|
|
|
| Related Articles |
| Client-side vulnerabilities loom large |
28 November 2007 |
| Critical vulnerabilities in common PC software, including both applications and operating systems, continue to grow in number and stand as the leading cause for concern in the IT security landscape today, according to training experts at the SANS Institute.Holes in so-called client-side applications, including Web browsers, e-mail clients, productivity suites, and media players, have become particularly worrisome over the last year, according to SANS, which highlighted the issue as part of its annual report on the top 20 Internet security risks for 2007.As hackers have shifted their attention further away from operating system flaws and drilled down to applications-layer vulnerabilities they have found a seemingly endless wealth of possibilities for infecting PCs with everything from spyware to botnet programs, SANS researchers contend.Unless something can be done to improve software developers' coding habits or better test popular applications for such issues before they land on end-users' machines, attackers will be able to continue their successful assaults against enterprise networks and devices for the foreseeable future, said Rohit Dhamankar, project manager for the Top 20 report at SANS and a senior manager of security research for TippingPoint.?"There's just been such a dramatic rise in the numbers of vulnerabilities found in applications like Internet Explorer and Microsoft Office and a number of media players that attackers are having their way," said Dhamankar. "Enterprises are bolstering security, but desktop users still pose a massive risk if they can download anything they want from the Web; the attacks are also growing in sophistication to the extent that many can defeat antivirus and other security systems primarily by obfuscating their code."Some of the most powerful tools that hackers have adopted in hunting for potential targets are the same industrial-strength applications fuzzing tools that software vendors themselves are using to search for holes in their products, said the expert.Enterprises could do themselves a favor by enforcing stricter policies that dictate the types of applications that end-users are allowed to put on their work machines and using technical means to ensure that those rules are being followed, Dhamankar said.Other SANS researchers noted that while companies may not want to tell end-users that they cannot utilize media players, messaging clients, and other applications that have moved into the business world from the consumer sector, they could help themselves out by limiting the variety of client-side applications that people may choose from."IT departments can't focus on all the applications of the world, but they can choose several and keep their eye on those while allowing end-users some freedom," said Amol Sarwate, research manager at Qualys who studies vulnerability patterns for SANS. "What companies need to do is enforce standards for applications usage and utilize technical means to block unwanted software, devices, and even wireless access points."While many businesses have already realized that they need to shift more of their efforts toward defending client-side vulnerabilities, most have failed to embrace a proactive approach versus simply keeping track of publicly-reported flaws and patching those issues said Sarwate.Enterprises need to think about future security issues
It will be particularly important for firms to examine the additional security issues that will be introduced in the coming years with broader adoption of technologies including VoIP (Voice over IP), according to the expert."The key is for people to start thinking ahead of these client-side vulnerabilities to understand what the next big thing may be. Things like VoIP need to be examined for their security implications," said Sarwate. "Many companies are already adopting these tools because of all the advantages they offer, but there will be many attacks carried out against these systems as well."Among the advice that SANS is offering organizations hoping to improve their client-side security coverage is to mandate secure configurations at installation time for all applications, to constantly verify patching and upgrading of both applications and system software, to scan for new vulnerabilities frequently, and to keep their security systems up to date.Other leading areas of concern highlighted by SANS in its report included critical vulnerabilities in Web applications that allow for cross-site scripting attacks or for computers to be otherwise compromised simply by pointing their browsers at poisoned URLs."Gullible, busy, accommodating computer users," including executives, IT staff, and others with privileged access also remain a major weak point for enterprise security, according to SANS, as these seemingly more seasoned users of computers and software are still falling for increasingly targeted spear-phishing campaigns in large numbers.One of the best ways to educate users about the problem is for organizations to create