First, IT Professionals need to know that the boss is always right. If the executives say that they do not want to use passwords, then that settles it. Of course, IT Pros should make recommendations, but let the boss decide. IT Pros need to document the executive’s decisions, especially decisions that go against what the IT Pro feels is best, and move on. They should not bring them up again. If bosses feel unsupported in the decisions they make, the IT Pro will soon be looking for a new job.

Second, bosses get frustrated when they feel a project is moving slower than they believe it should move. It is necessary to keep them up to date on existing projects. Otherwise, the boss may decide to hire someone else that they perceive as being able to bring more value and get things done. IT Pros need to send the boss a monthly, if not weekly, bulleted list of completed, current, and planned projects; even small ones. If the boss even hints that they would like to know more about a project’s progress, the IT Pro needs to jump on reporting that. A verbal conversation is often faster and much more effective than an IT Professional writing and re-writing a long defensive email.

Third, IT Pros need to ask the boss how they can improve their service to the organization. They need to ask how IT fits into the big picture, and ask how they can support the business strategies. They need to listen and do what the boss says to do. They need to have that conversation every month or so. They need to ask themselves what they would want if they were in the boss’s shoes.

Many IT Pros are confident that, and maybe they are, so valuable to an organization that they would never be fired. The only thing that feeling guarantees is that there will be no advance warning to the termination, because the executives of an organization don’t want to risk any kind of retaliation from an IT Professional that feels so indispensable.

Forward this to all IT Professionals that you care about.

The post IT Professionals: 3 Things IT Professionals Must Do to Avoid Being Fired appeared first on Foster Institute.

Due to more than 35 instances of Samsung Galaxy Note 7 phones exploding, Samsung has recalled the 2.5 million devices.

Fortunately, none of the explosions happened in an airliner. Yet. And may it please never, ever, happen.

Will the ban be enforced and, if so, how? Do all Samsung device owners know which model they have?

Are we all gambling with our lives when we fly on planes with phones that might explode? Will the airlines deny use of other Lithium battery operated devices to make things easier to enforce? If you cannot take phones with you on a business trip, is this a new business opportunity for someone to rent phones to travelers arriving at airports?

The post “This is Your Captain Speaking – No Samsung Phones Allowed” appeared first on Foster Institute.

At a client’s office this week, one of the IT Professionals had an interesting idea. He can configure two-step logon to contact him, not the consultant, for login verification.

If you configure this at your office, here is how it would work: First, the consultant would enter their username and password to login to your network. Then, an app on your smartphone would indicate that the outsourced consultant is trying to gain access. Then, you will be able to choose to allow or deny the consultant’s login attempt.

This IT Professional wants to know, in real-time, when someone is attempting to log on to his network. If you use this arrangement, you will have the capability to permit them or deny them access each and every time.

It is an interesting idea.

The post A Way to Control Consultant Access – Every Time appeared first on Foster Institute.

IT Professionals have approached me to say they feel unhappy with their compensation. And some executives ask how much is enough pay. There are ways to know…

Websites such as Pay Scale dot com, Career Builder dot com, and Salary Expert dot com provide estimated pay ranges based on location and skills.

Executives: Quality IT Professionals are really difficult to find these days. So you don’t want to lose the ones you have. HR specialists have said that money is not the primary motivation for someone to keep their job, as long as the compensation meets a minimum. Your IT Professionals are likely very loyal to you and will invest a great amount of energy to help you. Just know that they may be receiving job offers from others.

IT Professionals: Keep up with certifications – those new skills will help your organization too. You enjoy learning or you’d never have selected an IT career anyway. One source of training and certifications is CompTIA dot org. They offer hardware, networking, security project management, and other certifications referred to with names such as A+ Computer Technician, Network+, Security+, etc. Talk to your employer about ways you can become more valuable to them. Some of you are very good about putting the needs of the organization that you serve, before your own needs. Be careful. If you give too much, and feel undercompensated, the resulting unhappiness can be bad for you and the organization too.

The difficulty executives face is not realizing how much a dedicated IT Pro does. When an IT Professional performs a miracle by breathing life back into a crashed server, it is sometimes difficult for non-IT Professionals to appreciate the level of accomplishment. What IT calls a miracle, executives consider the accomplishment as being part of their job description. They have no idea what is, and is not, involved.

Executives, I’m not saying that every IT Professional needs a pay raise. If you are unhappy with your IT Pro, you may be looking forward to when another company hires them away. In fact, if you aren’t happy with their performance, there is no reason to keep them around. They do, as many executives have said, hold the keys to your kingdom. Or, as I like to say it, they have their fingers on the jugular vein of your company. Do not let them hold you hostage with that power, and don’t be worried about kicking them out if you need to.

But if your IT Professional is someone who you like, and appreciate, and you can see that they are good at what they do, keep in mind that good IT Professionals are a hot commodity these days.

The post Are You Paying IT Pros Too Much? appeared first on Foster Institute.

