Watch out! Woman ticketed for wearing Google Glass while driving

Meanwhile, Google releases images of updated version of Glass

A woman said in a post on her Google+ page that she was was ticketed by police in southern California for wearing Google Glass.

Cecilia Abadie, whose Google+ profile describes her as a blogger, speaker and Google Glass pioneer, sought information on laws about driving while wearing the computerized eyeglasses.

She couldn't be reached for comment to provide details of the incident.

"Is #GoogleGlass ilegal while driving or is this cop wrong???," wrote Abadie on her Google+ page. "Any legal advice is appreciated!! This happened in California. Do you know any other #GlassExplorers that got a similar ticket anywhere in the US?"

Abadie, though, did note in the comments section of her post that she was initially pulled over for, and was ticketed, for speeding.

"The speeding [ticket] was justified as I was in a 65 mph zone and thought I was on a 75mph zone, I always feel like I need some software to alert me when zones change ... is that only me??," she wrote. "Glass was not on and I honestly don't use it much while driving but I do wear."

Zeus Kerravala, an analyst with ZK Research, said the courts will soon have to settle this issue.

"If people start using glass while driving to look up points of interest or watch a video, then sure, it's dangerous," he said. "If someone was indeed using it for navigation, what's the difference between looking at Glass, a phone or a navigation system?"

As Abadie was dealing with the law around Glass, Google was busy releasing images of its design upgrade.

Google announced earlier this week that the so-called Explorers who are testing the devices won't have to buy new models of Glass when they become generally available. The prototypes can be exchanged for a new, updated version within 60 days.

That deal, however, won't apply to the latest Glass Explorers.

Google explained that only Explorers who purchased Glass devices before Oct. 28 are eligible for the program.

Google posted two new photos of the upcoming version on its Google Glass page.

The photos show a new version that's much like the old. The new one doesn have a single earbud that can be inserted into the user's right ear and is attached to the back of the device's bow.

The new units also are designed to work with shades and prescription lenses.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

How to balance maintenance and IT innovation

Many IT leaders admit their spending is too heavily weighted toward keep-the-lights-on projects. Here's how to tip the balance.

Social! Mobile! Big data! BYOD! You probably already know what your company's executives most want to see from your IT organization. But unless your company is very new, or you're unusually lucky -- or a very, very good manager -- more than half your time and resources are spent, not on innovative projects, but on "keep the lights on" activities whose sole purpose is to prevent existing systems from breaking down. And sometimes the percentage is a lot higher than that.

"I've seen companies where it's 80% or 90% of the IT budget," says Columbia Business School professor Rita Gunther McGrath, who examined this issue for her book The End of Competitive Advantage: How to Keep Your Strategy Moving as Fast as Your Business. "I think it should be no more than 50%," she adds.

Most CIOs would agree with her, but can't achieve that 50-50 split in their own budgets. In a recent Forrester Research survey of IT leaders at more than 3,700 companies, respondents estimated that they spend an average 72% of the money in their budgets on such keep-the-lights-on functions as replacing or expanding capacity and supporting ongoing operations and maintenance, while only 28% of the money goes toward new projects.

Another recent study yielded similar findings. When AlixPartners and CFO Research surveyed 150 CIOs about their IT spending and their feelings about IT spending, 63% of the respondents said their spending was too heavily weighted toward keeping the lights on.
Why So Difficult?

If no one wants to spend such a huge portion of IT's funds just to run in place, why does it keep happening? One explanation lies in the term "keeping the lights on" itself: Turning the lights off isn't an option. "It's the ante that allows you to hold on to your job," says Eric Johnson, CIO at Informatica, a data integration company in Redwood City, Calif., with annual revenue of $812 million. "If the systems are down and the phones aren't working, no one will care how innovative you are."

Of course, new projects are very important, so the challenge is to do both. "CIOs are striving to be business executives, truly driving value for the organization," Johnson says. "That's why there's so much emphasis on keeping the lights on while still finding the budget to drive innovation."