fake spear-phishing threats and send them out to internal users to determine which individuals might be most likely to fall for the schemes and follow up with additional training, the group said.Critical vulnerabilities in the software and systems that provide the operating environment and primary services to computer users, or server-side software, remain another area of leading concern, according to SANS.Problems in Microsoft Windows services, Unix and Mac OS services, back-up and AV programs, management servers, database software, and VoIP technologies in particular are proving troublesome, according to the report.Many of those issues can be addressed by following the same advice offered for solving client-side vulnerabilities, SANS said in the research. |
| |
| Gmail works fine on iPhone, blanks on Windows Mobile |
28 November 2007 |
| Windows Mobile Gmail fans are getting antsy about a known glitch in the mobile e-mail offering that hasn't been fixed by Google in about a month.In October, Google began supporting IMAP (Internet Message Access Protocol) for Gmail, which means that when mobile users send and receive Gmail e-mail on their mobile phones, their changes are synched, appearing the next time the user accesses Gmail from any device. With POP3, previously the only e-mail protocol supported by Gmail, if a user deleted a Gmail message from their inbox using their cell phone, the message would still appear in the inbox the next time the user logged on to Gmail from their computer.However, shortly after the IMAP capability was activated, users of Windows Mobile phones began complaining in online forums about problems. Some of them said that HTML e-mails showed up blank on their phones. Others said that message headers appeared on their phones but not the messages themselves.The problem appears to affect mainly Windows Mobile users. In late October, one user complained to Google about the problem with Windows Mobile and got a reply saying that Google hadn't had the chance to test the Windows Mobile mail client."Why would Google make this work with the iPhone and not WM devices," another user wrote in the forum after reading the letter that was purportedly from Google. "I would think the WM community is much larger than the iPhone community, and I find it difficult to believe that no one at Google owns or uses a WM device."On Nov. 16, a Google employee posted a note acknowledging the problem. Google has added the issue on its Gmail known issues page, where users can report their experiences. Google says it is working to address the issue.But by Nov. 27, users were beginning to run out of patience. "Google people! The listing on the known issues page hasn't changed in days ... weeks. At least let us know you are working on this. Do you realize, that Gmail IMAP on Windows Mobile in its current state is unusable?" one person wrote.Google did not reply to a question about when the fix might be released.Solving this issue may not be the end of Google's Windows Mobile problems. One blogger says that the Gmail IMAP service dramatically drains the battery on Windows Mobile phones. Todd Ogasawara, a blogger and a Microsoft Most Valuable Professional in mobile devices, ran an informal test on his T-Mobile Dash, a Windows Mobile phone. He watched his battery life drop 4 percent after instructing the phone to synch with the Gmail IMAP server just once. He began looking at the effect of Gmail IMAP on his battery after noticing a dramatic decrease in battery life once he signed up for the Gmail service.Another tech enthusiast and blogger, Josh Smith, said he has noticed that the Gmail IMAP servers are quite slow and that the amount of time it takes to check them from a phone could lead to a drained battery. However, because the messages are coming through blank, he hasn't been using the service enough to notice an impact on battery life on his Windows Mobile phone, he said.The issues highlight the challenges that Google has complained about in working with the mobile industry. Application developers must tweak or write new applications for each handset operating system and often even for different handsets running the same software. Google hopes to solve the problem with its Android mobile platform, which it plans to make available for free and open source. Some mobile experts, however, have suggested that Android may only exacerbate the problem by adding one more platform that developers will have to address. |
| |
| IBM updates free enterprise search tool |
27 November 2007 |
