign up to the service.

Now the weight for data security is now being placed primarily on the service providers who offer these services to the end users rather than the end users themselves. Even if the service provider is providing technology to facilitate another organisation’s operations, they will have to be responsible for that organisation’s data and the data stream created by the organisation’s customers.

Handling a data break-in or similar incident

Common procedures taken by service providers

A typical procedure in handling a compromised user account is that the account is locked down by the service provider. The user is then forced to set a new password for that account. In the case of banking and other cards that are compromised, the compromised account cards would be voided sot that retailers or ATMs seize them and the customer would be issued with a new card and have to determine a new PIN.

The question that was raised in the interview and presentation today is what was placed at risk during the recent Sony break-ins. The typical report was that the customers’ login credentials were compromised, with some doubtful talk about the customers’ credit-card and stored-value-wallet data being at risk.

Inconsistent data-protection laws

One issue that was raised today was inconsistent data-protection laws that were in place across the globe. An example of this is Australia – the “She’ll Be Right” nation. Compared to the USA and the UK, Australians don’t benefit from data-protection laws that require data-compromise disclosure.

What is needed in a robust data-compromise-disclosure law or regulation is for data-security incidents to the disclosed properly and promptly to the law-enforcement authorities and the end-users.

This should cover what data was affected, which end-users were placed at risk by the security breach, when the incident took place and where it took place

International issues

We also raised the issue of what happens if the situation crosses national borders. Here nations would have to set out practices in handling these incidents.

It may be an issue that has to evolved in the similar way that other factors of international law like extradition, international child-custody/access, and money-laundering have evolved.

Use of industry standards

Customers place trust in brands associated with products and services. The example that we were talking about with the Sony data breach was the Sony name has been well-respected for audio-visual electronics since the 1960s. As well, the PlayStation name was a brand of respect associated with a highly-innovative electronic gaming experience. But these names were compromised in the recent security incidents.

There is a demand for standards that prove the ability for a computing service provider to provide a stable proper secure computing service. Analogies that we raised were those standards that were in place to assure the provision of safe goods like those concerning vehicle parts like windscreens or those affecting the fire-safety rating of the upholstered furniture and soft-furnishings in the hotel that we were in during the afternoon.

Examples of these are the nationally-recognised standards bodies like Standards Australia, British Standards Institute and Underwriters Laboratories. As well there have been internationally-recognised standards bodies like the International Standards Organisation; and industry-driven standards groups like DLNA.

The standards we were focusing on today were the ISO 27001 which covers information security and the ISO 20000 which covers IT service management.

Regulation of standards

Here, the government regulators need to “have teeth” when it comes to assuring proper compliance. This includes the ability to issue severe fines against companies who aren’t handling the data breaches responsibly as well as mitigation of these fines for companies who had an incident but had audited compliance to the standards. This would be demonstrated with evidence of compliant workflow through their procedures, especially through the data incident.

As well, Brahmin had underscored the need for regular auditing of “computing as a service” providers so they can prove to customers and end users that they have procedures in place to deal with data incidents.

I would augment this with the use of a customer-recognisable distinct “Trusted Computing Service Provider” logo that can only be used if the company is compliant the the standards in their processes. The logo would be promoted with a customer-facing advertising campaign that promotes the virtues of buying serviced computing from a compliant provider. This would be the “computing-as-a-service” equivalent of the classic “Good Housekeeping Seal” that was used for food and kitchen equipment in the USA,

Conclusion

What I have taken from this event is that the effort for maintaining a secure computing service is now moving away from the customer who uses the service towards the provider who provides the service. As well, there is a requirement to establish and enforce industry-recognised standards concerning the provision of these services.

Introduction

I have seen the Brother VM-100 visitor-management software in action for myself when I visited Brother’s headquarters in Sydney for the interview that I did with Stephen Bennett and Heidi Webster last year. Now I have the chance to put this same software through its paces as an entry-level visitor management setup for that small office.

Price:

Software package: AUD$399

System kit with QL-570 printer: AUD$499

In some areas, the system kit with the label printer would be known as the VM-100VP whereas in other areas it would be known as the QL-570VP. This will be of importance when you want to track down the visitor management system as a full kit.

These also include a roll of thermal paper for the label printer as well as a starter-pack of 12 badge holders and clips.

