Cool Yule Tools: Best techie gifts for 2014

The National Santa Agency has a handle on what everyone wants.

Sonos Play:1 $199
This portable speaker lets you experience the joy of the Sonos Music system without the additional equipment (a wireless bridge, for example) needed with other parts of their gear. Control music through the wonderful Sonos app on your phone or tablet and you'll be hearing lovely music all season long.

KEF X300A Wireless Digital Hi-Fi Speaker System $799.99
When you think of wireless speakers, you think of smaller, Bluetooth-enabled devices (such as the Jambox Jawbone, or the Sonos Play:1, etc.), aimed a providing some good sound for music stored on tablets, phones, etc. These speakers are not like those systems.

The KEF X300A speakers are huge speakers – they look more like giant audio system speakers you’d have connected to your older audio system (if you still had a receiver, record player, cassette deck, etc.) They’re very heavy – when you get these, decide quickly where you want them and keep them there – portable speakers these are not.

iHome iDL100 – Triple Charging FM Clock Radio Stereo System $149.99
With the integration of alarm clock functions (clock, alarm, snooze button, etc.), you’ll most likely want to have this unit sitting on your nightstand. The Lightning Connector dock at the top lets you place your iPhone 5/5S (or the new 6 models) as well as your iPad to recharge it. If you’re so motivated, you can even set your alarm clock to wake up to a favorite song instead of an annoying buzzer or beep.

But leaving this on a bedroom nightstand isn’t the only thing you’ll want to do with the iDL100 – The system allows for three devices to be recharged (the two Lightning-based devices at the top, as well as a USB charging port in the back), and the speakers are good enough to place in a kitchen or other small room for additional audio entertainment. If you have a video that you’d like to watch on your phone or tablet, for example, the system provides excellent audio to accompany the video. An AUX in jack lets you connect any other older audio device (or an old iPod that doesn’t have the Lightning connector).

Pure Evoke F4 with Bluetooth $220
Pure continues to impress us with its Internet-radio-themed devices – this Evoke F4 is a very old-school, classic look-and-feel device that can access a variety of different music streaming sources from around the world. But also realizing that customers may already have a bunch of music either stored on computers, storage devices or even phones/tablets, they’ve added Bluetooth connectivity to play music from those devices to the Evoke F4 system.

In addition to the Internet radio services (connecting through Pure’s Connect service), the Evoke F4 can connect to Sirius XM satellite radio (a separate subscription would be required) and FM radio (hence the old-school metal antenna). Connecting to the Internet is done through Wi-Fi (interestingly, no Ethernet port on the unit). Volume control and menu control are handled through nice metal dials, but there’s also some touch-enabled buttons on the display for making other menu choices.

Star Wars Street by 50 on-ear wired headphones (SMS Audio) $199.95
If you’re a Star Wars fan and you love music, and - more importantly - you want others to know about your love of the movie, then these headphones are ones that you’ll want to sport when you’re out and about. These high-performance headphones provide pretty good sound quality for your music, movies or if you want to use when video gaming, and come in different Star Wars themes and colors (we tried the white Stormtrooper model, but there’s also some other cool colors/themes such as Rebel Alliance, Boba Fett and Galactic Empire). The on-ear wired headphones include 40mm drivers, passive noise cancellation (non-powered) and can fold up for putting into your travel bag.

Icon Q Boundless E1 Bluetooth earphones $65
These small and light earbuds/earphones will wirelessly connect you with your music device (phone, MP3 player, tablet) without a tangled cord getting in the way. This can be good if you want to use these while working out (although I prefer the Plantronics BackBeat Fit earbuds for that purpose), or if you just don’t like the extra bulk of a connection cord. The earbuds provide good, but not stellar, sound for your music or movies -you are using Bluetooth, after all. Pairing can be done via Bluetooth (an in-ear prompt helps you determine whether the earphones are powered on or off, or whether you’re in pairing mode), or NFC if you have an NFC-compatible phone or tablet.

Polk Audio Ultrafocus 8000LE noise cancelling headphones $250
For comfort and sound quality, these noise-cancelling headphones are pretty impressive. We've tried other brands and they always felt heavy and clunky on the head. They were the kind where your wife says, “You’re not really going out of the house wearing those are you?”