A bigger problem has to do with the traditional approach to IT at most companies, where techies who are expected to abide by the principle that "the customer is always right" find themselves creating unwieldy systems in an ongoing effort to give the business exactly what it asks for. Keeping those systems running is usually difficult, time-consuming and expensive. "I've worked with a lot of companies where the CEO says, 'I want you to do this, this and this.' The CIO says, 'That'll be $5 million.' The CEO says, 'Do it for $3 million.' So it's patch, patch, patch," McGrath says. That approach creates "technical debt" -- something you'll have to go back and pay for later -- according to Bill Curtis, chief scientist at CAST, a software analysis company headquartered in Meudon, France, with annual revenue around $47 million.

Similar problems arise when IT tries to satisfy business needs too quickly. "Sometimes these things were built as 'Let's just get something up and see how it works,'" Curtis says. "Things that were designed as a demo suddenly have to grow. Or even if something was designed appropriately for what they thought would be the use, people kept adding new requirements and features until it became a kludge."

Perhaps worst of all is the tendency to customize licensed software in an effort to fulfill business requirements -- whether or not those requirements have any real bearing on the organization's goals or success. "We talk about business capability -- the list of things a business needs to do to be successful and achieve its goals," says Nigel Fenwick, an analyst at Forrester Research. "Out of 30 high-level capabilities, maybe two or three are differentiators." When senior executives understand this well, he says, they encourage IT to focus on those key areas and seek standardized, easy-to-maintain solutions for everything else.

Unfortunately, such understanding is rare. "It's hard to get the CEO to stand up and say, 'This is the way we're going to do it,'" Fenwick says. But if the CEO doesn't do that, he adds, "every little department will want to customize the technology to make their part of the business run more efficiently -- and so they should." After all, each department is being judged on its own efficiency, and anything that can make it run better is a good thing -- from the point of view of the department's managers. But the approach leads to systems that are difficult and costly to maintain.

"Over the past 10 to 20 years, we've plowed millions of dollars into software customization to support generic capabilities," Fenwick says. "It has made IT more complex, made interfaces more difficult, reduced IT's agility and added cost."

There's one last reason it can be difficult to contain keep-the-lights-on costs: You may become a victim of your own success. "We've determined that it'll be pretty tough to get to 50-50," says Peter Forte, CIO at Analog Devices, a semiconductor maker headquartered in Norwood, Mass., with annual revenue of $2.6 billion. "The reason is, the more successful you are on the right-hand side, that drives more activity to keeping the lights on. Every new system we deploy is a system that needs to be maintained."

Here's a look at strategies that can help CIOs who want to spend less on keeping the lights on and more on innovations that will help the company reach its goals.
Virtualization

If you haven't gotten around to virtualizing servers, you may find that doing so is an effective way to cut keep-the-lights-on costs. Forte discovered that when a normal cyclical low in the semiconductor industry coincided with the worldwide economic downturn of 2009. "We lost 30% of our revenue almost overnight," he says. As a result, IT had to quickly cut 30% of its costs, leading to significant layoffs.

At the time, Analog Devices was about 45 years old, with the legacy infrastructure to prove it. "The first thing we did was calculate what percentage of our investment would be needed to keep the lights on," Forte says. "It was in the low 80s." For a technology company whose success depended on its ability to rapidly bring new products to market in large numbers, that was not acceptable. So IT launched a three-year effort to shift that balance. Today, Forte says, Analog Devices spends 62% of its IT budget on keeping the lights on and 38% on growing the business. That's not 50-50, but it's a meaningful improvement.

There were several elements to the program, but virtualization was one of the most effective. "We moved from an environment where we were 100% physical to over 90% virtual," he says. That saved several million keep-the-lights-on dollars that the company poured back into innovation. At the same time, Analog Devices switched to a service catalog approach, automating such tasks as resetting passwords for employees -- something that help desk staffers previously did over the phone about 1,800 times per quarter. "Those technologies swooped in and saved us," Forte says.
Cloud Computing

For many companies, moving services to a public, private or hybrid cloud also has a huge impact on costs. Johnson estimates that Informatica spends about 60% of its IT budget on innovation and only 40% on keeping the lights on, and heavy use of the cloud is one reason why. "We have more than 30 enterprise software-as-a-service operations," he says. "We have a mantra: 'Cloud first.' Can we do it with a hosted cloud solution? If not, and we have to buy it, that's fine. [But] building it custom is always the last resort."