The software works on the Windows desktop computing platform with an operating system from Windows XP onwards. This would cover most computers deployed in the small-business world over the last ten years.

Functions

Login screen

The software is able to work as a receptionist-aided mode for the typical reception desk or as a self-check-in mode for conferences and trade events.The data in this software is password-protected and when administrators log in, they either can log in as a user with no administrator privileges available or as an administrator that only can work the higher-level functions.

It is also feasible to set inactive visitor data to be automatically purged after a certain time period ranging from a week to a year; which keeps with different individual-privacy and data-protection requirements.

The standard receptionist-aided mode allows the creation of a visitor badge and a parking permit, with the latter supporting a loosely-described vehicle for the parking permit. It also supports the creation of a “reserve list” which is populated with visitors who have been pre-registered and are intending to be checked in. This works well if you have the staff inform the receptionist of expected visitors, are handling large visitor groups or you want to use this software for managing an “invitation-only” event with the list full of RSVP’d invitees. Parents, take note here when it comes to managing that 16th birthday and you want to make sure that the party isn’t overrun by gatecrashers.

Receptionist's data-entry screen

The Brother VM-100 software has the ability to turn out an “emergency list” of visitors who are currently checked using the regular printer for whenever you need to reconcile whoever is in the building during emergency situations. As well, the data can be exported as CSV (comma-separated) text files for use with other programs. This same data form is also used to import potential hosts in to the “hosts” table. This supports hosts coming from different departments or organisations, thus able to work with larger multi-department organisations or buildings that have many tenants but one common reception desk.

Experience with the software

When you install the software, you have to restart the computer after the installation process is completed. Otherwise the program won’t work properly. As well, there are error messages that are simply “generic error” stub messages appearing if things go wrong through the installation.

Self-checkin screen for conference registration

The username and password setup allows suitably-privileged users to operate either as regular users or administratiors. The only limitation is that the password string only handles basic alphanumeric characters – it doesn’t allow the use of punctuation in the passwords, which could allow for stronger passwords.

The administrator user can choose various badge layouts for use as the standard layout for both the badge and the parking permit, but there isn’t the ability to custom-design a layout for one’s own needs.

The process of checking in and checking out visitors works incredibly smoothly and the user interface does a good job in making this easier for untrained operators. There is the support to take images of visitors as they are checked in using your computer’s webcam.

Default visitor label

If you use the self-checkin setup, the check-in process is totally wizard-driven where your visitors work through two screens to sign in and obtain their conference pass or badge.

There is the ability to load visitor details for reserving or signing in and out from the “Reserved”, “Signed In” and “Signed Out” lists. As well, visitor data can be imported in to the system from such services as contact management systems.

Limitations and points of improvement

The parking permit function could support the ability to keep vehicle data in a separate table indexed by the vehicle’s number-plate (license plate) and containing make, model and colour data. This could improve the workflow process for creating parking permits for regular visitors’ vehicles.

There is the ability to sign in accompanying visitors, but the label printer will turn out a badge as you sign in the visitor. This can be OK for two or three people checking in at once but would be a problem if you had to do something like check in a busload of school students who are visiting as part of a field trip. In this case, the receptionist would have to “reserve” all of the group members, then select the group members from this list using either Shift+click (for contiguous entries) or Ctrl+click (for non-contiguous entries), then click “Sign in and print badge” to check the group in and turn out the badges.

This function could be improved by supporting a “group mode” which allows the receptionist to enter details for the group members, then click a “Sign group in” button when the last member is entered. Here, all the group is entered and the badge printer spits out the badges. As well, this could support the turning out of any parking permits in that same run so these are handed out to the drivers.

As well, I would like to see the program support the ability to work with ODBC-compliant databases or other database-hooks that are standards compliant. It could make such data collections as the host list work with data sources like human-resources databases.

Other points of improvement could also include the ability to allow the receptionist to choose the printer that they send the emergency report to rather than the default printer that is assigned for the system; and the ability to determine other visit reasons in the “Purpose of Visit” field.

These limitations and the lack of “polish” in the user interface may be typical for a version-1 (first release) program but I would like to see the program being improved continuously through its lifecycle rather than appear as a half-baked effort to work with Brother’s label printers.

Conclusion

As it stands, the Brother VM-100 visitor management system works as a capable entry-level visitor management setup for the typical small office, factory or warehouse. It may be stumped as far as integration with other back-end systems for growing organisations is concerned but, being a program in its early stages, it is something that would be expected.