The Ultrafocus 800LE is Star-Wars-white plastic on the outside and chocolate brown on the inside – which means the ear cups themselves are brown along with the padding on the inside of the headband. On the outside of the left ear cup is the battery cover for the two AAA batteries you need to run the headphones. On the outside of the right is a circular control panel.

Plantronics BackBeat Fit headphones $129.99
These super comfortable, around-the-ear earbuds use Bluetooth wireless to connect to your phone/music player, and provide an outstanding listening experience for when you're jogging, running or generally working out and building up a sweat. The headphones are sweatproof and have a long-lasting battery, so the tunes won't cut out on Heartbreak Hill.

Plantronics BackBeat Pro headphones $249.99
These over-the-head headphones include active noise cancellation and a superior battery life, making it a great gift for anyone looking for great-sounding music and quiet while they’re in a noisy environment (aka planes, room full of kids, etc.) Additional features, such as multipoint connections (connecting to a phone and tablet, for example), an “OpenMic” button that reduces the volume so you can hear outside noise without removing the headphones, and a nice comfortable fit make this an excellent choice to give or receive as a gift this year.

iHome iBN26 Bluetooth speaker/speaker phone $79.99
If you're looking for a small and stylish wireless speaker for casual use around the house, iHome's iBN26 should be on your list. This compact system can connect to your mobile device using Bluetooth or NFC. After pairing, all you have to do is start playing music on your mobile device and your songs will be streamed wirelessly to the iBN26. Sound quality is good, albeit light on bass and a little muddy on higher notes. But for the price, it's more than enough to fill a room with whatever tunes you fancy.

Boom Swap headphones $69.99
Hey kids, having a hard time deciding whether you want on-ear or over-the-ear headphones? Can’t decide what color to make your headband or earcups? Then check out The Boom Swap headphones, a modular headphone system that allows you to make changes depending on your mood and situation. It’s like a “build your own headphone” system! The headphones are made out of a flexible plastic and come with several components, including two foam over-the-ear earcups that you can easily slide onto the on-ear parts. The flexible headband can be removed and replaced with a second one of a different color (ours came with black and blue headbands). On the outside of the earcups, another two options for colors. The headphones come with three color options (black/blue, white/black and mint/orange), but unfortunately you can’t buy different colored headbands or earcaps separately.

Polk Audio Hinge headphones $97 (Newegg) to $129 (Best Buy and Nordstrom)
These headphones have an old-school, over-the-ear style, but in a compact form that’s also more comfortable. The aluminum frame make them lightweight, yet still very sturdy, adding the additional comfort.

These were a lot more comfortable than most on-ear sets we’ve tried - there’s a good seal, but not a lot of tight pressure. Music quality was surprisingly good bass and treble for headphone sin this price range - it gave out some nice deep and clear tones.

REPORT 3: Office gadgets and other work gear
Why should your family members have all the cool gifts at home? Here are some picks of some great technology gift ideas that will make you more productive when you're working in your cubicle or office.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

The top infosec issues of 2014

Security experts spot the trends of the year almost past

There is still time for any list of the “top information security issues of 2014” to be rendered obsolete. The holiday shopping season is just getting into high gear, after all, and everybody knows it was from late November to mid-December last year when the catastrophic Target breach occurred.

But this list is about more than attacks and breaches – it is about broader infosec issues or trends that are likely to shape the future of the industry.

Several experts offered CSO some thoughts on their top picks, what can be learned from them and whether that knowledge can help organizations improve their security posture in the coming year.

Cyber threats trump terrorism
An Associated Press story this past week on the federal government’s $10-billion annual effort to secure its multiple agencies noted, almost in passing, that, “intelligence officials say cybersecurity now trumps terrorism as the No. 1 threat to the U.S.”

That makes sense to Sarah Isaacs, managing partner at Conventus. While cyber attacks have been expanding and evolving for decades, Isaacs said there has been a qualitative change: It is not just criminals trying to steal money – it is nation states using it for espionage and even military advantage.

Be sure not to miss:

Free security tools you should try

In May, “the Department of Justice indicted five members of China’s People’s Liberation Army on felony hacking charges for stealing industrial secrets,” she said. “We’ve never seen that before.”

Then in September, “NATO agreed that a cyber-attack could trigger a military event,” she said. “This is about more than protecting credit cards. This is escalating to new levels.”
"Everyone is oversharing everything. The threats are broad and potentially catastrophic."
sarah isaacs

Sarah Isaacs, managing partner, Conventus
Author, security guru and Co3 Systems CTO Bruce Schneier, would likely agree. In a recent blog post, he wrote that increasingly sophisticated attacks, especially advanced persistent threats (APT) that are not about financial theft, are coming from, “a new sort of attacker, which requires a new threat model.”