And security concerns shouldn't keep you out of the cloud, Fenwick says. Business executives "need to look at how much it matters if something is running in a data center 100 miles away and owned by the company versus one that's 100 miles but owned by another company," he says. "People don't really understand the relative risk of someone hacking into our data center compared with Amazon's data center."
Standardization

Eliminating customization for any function that isn't a key differentiator can substantially reduce keep-the-lights-on costs. "People have done a lot of the easy stuff," Fenwick says, referring to the fact that virtualization and cloud computing have already had big impacts on many IT budgets. Standardizing software is the next thing you can do to meaningfully cut costs.

But while standardization can create great efficiencies, it can be a hard sell. That's because, unlike the cloud or virtualization, standardizing -- whether on SaaS or off-the-shelf applications -- requires users to change how they do their work. "If you're buying something off the shelf, it's by definition not going to be designed for your processes," McGrath says. "And once you start tinkering with it, you lose the benefit."

The key is to have the discipline to say, "We are not going to customize this.... We're not going to make changes that will make it more difficult for us to be agile." Fenwick says.

Johnson says standardizing both technology and business practices helped Informatica get to the point where it spends 60% of IT's budget on new initiatives. "You make sure you don't have 10 ways of doing something," he says. "You have one way of doing it."
Planning Ahead

One thing that makes keeping the lights on much more costly is the need to make unexpected repairs. You can save money -- and lead a more pleasant life -- if you plan ahead and prepare for system maintenance needs.

For The Reinvestment Fund, a Philadelphia-based community development financial institution that manages $700 million in funds, automatic monitoring of the IT infrastructure's operations has made a huge difference, says CIO Barry Porozni. "Upgrading our monitoring system was one thing that really made an impact," he says. "It probes into applications and devices so we know proactively if email is down -- we don't need users to come to us. Same thing with data storage -- we're very data-intensive, and it tells us how close we are to running out of space."

The new monitoring system has freed up a lot of time, Porozni says. Previously, he and his staff had to go through a checklist first thing in the morning and last thing in the evening to make sure all systems were functioning well. Adopting the new technology and other steps have helped cut the percentage of the IT budget devoted to keeping the lights on from about 80% to about 70%, he says, and he aims to get it much lower.

For Michael Leeper, director of global technology at Columbia Sportswear, a Portland, Ore.-based outdoor clothing retailer with $1.67 billion in annual revenue, planning ahead also means not doing anything you're likely to regret later. "Hopefully, you've done your homework so you don't have to create short-term solutions just to solve a problem," he says. At the same time, though, he's careful not to turn down requests from business people.

"Inevitably, you have to do something you don't want to do just to make people happy," he says. When that happens, it's important not to leave the quick fix in place, but to go back and improve it. "Once that first [request] is up and running, you start figuring out how to fix it," he says. "We'll show the business what they're asking for, and then go fix it in the background. You don't want to start building on something that's bad."

Planning ahead also applies to projects designed to grow the business, so Leeper and his team are in the habit of piloting new projects before anyone asks for them. "Once the platform's stable and current, the next thing we do is make a small investment in technology we may not need immediately," he says. One example is virtual desktops -- Leeper saw that there might be a need for them so he implemented some to learn about them. "Then when the business did come to us, we didn't have to tell them to wait," he says.
Selling Your Vision

Marketing your ideas for taming keep-the-lights-on costs, both within IT and to the company at large, is an important step. Indeed, as Analog Devices went through the painful process of recovering from layoffs and then bringing its technology up to date, Forte used a simple phrase to tell both his IT colleagues and Analog executives what the team was up to: "Shrink the footprint, shift the balance [from keep-the-lights-on toward innovation], optimize services."

"The importance of communication can't be overstated," he says. That was especially true when he took over as CIO in 2009. At the time, customer satisfaction with IT was low. "I kept telling people, 'Hang in there, we'll get things in order,'" Forte recalls. "I spent time with every vice president in the company, telling the same story: Shrink, shift, optimize."

By staying relentlessly on message, Forte gave both the business and his IT group a good grasp of the priorities and what still needed to be done. "I was giving a talk at a local college about business-IT alignment," he says. "I said, 'You can walk up to anyone who works in IT at Analog Devices, ask them what the three most important initiatives are for IT, and you'll get the same answer.'" One student happened to have a friend working at Analog, so she called her friend to test Forte's assertion. Sure enough, when asked for the top priorities, the student's friend answered, "Shrink, shift, optimize."