| IBM and Yahoo issued a new version of their free enterprise search product on Tuesday, just weeks after rival Microsoft announced a competing product.The latest release of IBM's OmniFind Yahoo Edition contains a number of enhancements, according to IBM. Users can now generate up to five separate indexes of documents, thereby enabling them to search from a particular set instead of the entire repository.Other tweaks include the ability to define additional custom search fields, such as from HTML tags or document metadata. "If you've created a Word document with customer metadata fields, it will be able to extract it," said Aaron Brown, IBM's director of search and content discovery. IBM also said the software is now easier to install as a Windows service.OmniFind Yahoo Edition is based on the open source Lucene project. The update includes the latest version of the Lucene core, according to Brown: "It helps us close the loop with the community, because we've contributed a lot of IBM code back into Lucene."However, the update does not include any scalability improvements, and remains limited to searching 500,000 documents per instance, Brown said.Brown said the updates were primarily guided by feedback from customers. The software has been downloaded about 25,000 times, according to IBM. Yahoo and IBM released the first version of the search engine about one year ago.Microsoft's entry into the stand-alone enterprise search market has been seen as potentially disruptive for certain vendors, such as Coveo, but not for search companies offering high-end, specialized products.Like IBM, Microsoft is adopting a multitier strategy around search. Both companies are giving away an offering in the hopes of attracting customers, who will eventually desire greater capabilities and pay for commercial products.Microsoft's new products, Search Server 2008 and Search Server Express 2008, which is free, will be generally available in the first half of 2008, according to the company.Brown said Microsoft's move was not unexpected: "We obviously didn't have any inside information. I can't say I was entirely surprised, given where the market is moving."He said there is "a lot of traction" in Europe for OmniFind Yahoo Edition right now, adding that a range of organizations are using the product, from a small U.S. public school district to a global electronics company, which he did not name.Burton Group analyst Guy Creese recently told IDG News Service that he expected Microsoft's partner community to build products on top of the company's base search technology, extending its market potential. IBM has a head start in this area, with companies such as Axioma.Brown said of IBM's partners, "They've adopted the base platform and are building richer stuff." |
| |
| Microsoft wraps up MOU for Siberian data centre |
27 November 2007 |
| Ice station server
Microsoft said yesterday that it has signed a memorandum of understanding with the Siberian government which could see the software giant park its latest data centre on a remote, sub-arctic part of Russia.… |
| |
| SaaS delivery model takes new turn |
26 November 2007 |
| With the announcement tomorrow by 19Marketplace of Workplace2go, SaaS will add yet another unique facet to its business model.Unlike CRM services from Salesforce.com, RightNow, or Microsoft Dynamics, 19Marketplace offers none of its own products. Rather in its initial launch, it will offer to host a growing menu of well-known applications from other companies.Workplace2go applications include WebEx WebOffice, WebEx Web Conferencing, Microsoft Hosted Exchange E-mail, Blackberry Mobile E-mail, Good Technology Mobile E-mail, Arsenal Digital Remote Data Backup, LivePrism Spam Protection, and McAfee TOPS for desktop security.John Kryzkowski, general manager at 19Marketplace, likens his company to a retailer that takes on product lines from different manufacturers and becomes a specialist in sales, marketing, distribution, and merchandizing."The key is the right merchandise and services for our customers," said Kryzkowski.Although to some extent what 19Marketplace is doing is like the traditional ASP (Application Service Provider) model, this is different in that the services 19Marketplace offers are architected around a multi-tenant infrastructure rather than a dedicated environment for each customer.What makes 19Marketplace even more unique is that it the company does not host its own services; rather it resells popular applications, which are hosted at SaaS infrastructure provider Jamcracker.The current list of applications is targeted at small businesses, and pricing appears to reflect the needs of that audience.The service fee for Live Prism, an anti-spam package, is $1.99 per user per month. The fee for Microsoft Exchange E-Mail server with each user given 2GB of storage is $13.95 per user, per month.Most of the current SaaS providers host applications in their own data center, making their time to market as much as nine months until they can deliver a new application, according to Kryzkowski.On the other hand, 19Marketplace provides a link to services that are already up and running."We plug into them for provisioning and single sign on, and they have access to all of their services," said Kryzkowski.Applications listed above are available immediately. |
| |
| IT Support Engineer [Exchange, Windows Server] - W |
26 November 2007 |
| IT Support Engineer [Exchange, Windows Server] - Worcestershire
IT Support, Network Support, Network Support Engineer, Support Analyst, Installation Engineer, Windows Server, Exchange, SQL, IIS, Clustering, Oracle, MCSE, Disaster Recovery, Business Continuity, Pre-Sales, Cisco.