There is evidence of that in a recent study by ISACA on APTs. CEO Rob Clyde said 92% of respondents, “feel APTs are a serious threat and have the ability to impact national security and economic stability.”

Clouds – private, public and hybrid – are not new. But the steady increase in the use of cloud storage services is posing larger risks to businesses.

Schneier, in his blog post, said the continuing migration to clouds means, “we've lost control of our computing environment. More of our data is held in the cloud by other companies …”

While experts say cloud service providers frequently provide better security, that may not be true of so-called “shadow” or “rogue” use of clouds by workers who believe that is an easier way to do their jobs than going through IT.

Internet of Everything (IoE) – a hacker frontier

The Internet of Things (IoT) is so last year. It is now the IoE. Smart, embedded devices in homes, cars, electronics, machines, and worn by individuals are now mainstream. They already number in the billions, and estimates of their growth range from 50 billion by 2020 to more than a trillion within the next decade.

And that means a growing tsunami of data flowing to the Internet, where it can be sold for marketing purposes or stolen for more malicious means.

Isaacs, who says she is among those who uses an exercise wearable, said she used “dummy data” to register it. “So nobody knows it’s my data,” she said. “It can’t be mapped directly to me.”

In general, however, she said, “everyone is oversharing everything. The threats are broad and potentially catastrophic. I’m very nervous about the smart cars I see.

There does seem to be an increasing awareness of the privacy implications of smart cars. The AP reported this week that 19 automakers that make most of the cars and trucks sold in the U.S. signed on to a set of principles, delivered to the Federal Trade Commission (FTC), that seek to reassure vehicle owners that the information gathered by those vehicles, “won't be handed over to authorities without a court order, sold to insurance companies or used to bombard them with ads … without their permission.”

The vulnerabilities of “smart” devices to hacking have been demonstrated numerous times, prompting Phil Montgomery, senior vice president of Identiv to call for, “a more regimented standards-based security approach that relies less on outdates processes around username/password technology and more on stronger forms of authentication.”

No parties for third parties
This was the year that the risks of breaches through third-party contractors made it into mainstream consciousness. The Target breach, which exposed 70 million records, was just one of many that came through outside vendors.

Regulatory agencies are trying to maintain that awareness. Stephen Orfei, the new general manager of the Payment Card Industry Security Standards Council (PCI SSC) noted in a recent interview that, “security is only as good as your weakest link – which means the security practices of your business partners should be as high a priority as the integrity of your own systems.”
"Employee negligence was at an all-time high in 2014."
christine marciano

Christine Marciano, president, Cyber Data-Risk Managers
Christine Marciano, president of Cyber Data-Risk Managers, said that in addition to vetting vendors for rigorous security standards, companies should, “require their vendors to carry and purchase cyber/data breach insurance, to indemnify them for any costs associated with a data breach caused by the vendor’s negligence.”

The porous, sometimes malicious, human OS
While third parties may be a weak link in the security chain, that is less likely due to technology and more due to the human factor.

It was former National Security Agency contractor Edward Snowden who brought the risks of malicious insiders to international attention in 2013, but the danger to enterprises can be just as great from loyal insiders who are simply "clueless or careless," and fall for social engineering scams.

Joseph Loomis, founder and CEO of CyberSponse, said he is, “sure there are major companies out there with little controls over their employees and their access rights. Who is watching who and what they’re doing?”

It is also about employees controlling themselves when presented with ever-more persuasive social engineering attacks.

The federal government reported earlier this year that 63 percent of the breaches of its systems in 2013 were due to human error.

According to Marciano, “employee negligence was at an all-time high in 2014,” with the problems ranging from, “failure to perform routine security procedures to lack of security awareness, routine mistakes and misconduct.”

Eldon Sprickerhoff, cofounder and chief security strategist at eSentire, noted that, “phishing emails are getting better and better. I’ve seen some that were so well targeted, so well done that I could not tell the difference.”

And it is not just the average worker who is a problem. Identity Finder CEO Todd Feinman said the problem goes all the way to the top. “Many executives don’t know where their sensitive data is so they don’t know how to protect it,” he said.