Still, though you may have a grand vision for bringing down keep-the-lights-on expenses, Leeper advises starting out with small steps. "You'll never get anywhere if you try to do it all at once," he says. But it's important to start somewhere. "Pretty soon, you begin accomplishing little upgrades with little payoffs," he says. "And then one day you'll look around and think: 'Hey, I did it all.'"

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

10 new gadgets to spruce up your workspace

These gadgets and peripherals now hitting the market will give you and your desk a much-needed upgrade.

Look at your desk. Could you use a new mouse? Additional digital storage? A better monitor? A place to charge all your mobile devices?

You're in luck. With the holiday shopping season just around the corner, all kinds of gadgets and peripherals are starting to hit the market. Here are 10 to consider if you want to improve productivity, spruce up your workspace or make it easier to take a much-needed break.

Logitech Ultrathin Touch Mouse T630
The Logitech Ultrathin Touch Mouse T630 ($69.99) is a Bluetooth mouse designed specifically for ultrabooks. The mouse features brushed metallic sides, its touch surface supports the use of Windows 8 gestures and it's thin enough to slip unobtrusively into a laptop sleeve or jeans pocket.

The Ultrathin Touch Mouse can pair with two different Bluetooth devices; a physical switch lets users toggle between devices. While some may find the mouse a bit small — it's 3 inches long and 2 inches wide — frequent travelers who can't live without a mouse will find the Ultrathin Touch Mouse invaluable.

Wacom Bamboo Pad Wireless
The Wacom Bamboo Pad Wireless ($79; available in four colors) is a touchpad that works with a battery-free, pressure-sensitive digital stylus. This combination lets users easily add handwritten notes and sketches to a PC or Mac. The Bamboo Pad Wireless also supports multi-touch gestures such as rotate, scroll and zoom. A small USB transceiver connects the touchpad with a user's computer.

Griffin PowerDock 5
The Griffin PowerDock 5 charging station ($99.99) is optimized to charge five iOS devices at the same time, though it will also charge most Kindle and Android devices. Each "charging bay" is roomy enough to accommodate a tablet without removing it from its cases, while the 2.1A of charging circuitry per USB port ensures that devices are charged quickly. Bear in mind that the PowerDock 5 doesn't come with charging cables, while the individual frosted backrests aren't designed to be removed once they've been assembled.

Jawbone Mini Jambox
The Mini Jambox ($179.99; available in nine colors) is the slimmest portable speaker by Jawbone yet. Crafted from a single piece of extruded aluminum, the Mini Jambox offers a lightweight form factor weighing just 9oz (255 grams). But it produces big sound despite its small package, with a pair of proprietary acoustic drivers and a passive bass radiator delivering music playback. The Mini Jambox supports Bluetooth 4.0 or 3.5mm stereo connectors and recharges using micro-USB port for 10 hours of continuous playback.

Twelve South GhostStand
The GhostStand ($34.99) by Twelve South is a transparent, modern platform designed to elevate a laptop to a comfortable viewing angle. Though designed specifically for the MacBook, it should work well with practically any laptop on the market. The GhostStand's silicone rails serve a dual purpose: keeping your laptop in position on the stand and the stand in position on your desk.

The GhostStand ships as two pieces of clear, acrylic plastic. Simple assembly is required. Once in place, though, Twelve South discourages disassembling the stand.

Brinell Drive SSD
The Brinell Drive SSD is a slim, portable solid-state drive that offers both looks and top-notch performance for folks who don't mind paying for it. The 2.5-inch SSD is mounted inside a light metal frame with an exterior surface made from premium materials: Stainless steel, leather, carbon and Macassar wood.

Under the hood, the Brinell Drive delivers performance of up to 420MB/s read and 330MB/s write over its USB 3.0 interface. Each Brinell Drive comes with a USB 3.0 cable and a protective leather pouch. The drive is available in 120GB, 250GB and 500GB capacities, and prices vary by material.

exar JumpDrive M10
The Lexar JumpDrive M10 is a USB 3.0 flash drive that delivers up to 100MB/s read and 55MB/s write speeds. The drive also displays the remaining storage space on its integrated, always-on e-ink capacity meter. EncryptStick Lite software, which comes bundled with the flash drive, also allows for the creation of a password-protected vault to automatically encrypt file using 256-bit AES encryption.