Fancy joining this Microsoft Gold Certified Partner based in Stourport-on-Severn that are seeking an IT Support Engineer?
If so, read on…….
We require a Senior Engineer to work within our Technical Division.
You'll need a wide range of skill sets including Windows 2003 and SBS Server and experience with Microsoft Exchange. Linux experience would also be beneficial. In addition, you'll be proficient in Windows 2000 / XP and solving desktop related problems.
Experience with server hardware, including RAID and back-up technologies are also required. Skills with routers, internet connectivity and firewalls are also beneficial.
Fault diagnosis and first time fix skills are essential, together with a positive and flexible approach.
It's essential that you possess excellent customer handling and communication skills and hold a valid driving licence.
Microsoft certification would be advantageous.
This position is commutable from the following areas: Worcester, Worcestershire, Stourport-on-Severn, Kidderminster, West Midlands, Droitwich, Redditch, Leominster, Stratford-upon-Avon, Bromsgrove, Solihull, Great Malvern, Evesham, Tewkesbury, Cheltenham, Hereford, Bromyard.
To apply, please contact:
Karl Scrivener
Principal Consultant
Tel: 01908 562585
Idealpeople Ltd
Karl.Scrivener@idealpeople.net
Idealpeople are acting as an employment agency in relation to this vacancy.
Find Top Tips for Job Hunters and Hirers at the [a href="www.idealpeopleblog.com"]Idealpeople blog[/a]
Take a look at all of Idealpeople's vacancies at [a href="www.idealpeople.net"]www.idealpeople.net[/a] |
| |
| C#, .NET Software Developer - Cambridge, C#, .NET |
23 November 2007 |
| C#, .NET Developer - Cambridge C#, .NET
Job Title: .NET Developer, C# Developer, Software Developer, Software Engineer
Based: Cambridge, Cambridgeshire, Cambs, East Anglia
Salary: £40,000 - £50,000
Benefits: Relocation Package, Pension Contribution, Group Life Cover, Private Medical Insurance, Free Food and Beverages, Gym Membership, 25 Days Holiday, Childcare Scheme, Career Progression. Training and development is seen as crucial to the growth of individuals, their teams and the company.
Essential Skills
Degree in Scientific or related discipline.
Significant experience of developing Windows Desktop applications using .NET and/or C#.
Knowledge of the .NET framework, Win32 API and developing for Microsoft platforms.
Knowledge of OOD Object Oriented Design.
Experience implementing database applications, preferably Microsoft SQL Server and Access.
Good verbal and written skills.
Team player.
Buzzwords: .NET, C#, Developer, C++ Software Developer, C# Software Developer, COM, Visual Basic, SQL Server, Win32 API, VB.Net, .Net Framework, .Net 2, XML, Object Oriented Design, Object Oriented Programming, OOD, OOP, UML
Company
Established in 1990
Software house developing powerful analytical solutions worldwide
200+ staff in the UK with partners in 13 other countries, inc. the US, Netherlands, Italy and Germany
Awards include: Fast50, European Fast500, Indy 100
About Idealpeople
Idealpeople exists to align industry specialists with client expectations. We're recruitment experts in the IT, Communications, e-Business and New Media sectors in the UK and internationally
Contact
Karl Scrivener 01908 562585
karl.scrivener@Idealpeople.net
Idealpeople are acting as an employment agency in relation to this vacancy.
Find Top Tips for Job Hunters and Hirers at the [a href="www.idealpeopleblog.com"]Idealpeople blog[/a]
Take a look at all of Idealpeople's vacancies at [a href="www.idealpeople.net"]www.idealpeople.net[/a] |
| |
| ASP.NET Lead Developer, Consultant – Hemel Hempste |
23 November 2007 |
| ASP.NET, C#, .NET, ASP.NET, XML, XSL, XSD, SQL Server, Lead Developer, C# Developer, .NET Developer, Software Developer, Consultant, Technical Consultant, Microsoft, UML, RUP, Web Services, SOA, Service Oriented Architecture, Technical Architecture, Technical Architect, Analysis, Design, Development, e-Business.