Introduction

HP Envy 100 all-in-one printer - you can print to these printers from your smartphone or tablet

Most smartphone or tablet users would like to obtain hard copy of documents or pictures on paper. But at the moment, there is no open and common platform for printing from these devices.

There isn’t even the ability to connect a printer directly to any of these devices and this issue will become more real as more households use these devices. It will extend to other Internet-ended devices like Internet-ended TVs and set-top boxes that are part of interactive TV setups.

There are a few solutions being established by most of the printer manufacturers and all of these solutions require that you use a newer network-enabled printer that is connected to your home network.

Manufacturer-supplied print app

Brother iPrint&Scan - one of the mobile print apps offered by the manufacturers

The most common solution is to download a printing app from the mobile device’s app store. This method can work if your preferred printer brand is other than Hewlett-Packard because this brand offers different print options that don’t rely on these apps. As well I have installed these apps on to my Android smartphone so I can assess different network printers’ abilities with printing from a smartphone.

These are written by the vendors themselves, usually for all of their recent-issue network-enabled printers and they can print known file types like image files, PDFs or, in some cases, common office file formats. It is also worth knowing that most of these apps allow you to scan photos or documents to your mobile device using your multifunction printer’s scanning facility.

Typically these programs register with the device’s operating system as a file-handler for the file types that they can print. Then, when you open one of these files in the operating system, you have the option to open the file with the printer app; which will list the printers on your network that it has discovered and knows it can work with. Subsequently you select the options that suit your needs, such as paper size or duplex printing, and start the print run.

Apple AirPrint

This works with all Apple iOS devices that are up-to-date with a version of iOS 4.2 or newer. At the moment, it only works with HP ePrint-enabled printers and provides a similar print-job experience as what would be expected for desktop printing.

Apple has yet to release this feature to other printer manufacturers so that people can have a choice of printer to work from.

Google Cloud Print

Google is offering a smartphone printing solution known as Google Cloud Print. This solution, which is immature at the time of writing, requires the use of an HP ePrint-capable printer or certain network-enabled Kodak printers for PC-free network printing. Other printers will require a desktop computer to be running a helper application to collect and forward print jobs to that printer.

At the moment, it works in a similar manner to the printer-manufacturer-supplied app setups where the user has to use the app to print out documents. There is a larger choice of applications as shown on this page for mostly the Android and iOS platforms.

Email-to-print

I have covered HP’s ePrint “print-by-email” setup through the review of a handful of ePrint-enabled HP printers. Here, the printer and the smartphone or tablet must see an Internet service for this to work.

As well the printer has to be registered with the HP ePrint service by its owner. Users would have to then send the image, PDF or document file to a special email address that has been determined as part of the printer setup routine. There is the ability to set up a white-list of approved email addresses that can send print jobs to the printer and recently HP enabled the ability for users to determine an easy-to-remember email-to-print address for their printer.

Kodak offers a similar function for some of their network-enabled printers at the moment. But none of the other popular printer manufacturers have established an email-to-print infrastructure that can work with any smartphone or tablet device.

Achieving best results from your mobile-device print setup

An issue that may plague smartphone or tablet users when they print using one of the mobile print solutions, especially the manufacturer-supplied print apps or the Apple AirPrint setup is that the job may be interrupted midway or take an inordinate time to print. It may not be of concern for Google Cloud Print or email-to-print setups because the job would be lodged with an Internet-based server which would resubmit it to the printer.

This can happen if the mobile device isn’t communicating properly with the Wi-Fi network such as through low batteries or being used in an area where there is poor reception. In most cases, it would be a good idea to make sure the battery is charged up or the device is plugged in to its charger; and you are seeing at least three or four bars on the Wi-Fi signal-strength indicator when you are running the print job. This may require you to avoid moving the device around until the print job is complete, which will be indicated on the software.

What can be done

What I would like to see for on-site printing from mobile devices is the use of the UPnP print device classes which I have touched on previously. As well, more printer manufacturers could license or exploit the email-to-print setups that HP and Kodak have established.

As I have said previously, the network printers should also have a larger memory so that  print jobs can be transferred from the client device and held in the printer’s memory until the last page is turned out.