Bose Wireless Headphones
The Bluetooth-enabled Bose Wireless Headphone AE2w ($249.95) offers natural sound and a comfortable around-ear fit. The removable Bluetooth adapter offers up to seven hours of run time, and its lithium-ion battery is recharged via an included USB cable. A built-in microphone lets users make phone calls or activate voice-recognition apps.

Overall, the Bose Wireless Headphone AE2w offers the flexibility of wireless with a great-sounding and comfortable headset — though depending on your preferred music genre, you may find the playback volume a tad soft.

SimpleScan DP
The SimpleScan DP mobile scanner ($199) offers double-sided scanning with an optical resolution of 300dpi. The versatile mobile scanner can be deployed in three distinct configurations. It offers a scan speed of 10 pages per minute (PPM) when scanning in black and white, and 4ppm in color. The SimpleScan DP mobile scanner is fully USB-powered, and is available in black and white.


Lenovo ThinkVision LT1423p
The 13.3-inch portable ThinkVision LT1423p monitor from Lenovo offers 1600x900 resolution on an AH-IPS (Advanced High Performance In-Panel Switching) display panel that is protected by a layer of Gorilla Glass layer. The ThinkVision LT1423p comes with a 10-point touch surface that's certified for Windows 8 use and works with a ThinkPad Digitizer pen to deliver a high resolution of 2540ppi. The monitor connects to the computer via a USB interface using DisplayLink technology and is powered by the same USB link.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Social Engineering: The Basics

What is social engineering? What are the most common and current tactics? A guide on how to stop social engineering.

You've got all the bells and whistles when it comes to network firewalls and your building's security has a state-of-the-art access system. You've invested in the technology. But a social engineering attack could bypass all those defenses.

CSO's ultimate guide to social engineering

Say two fire inspectors show up at your office, show their badges and ask for a walkthrough—you're legally required to give them access to do their job. They ask a lot of questions, they take electrical readings at various wall outlets, they examine wiring under desks. Thorough, aren't they? Problem is, in this case they're really security consultants doing a social engineering 'penetration test' and grabbing access cards, installing keystroke loggers, and generally getting away with as much of your business's private information as they can get their hands on. (See How to rob a bank for details from this real-world example.)

Social engineers, or criminals who take advantage of human behavior to pull of a scam, aren't worried about a badge system. They will just walk right in and confidently ask someone to help them get inside. And that firewall? It won't mean much if your users are tricked into clicking on a malicious link they think came from a Facebook friend.

In this article, we outline the common tactics social engineers often use, and give you tips on how to ensure your staff is on guard.

Social engineering is essentially the art of gaining access to buildings, systems or data by exploiting human psychology, rather than by breaking in or using technical hacking techniques. For example, instead of trying to find a software vulnerability, a social engineer might call an employee and pose as an IT support person, trying to trick the employee into divulging his password.

Famous hacker Kevin Mitnick helped popularize the term 'social engineering' in the '90s, although the idea and many of the techniques have been around as long as there have been scam artists of any sort. (Watch the video to see social-engineering expert Chris Nickerson size up one building's perimeter security)
Through a Social Engineer's Eyes
Social Engineering expert Chris Nickerson reveals what criminals are looking for when it comes vulnerabilities in building security.

How is my company at risk?

Social engineering has proven to be a very successful way for a criminal to "get inside" your organization. In the example given above, once a social engineer has a trusted employee's password, he can simply log in and snoop around for sensitive data. Another try might be to scam someone out of an access card or code in order to physically get inside a facility, whether to access data, steal assets, or even to harm people.

Chris Nickerson, founder of Lares, a Colorado-based security consultancy, conducts 'red team testing' for clients using social engineering techniques to see where a company is vulnerable. Nickerson detailed for CSO how easy it is to get inside a building without question.

In one penetration test, Nickerson used current events, public information available on social network sites, and a $4 Cisco shirt he purchased at a thrift store to prepare for his illegal entry. The shirt helped him convince building reception and other employees that he was a Cisco employee on a technical support visit. Once inside, he was able to give his other team members illegal entry as well. He also managed to drop several malware-laden USBs and hack into the company's network, all within sight of other employees. Read Anatomy of a Hack to follow Nickerson through this exercise.

In What it's like to steal someone's identity professional pen tester Chris Roberts, founder of One World Labs, says he too often meets people who assume they have nothing worth stealing.