Our client, a leading consultancy are currently looking for an ASP.NET Lead Developer / Technical Consultant to be based out of their Hemel Hempstead, Hertfordshire offices.
We have an urgent requirement to secure a Consultant with excellent ASP.NET platform experience.
Required skills and experience
Experience of analysis, design, development and implementation of e-business architectures based on the Microsoft ASP.NET platform.
Strong development experience with OO languages [including C#].
Technical development skills to include Solid Middle tier development experience including .NET Framework, ASP.NET, XML [XSL, XSD], Strong SQL Server.
Experience of formal development/design methodologies i.e. UML, RUP or similar.
Good understanding of issues and standards surrounding Web Services, Accessibility and Service Oriented Architecture [SOA].
In addition, you will bring a “can-do” attitude with a passion and general curiosity for technology.
This position is commutable from the following areas: Hemel Hempstead, Luton, Bedfordshire, Marlow, Dunstable, St.Albans, Harpenden, Watford, Hertfordshire, Buckinghamshire, Maidenhead, Peterborough, Cambridgeshire, Watford, London Colney, Radlett, Tring.
Karl Scrivener
Branch Manager
Tel: 01908 562585
Idealpeople Ltd
Karl.Scrivener@idealpeople.net
Idealpeople are acting as an employment agency in relation to this vacancy.
Find Top Tips for Job Hunters and Hirers at the [a href="www.idealpeopleblog.com"]Idealpeople blog[/a]
Take a look at all of Idealpeople's vacancies at [a href="www.idealpeople.net"]www.idealpeople.net[/a] |
| |
| Programming less |
28 November 2007 |
| A programming lesson I keep relearning.
The design of the central data structure of an app determines the quality of the app, in every way.
Any extra thought that goes into this, will pay off in:
1. Maintainability of the code.
2. Size of the code (you'll write less code with a well thought-out central data structure).
3. Simplicity of the user interface (the structure inevitably shows through in the UI).
4. Ability to respond to feature requests.
5. Adapt to new hardware, OS changes, other apps.
6. More "it just works" experiences.
This is why it's sometimes the right thing to start over from scratch. Programmers often want to start over because they look at the code and it looks complicated, and they think they can make it simpler if they start over. They're right, of course, it will be simpler when they start over, because it won't do nearly as much as the mature product does. Once they finish building out the feature set, it may well be just as complicated.
It's a judgement call. I remember looking at the source of Unix kernel for the first time as a grad student in Wisconsin, and being amazed at the simplicity and obviousness of the code. I couldn't believe something so simple actually worked. Your code at its kernel level must have this simplicity. But at the edges, where you're accomdating the minds of users, inevitably it gets a little messy. The key thing to look for is how hard is it to add a completely new feature. It should be easy to do that. If it's not, it's likely because of a poorly organized (and therefore not well-understood) central data structure.
I've rewritten apps many times, over many years, because when I wrote the first or second versions, I didn't understand the problem well enough, and the code had turned into a morass of patches and workarounds.
Right now I'm recoding the internals of a special-purpose aggregator. I've written many of these, over the years, always quickly, trying to get something running fast, and then lived with data structures that resulted. This time I'm going slowly and carefully, with an installed base of one (me) and ripping up the pavement whenever I find even a slightly better way of doing something. I have other users who are waiting, but that's life.
5/7/97: "When a programmer catches fire it's because he or she groks the system, its underlying truth has been revealed." |
| |
| Google: Jolly green giant? |
28 November 2007 |
| The search and advertising company is a force to be reckoned with across the Web. Now it's looking to do the same in alternative energy (along with many others, large and small). |
| |
 |
|
|
|