Ubiquitous BYOD
While BYOD is now mainstream in the workplace, Isaacs calls the increased focus on mobile computing, “very scary, and it’s going to get even worse.”

BYOD is now bringing, “extremely unreliable business applications inside the walls of corporations,” she said. “There are a lot of software vulnerabilities. Every app that is free or 99 cents, probably doesn’t have great level of security. And people don’t install patches either.”

According to Clyde, “there are now many times more mobile devices than PCs in the world. In fact, in many regions of the world, mobile devices are the only way most users connect to the Internet,” yet security remains a relative afterthought.

ISACA found that, “fewer than half (45%) have changed an online password or PIN code.

And now, connected wearable devices (BYOW) are becoming common in the workplace, yet, “a majority of professionals say their BYOD policy does not address wearable tech, and some do not even have a BYOD policy,” Clyde said.

The age of Incident Response (IR)
All of the above issues have led to an increased focus on IR. According to Schneier, this is not just the year but the decade of IR, following a decade of protection products and another of detection products.

In his blog post, he cited three trends: More data held in the cloud and more networks outsourced; more APTs by nation states and; a continuing lack of investment in protection and detection, leaving the bulk of the burden on response.

But IR has been more on everybody’s lips in 2014 than even a couple of years ago. The mantra of security experts is that it is not a matter of if, but when, an organization will be breached, and that an effective IR plan (combined with detection) can make attacks more of a nuisance than a disaster.

Getting IR right is crucial, but Tom Bain, vice president of CounterTack, calls it, “the hardest job in security. You can have all the technology in place to detect, prevent and analyze, but if your workflow is broken, or the team is so inundated with incident investigation, you are still vulnerable,” he said.

More regulation, please
An industry that generally decries government regulation – retail – is now singing the opposite tune when it comes to cyber security.

A Nov. 6 letter signed by 44 state and national organizations representing retailers, addressed to the leaders of both houses of Congress, called for, “a single federal law applying to all breached entities (to) ensure clear, concise and consistent notices to all affected consumers regardless of where they live or where the breach occurs.”

Sprickerhoff said such a law would be, “a good first step. There are 38 states with different definitions of what is a breach, so things are getting a bit out of hand,” he said. “If you had unifying description of what needs to be done, that’s not a bad thing.”

Richard Bejtlich, chief security strategist, FireEye
“I worry that ‘compliance with frameworks’ attracts a lot of attention,” said Richard Bejtlich, chief security strategist at FireEye. “I would prefer that organizations focus on results or outputs, like what was the time from detection to containment?

“Until organizations track those metrics, based on results, they will not really know if their security posture is improving,” he said.

What to do?
There are, of course, no magic bullets in security. Isaacs said, noting that it’s almost impossible to say what is the biggest threat. “I heard a speech where it was described as, “death by a thousand cuts,” she said.

But experts do have suggestions. Sprickerhoff said more training is crucial, not just the security awareness of employees, but the next generation of IT security experts.

“I don’t think it’s ever been harder to find good people in IT security,” he said. “There’s not much in course work at the college level.”

Eyal Firstenberg, vice president research, LightCyber, said improving security is going to take a combination of technology and training.

“There is a need for fast and accurate alerts and notifications, which ultimately determine the outcome of these cyber engagements,” he said, but added that, “organizations need more professional diagnosticians on staff who are trained to know what threats are real and need to be addressed, and which ones aren’t.”

Ashley Hernandez, an instructor for Guidance Software, calls for more communication among organizations. “Security professionals need to have a way to share intelligence about patterns or attack types to others in their industry or trusted security groups,” she said.

Clyde notes that ISACA, “has a number of programs, from risk governance frameworks like COBIT 5 to the Cybersecurity Nexus (CSX), to ensure cybersecurity professionals have the skills they need to defend enterprises from the plethora of threats.”

Finally, Loomis offers a short list:
Improve procurement processes. “It takes too long to buy new tools,” he said.
Start educating your staff on what the DHS and NIST Frameworks really are. Read the MITRE book on the 10 strategies to a world-class SOC.
Stop believing the marketing and get real-world feedback on tools. “Security has put a lot of money into marketing, but that doesn’t mean the solution is right for the organization,” he said.
Run simulations. “When was the last time a company ran a real cyber drill?” he asked.
Stop following paper policy, “Militarizing your team, running drills, making it second nature is what will help the response process, not following a check list,” he said.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com