"So many people look at themselves or the companies they work for and think, 'Why would somebody want something from me? I don't have any money or anything anyone would want,'?" he said. "While you may not, if I can assume your identity, you can pay my bills. Or I can commit crimes in your name. I always try to get people to understand that no matter who the heck you are, or who you represent, you have a value to a criminal."

Sneaky stuff. Give me some specific examples of what social engineers say or do.

Criminals will often take weeks and months getting to know a place before even coming in the door or making a phone call. Their preparation might include finding a company phone list or org chart and researching employees on social networking sites like LinkedIn or Facebook.

In the case of Roberts, he was asked to conduct a pen test for a client who was a high-net-worth individual to see how easy it would be to steal from him. He used a basic internet search to find an email address for the individual. From there, it snowballed.
Useful Books on Social Engineering!

Social Engineering: The Art of Human Hacking
By Hadnagy and Wilson (Wiley, Dec 2010)
"This book covers, in detail, the world's first framework for social engineering."

No Tech Hacking: A Guide to Social Engineering, Dumpster Diving, and Shoulder Surfing
By Johnny Long et al (Syngress 2008)
"Whether breaking into buildings or slipping past industrial-grade firewalls, my goal has always been the same: extract the informational secrets using any means necessary."

"We searched for the e-mail address online were able to find a telephone number because he had posted in a public forum using both," said Roberts. "On this forum, he was looking for concert tickets and had posted his telephone number on there to be contacted about buying tickets from a potential seller."

The phone number turned out to be an office number and Roberts called pretending to be a publicist. From there he was able to obtain a personal cell phone number, a home address, and, eventually, mortage information. The point being from one small bit of information, a social engineering can compile an enitre profile on a target and seem convincing. By the time Roberts was done with his pen test, he knew where the person's kids went to school and even was able to pull a Bluetooth signal from his residence.

Once a social engineer is ready to strike, knowing the right thing to say, knowing whom to ask for, and having confidence are often all it takes for an unauthorized person to gain access to a facility or sensitive data, according to Nickerson.

The goal is always to gain the trust of one or more of your employees. In Mind Games: How Social Engineers Win Your Confidence Brian Bushwood, host of the Internet video series Scam School, describes some of the tricks scam artists use to gain that trust, which can vary depending on the communication medium:

-- On the phone:
A social engineer might call and pretend to be a fellow employee or a trusted outside authority (such as law enforcement or an auditor).

According to Sal Lifrieri, a 20-year veteran of the New York City Police Department who now educates companies on social engineering tactics through an organization called Protective Operations, the criminal tries to make the person feel comfortable with familiarity. They might learn the corporate lingo so the person on the other end thinks they are an insider. Another successful technique involves recording the "hold" music a company uses when callers are left waiting on the phone. See more such tricks in Social Engineering: Eight Common Tactics.

-- In the office:
"Can you hold the door for me? I don't have my key/access card on me." How often have you heard that in your building? While the person asking may not seem suspicious, this is a very common tactic used by social engineers.

In the same exercise where Nickerson used his thrift-shop shirt to get into a building, he had a team member wait outside near the smoking area where employees often went for breaks. Assuming this person was simply a fellow-office-smoking mate, real employees let him in the back door with out question. "A cigarette is a social engineer's best friend," said Nickerson. He also points out other places where social engineers can get in easily in 5 Security Holes at the Office.

This kind of thing goes on all the time, according to Nickerson. The tactic is als o known as tailgating. Many people just don't ask others to prove they have permission to be there. But even in places where badges or other proof is required to roam the halls, fakery is easy, he said.

"I usually use some high-end photography to print up badges to really look like I am supposed to be in that environment. But they often don't even get checked. I've even worn a badge that said right on it 'Kick me out' and I still was not questioned."

-- Online:
Social networking sites have opened a whole new door for social engineering scams, according to Graham Cluley, senior technology consultant with U.K.-based security firm Sophos. One of the latest involves the criminal posing as a Facebook "friend." But one can never be certain the person they are talking to on Facebook is actually the real person, he noted. Criminals are stealing passwords, hacking accounts and posing as friends for financial gain.

One popular tactic used recently involved scammers hacking into Facebook accounts and sending a message on Facebook claiming to be stuck in a foreign city and they say they need money.