Conclusion

At the moment there isn’t a clear path for setting up a printing solution for your smartphone, tablet computer or similar device that doesn’t need a desktop computer to be available at all times. It all depends on which make and model of printer you are using on your network and, in some cases, what platform you are using for your device.

ScoreMobile scoreboard app

If you look in your mobile platform’s app store, there are quite a few sports apps which turn your smartphone or tablet in to a scoreboard or leaderboard for your favourite sporting events. Some of the scoreboard apps allow you to monitor a particular team’s games, view league ladders or see on-demand video of game highlights. Examples of these include the ScoreMobile apps; and the “Footy Now” / “League Now” apps for the AFL and NRL football leagues respectively; all of which are available on most of the main mobile platforms like iOS and Android.

Most of these apps are free or advertiser-funded and are written in conjunction with companies and other interests associated with the particular leagues or codes that these apps work with  As well, they work via whatever Internet connection your device is using at the moment, whether it’s the Wi-Fi home network, the Wi-Fi hotspot at your favourite bar or the wireless broadband service that you device is associated with. But are they a useful download for your phone or tablet?

I would say that they provide a useful role for any sports followers, whether they watch the game on TV at home or their favourite bar or cafe; or go to the stadium to watch the game.

Footy Now AFL scoreboard app

One key use for people who watch the game in a public place such as the stadium, a large outdoor screen in a square or a packed-out bar, is to have a “handheld scoreboard” that they can glance at  Here, they may not see the scoreboard easily due to them being in the wrong seating position or being further back from the venue’s TV screen.

At home, you could be outside listening to the radio commentary on that small portable radio yet be able to check the scores at a glance. This may then be useful for knowing whether to head inside to see the action on TV and can be a boon when there is confusion in the commentary which can happen with some plays. Two best examples of such a confusing situation is a batsman hitting a run but being caught or run out in cricket or a scoring event (try, goal or touchdown) in a game of rugby, Australian Rules or American football which can be escalated to a higher scoring play.

For Australian readers, this could extend to you having a tablet computer showing the scores for the AFL or NRL Grand Final near the barbecue while you are cooking the meat for the Grand Final lunch.

Another benefit that these apps provide when it comes to upcoming sport fixtures is the way the time for that fixture is conveyed. These apps show the time that the game or race is expected to actually start with it represented in your local time zone. It can be important when you watch the event on TV so that you are sure you have switched over to the right channel especially if you are avoiding the preliminary events or commentary before that fixture. Or it could be to make sure you are at the location you want to watch it at in time for the start if you are visiting the venue, a favourite “watering-hole” or your friend’s place where they have the big TV.

These apps would also appeal to travellers and expats who like to follow their favourite matches while they are travelling. An example of this was a friend I know who had used one of these apps on his iPhone to follow a baseball game that was taking place in the US while he was over here in Australia. Similarly a Manchester United fan could follow that soccer team’s performance anywhere around the world even if there isn’t a TV broadcast of the games where they are.

League Now NRL scoreboard app

For these apps to work properly, they need to have proper support for push notification but without placing too much strain on the device’s battery runtime. As well, these apps need to be able to work in a manner that doesn’t take over the processor power of these devices when they are just showing scores. As well, the data backend has to be synchronous to the scoreboard at the actual game in the same manner as what is expected for the TV scoreboard – a football goal appears on the mobile scoreboard app as soon as the pitch umpire declares that goal.

So whether you are an avid sports follower or just casually watch some sporting events like football finals or Grand-Prix car races, the mobile scoreboard apps do have a place on the smartphone and tablet devices.

Podcast

Seeing DLNA. Cool media sharing. by scobleizer

Podcast link

My Comments

This on-demand broadcast is a DLNA-hosted interview that I heard about what the DLNA home media network is all about with its heterogenous benefits.

One key factor that was mentioned many times was the heterogenous nature of the DLNA ecosystem. Here, they illustrated practices like bringing content up from a network-attached storage unit to Samsung TV or a TV hooked up to a network media adaptor from a different vendor using one of Samsung’s Android tablets.

They even cited the ability to use different software like TwonkyMobile or Samsung’s AllShare on the same Android device to do the same task. Even devices like Sony’s PS3 were mentioned due to the ability to discover content hosted on DLNA servers. Other applications that were even raised include delivering pictures to the printer when you want hard copies of them.

Of course, there was a direct comparison to the Apple AirPlay ecosystem which required the use of iOS devices, the Apple TV (or selected AirPlay-compliant devices) as well as content hosted on computers running iTunes for it to work.