"The claim is often that they were robbed while traveling and the person asks the Facebook friend to wire money so everything can be fixed," said Cluley.

"If a person has chosen a bad password, or had it stolen through malware, it is easy for a con to wear that cloak of trustability," he said. "Once you have access to a person's account, you can see who their spouse is, where they went on holiday the last time. It is easy to pretend to be someone you are not."

See 9 Dirty Tricks: Social Engineers Favorite Pick-up Lines for more examples.

Social engineers also take advantage of current events and holidays to lure victims. In Cyber Monday: 3 online shopping scams and 7 Scroogeworthy scams for the holidays security experts warn that social engineers often take advantage of holiday shopping trends by posioning search results and planting bad links in sites. They might also go as far as to set up a fake charity in the hope of gaining some cash from a Christmas donation.

Why do people fall for social engineering techniques?

People are fooled every day by these cons because they haven't been adequately warned about social engineers. As CSO blogger Tom Olzak points out, human behavior is always the weakest link in any security program. And who can blame them? Without the proper education, most people won't recognize a social engineer's tricks because they are often very sophisticated.

Social engineers use a number of psychological tactics on unsuspecting victims. As Bushwood outlines in Mind Games, successful social engineers are confident and in control of the conversation. They simply act like they belong in a facility, even if they should not be, and their confidence and body posture puts others at ease.
This is your brain on social engineering

Brian Brushwood is really good at tricking people. So good he founded a website called "Scam School".

Brushwood understands how social engineers mislead people. Four basic principles:

"People running concert security often aren't even looking for badges," said Brushwood. "They are looking for posture. They can always tell who is a fan trying to sneak back and catch a glimpse of the star and who is working the event because they seem like they belong there."

Social engineers will also use humor and compliments in a conversation. They may even give a small gift to a gate-keeping employee, like a receptionist, to curry favor for the future. These are often successful ways to gain a person's trust, said Bushwood, because 'liking' and 'feeling the need to reciprocate' are both fixed-action patterns that humans naturally employ under the right circumstances.

Online, many social engineering scams are taking advantage of both human fear and curiosity. Links that ask "Have you seen this video of you?' are impossible to resist if you aren't aware it is simply a social engineer looking to trap you into clicking on a bad link.

Successful phishing attacks often warn that "Your bank account has been breached! Click here to log in and verify your account." Or "You have not paid for the item you recently won on eBay. Please click here to pay." This ploy plays to a person's concerns about negative impact on their eBay score.

"Since people spend years building eBay feedback score or 'reputation,' people react quickly to this type of email. But, of course, it leads to a phishing site," said Shira Rubinoff, founder of Green Armor Solutions, a security software firm in Hackensack, New Jersey. "Many people use eBay, and users often bid days before a purchase is complete. So, it's not unreasonable for a person to think that he or she has forgotten about a bid they made a week prior."

Recent phishing lures even take advantage of the economic downturn, said Rubinoff. It has not been uncommon for fake emails to turn up that claim to be from human resources which say: 'You have been let go due to a layoff. If you wish to register for severance please register here,' and includes a malicious link.

No one wants to be the person that causes problems in this economy, so any email that appears to be from an employer will likely elicit a response, noted Rubinoff. Lares' Nickerson has also seen cons that use fake employer emails.

"It might say, 'In an effort to cut costs, we are sending W-2 forms electronically this year,'" said Nickerson.

How can I educate my employees to prevent social engineering?

Awareness is the number one defensive measure. Employees should be aware that social engineering exists and also aware of the tactics most commonly used.

For elements of an effective security awareness program, see Seven Practical Ideas for Security Awareness and Now Hear This!.

Fortunately, social engineering awareness lends itself to storytelling. And stories are much easier to understand and much more interesting than explanations of technical flaws. Chris Nickerson's success posing as a technician is an example of a story that gets the message across in an interesting way. Quizzes and attention-grabbing or humorous posters are also effective reminders about not assuming everyone is always who they say they are.

"In my educational sessions, I tell people you always need to be slightly paranoid and anal because you never really know what a person wants out of you," said Lifrieri. The targeting of employees "starts with the receptionist, the guard at the gate who is watching a parking lot. That's why training has to get to the staff."

Social engineering tricks are always evolving, and awareness training has to be kept fresh and up to date. For example, as social networking sites grow and evolve, so do the scams social engineers try to use there; see 5 Facebook, Twitter Scams to Avoid and 5 More Facebook, Twitter Scams to Avoid.

The National Cyber Security Alliance recently launched a 'Stop.Think. Connect.' campaign to get users to give more thought to their online behavior so they recognize social engineering cons before they get in trouble.

But it isn't just the average employee who needs to be aware of social engineering. A study conducted in 2010 found executives are actually the easiest targets. In Social engineering: 4 reasons why executives are the easiest targets Jayson Street, a security consultant and CIO of Stratagem 1 Solutions, says executives are soft targets for many reasons, including a lax security attitude and their tendency to use the latest technology—even before it is properly vetted.

Although it's a tactic to use with great caution, fear of embarrassment is a strong motivator. Nobody likes to look foolish, and a successful social engineering test does make the victim feel foolish. This is partly why storytelling works—the reader or listener feels empathy for the person who "got suckered."

Consider this factor if you choose to design an in-house social engineering penetration test. A little embarrassment will put everyone on their toes; crossing the line to humiliation will only make employees angry.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Few use tablets to replace laptops

Workers still see value in laptops for running most critical apps, IDC survey says

Many new tablets, including the new Kindle Fire HDX, are marketed as ways to create documents and other content for work-related tasks, instead of purely for home consumption of video and games.

Even with the focus on workplace productivity, a new survey shows that only 8.7% of tablet buyers want to use the tablet as a replacement for their laptops. The same survey by IDC found that 58.5% of respondents bought a tablet to use in addition to a laptop, and not as a replacement.

The online survey was conducted in April and included 299 U.S. consumers. All of them were 18 or older.

The results might have been different if the survey included younger tablet users, ages 17 and under, since that group has grown up with tablets since the first iPad went on sale in 2010, said Tom Mainelli, an IDC analyst and author of a report on the survey.

"The younger generation has different sentiments about phones and tablets and how useful they are," Mainelli said in an interview.

Still, he said the finding that only 8.7% found a tablet as a replacement for a laptop was a surprise. "When we ask that question again in a year, I'd expect you will see a growing percentage view a tablet at least as possibly replacing a laptop," Mainelli said.

"A huge percentage of people still see a lot of value in a laptop for one kind of app or service they use on it," he added. "Would they want to do their taxes on a tablet? They haven't quite made the leap to being comfortable with a mobile device like a tablet."

"But that [expanded tablet] usage is coming, and we see more people doing more things on tablets," Mainelli added. "Professionals still rely on laptops and a lot of them are just not really even thinking about the possibilities that the tablet offers and instead are concerned that a tablet doesn't run Flash or can only open one app at a time."

Mainelli said it's notable that Amazon announced two new Kindle Fire HDX tablets last week with an emphasis on business-class features such as a native VPN client and hardware and software encryption.

"Amazon is getting much more serious about making its tablets enterprise-ready," he said. The same can be said for iPads and many Android devices.

IDC has predicted 190 million tablets will be shipped to retailers in 2013, of which about half run on the Android mobile operating systen and half on iOS, with fractional amounts running Windows. Amazon runs on a custom version of Android and has dubbed its latest OS the Fire OS 3.0 Mojito.

In the IDC survey, 35% said they own an iOS tablet; 26.4% said they owned a tablet running standard Android; 10% said they owned a custom Android tablet like a Kindle Fire; 9.4% said they owned a Windows tablet and 0.7% owned a Windows RT tablet. More than 14% said they didn't know the OS on their tablet.

The survey also asked tablet owners if they had a chance to buy a tablet again, would they buy one with the same OS. The iOS owners were most likely to say yes (80.2%), followed closely by Windows owners (78.9%); standard Android owners were third (70%), and custom Android owners were 68%.

Mainelli said the lower values for owners who would buy both kinds of Android again are likely a reflection of the many varieties of Android tablets on the market, some priced as low as $79 for a white box version and others from various vendors priced close to the iPad with Retina display at $499. Google's Nexus 10 16 GB tablet running pure Android sells for $399.

"People who own the higher-end Androids probably have a similar affinity for them as do iOS owners," he said. But Mainelli said he was somewhat surprised by the high affinity for Windows. "Those owning Windows have a strong inclination to buy one again, right below Apple," he noted.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com