Apple users should know that there is software for their platforms in the form of TwonkyMobile or PlugPlayer for their iOS devices and NullRiver MediaLink or similar applications for their Macintosh computers.

Article – From the horse’s mouth

Form 2 – new colours – Bang & Olufsen

Product Review – HomeNetworking01.info

Bang & Olufsen Form 2 headphones

My Comments

Bang & Olufsen Form 2 headphones

Now Bang & Olufsen are celebrating the 25th anniversary of their Form 2 lightweight headphone design which I have reviewed on this site. These had the earpieces anchored to the headphone using a connection that wouldn’t look out of place on a nice watch; and were known for very good quality sound.

They have now been released in different colours rather than just the black finish that was associated with them. Here you can choose to have them in red, orange, yellow or white as well as black. The press photos on the B&O site also have images of them having the classic B&O logo on them, which would be similar to the trend that I have seen with other desirable brands where the logo is clearly visible.

It is also worth noting that I heard from B&O sales staff that these headphones are one of the few premium-priced headphones that are optimised for use on portable devices as well as home or professional audio equipment. This is compared to a practice associated with some other premium headphones where the impedance is suited for the headphone jack of a hi-fi amplifier, CD player, tape/MiniDIsc deck or mixing desk; and wouldn’t have the full volume from an MP3 player, smartphone or laptop computer.

This is definitely one of Bang & Olufsen’s classic designs that makes me think of their products being like the Jaguar cars. Here, these products aren’t about a label that only represents a status symbol, but are about something you enjoy using because they deliver the performance. You expect the clear treble notes and vocals while you hear a tight bass line when you hear music through them.

Articles

HP TopShot LaserJet Pro M275 scans 3D objects but only prints in 2D (video) | Engadget

From the horse’s mouth

HP

 Product Page; Datasheet (PDF)

Press Release

My Comments

HP has introduced a scanning system for one of their newer multifunction laser printers that would be considered out of the ordinary. Some of the press about this technology focuses on the 3D imaging but I see the technology as another way to image objects in a manner that can suit small businesses.

Here, the system, known as “TopShot” uses a document camera with integrated flash heads rather than a scanning bar to scan a document. The camera is mounted on a folding arm and sets up in a manner similar to how you would set up an overhead projector.

When you start the scan process, the camera would take six images, three with the flash and three in ambient lighting conditions. There is the use of different angles and exposure setups which can suit different requirements.

The main benefits offered is that you can obtain a higher-quality scan from bound documents like books.  Ordinarily you would have to place the book face down on your scanner’s glass and, perhaps, press down on the scanner’s lid to obtain a high-quality copy. This can damage the book’s binding and can also place the scanner’s lid and hinge at risk of damage. Some scanners and multifunction printers have implemented “pantograph” lid hinges so that the lid can be lifted over bound documents.

The TopShot scanning system would be at an advantage when you are dealing with very old and fragile documents; and would lend itself to those of us who deal with antiquarian books and similar material.

There is also the ability to use the scanner as a “white-box” photography studio for photographing small objects. HP are targeting this feature at online traders who want to get pictures of the goods they have for sale so they can populate their online catalogues or eBay sites. It would also please users who write blogs or Web articles discussing particular objects; people who are creating documents like inventories, manuals and catalogues or working with article databases.

The first implementation of this scanning technology will be in the form of the HP TopShot LaserJet Pro 200 colour laser multifunction printer. Like what is common with devices that offer “cutting-eddge” features, some other features tend to go by the wayside. In this example, the printer was less than spectacular judging from what I read of the site. Here, it didn’t have auto-duplex printing nor was the printing speed all that quick.

Of course, this printer has the HP ePrint functionality and the ability to work with mobile devices using AirPrint, Google’s CloudPrint or the HP ePrint Home & Biz mobile app. I would also like to see the TopShot scanning mechanism available as a dedicated device that is either connected directly to the host computer or to a network, which could allow it to work as a complementary tool for those of us who have good multifunction printers.

The big question with TopShot is the quality of document scans or object pictures taken using this setup compared to traditional setups. Could a TopShot printer yield a better electronic image or copy of a page compared to a regular scanner or multifunction printer? Could the TopShot take a better quality picture of a small object than a regular digital camera user working with a “white-box” setup?