Mark these dates on the calendar:

8/5/2016    Fri       DEF CON®
8/6/2016    Sat       DEF CON®
8/7/2016    Sun      DEF CON®
8/8/2016   Mon     SuperTech 2016
8/9/2016    Tue      SuperTech 2016
8/10/2016  Wed    SuperTech 2016

DEF CON® is the famous security and hacking convention in Las Vegas. This is an exciting event for all IT Pros.

The Foster Institute “SuperTech” experience in Napa Valley empowers your IT Professionals to grow in ways that will propel your organization’s success to new levels.

Invest in your IT Pros – sometimes their future is your future.

IT Pros give so much energy, long hours, and are dedicated to the success of your organization. They show patience with end-users.

Reward them with this awesome experience in return. They’ll look forward to it all year!

Forward this to other executives who want to show more appreciation to their IT Professionals too. It is a win-win for your organization.

Save the dates. They’re the only ones until 2017.

The post Your IT Pros Deserve This appeared first on Foster Institute.

The guidelines can be found by entering this search into Google:

Top 10 IA Mitigation Strategies site:nsa.gov

He also explained that, when it comes to Cyber-Security, the point of contact needs to be the person who handles risk management.

I see that too. IT Professionals are often overwhelmed with tasks related to keeping the network, applications, and managers happy. When a risk manager is able to intervene on their behalf and free up some of an IT Professional’s time, then IT Pros have time to implement important tactical security steps.

Review the 10 Guidelines with your IT Pro. See what you find out.

And forward this to the other executives that you know… so they can help the NSA make the US a safer place. They need your help to do so.

The post NSA National Security Agency appeared first on Foster Institute.

Is to differentiate between 1) Cyber-security changes the users will notice, such as making them change their passwords more often, vs. 2) Security changes that can be implemented without the user even noticing. Of course, #2 is the way to go. That way, the VP of IT and the CFO both win. Things are more secure, and the VP of IT doesn’t feel like he is getting in the way of business.

How strict you want your own VP of IT to be is part of your risk assessment. If your customers entrust sensitive information to you, and if your organization’s reputation will be tarnished if there is a breach, then those conditions dictate a more restrictive posture.

Please help spread the word that, as in #2 above, every organization should strongly consider implementing, first, the security controls that users won’t even notice.

Please post your comments below….

The post How Strict Do You Want your IT Pro to Be? appeared first on Foster Institute.

Every time you answer, they state, “You do not understand what I am telling you – your computer is infected!”

If you transfer them to your IT Pro, they will keep telling him, “The computer is infected. Go turn it on and let me take control of the computer to remove the virus.”

When your IT Pro tells the caller that they aren’t fooling anyone, the bogus tech person will call the worker back again.

If you ask the caller what company they work for, they give names like GoTechs247, or HS Info Technology, etc. There are even websites that look real but the phone numbers lead nowhere.

Make your workers aware and tell them to keep hanging up, over and over, because those guys won’t let up. Make sure your spouse and kids know too.

Once you, or members of your team, give hackers control over a computer, the attacker can use that machine for whatever they want. Steal your sensitive data, launch attacks from your machine against other companies, store illegal material, and the list goes on. All the while, your company looks like the culprit.

Some of you already know that the US Postal Service just announced they were breached as well. One of the differences between big and small companies is that the big companies usually find out that they’ve been breached.

Tell everyone you know to ignore those phone calls from “tech support” forever. If it was your real IT pros, they would have fixed the problem already.

Please post your comments below…

The post A Caller Says Your Computer Is Infected appeared first on Foster Institute.

At least one of the training days will be aboard an aircraft carrier! Other day possibilities include a redwood forest, a winery, and/or anywhere else other than a boring hotel conference room!

Option 1:

2/24/2015 Tue Day 1 SuperTech “Best Practices” workshop for IT Pros
2/25/2015 Wed Day 2 SuperTech continued
2/26/2015 Thu Day 3 is “PCI Day” to understand PCI Compliance (optional)

Option 2:

7/28/2015 Tue Day 1 SuperTech “Best Practices” workshop for IT Pros
7/29/2015 Wed Day 2 SuperTech continued
7/30/2015 Thu Day 3 is “PCI Day” to understand PCI Compliance (optional)

In the past, some executives have exclaimed, “Why should my IT Pro get to go to Napa and I don’t?” Good News: This year there are trainings for executives, leaders of executive groups, etc:

2/27/2015 Fri Plain English “Best Practices” workshop for Executives
7/31/2015 Fri Plain English “Best Practices” workshop for Executives

You are encouraged to bring spouses and significant others. You might as well stay the weekend and relax!

Everyone will receive a certificate of completion.

We’ll help you make the travel easier and provide recommendations for site-seeing and other activities in case you have time for that too.

Mark the dates on the calendar now and please email mike@fosterinstitute.com to receive more information!

The post IT Training Budget for 2015 appeared first on Foster Institute.

One big problem with Shellshock is that it is very easy for attackers to exploit a system. They tell a system, “Here is a program. Run it.”

Apple has not, as of now, released a patch for OSX. There is a new patch for Linux, but it does not completely fix the problem.

As an executive, even if you have limited IT experience, you can go to Google and enter this search phrase:
filetype:sh inurl:cgi-bin site:fosterinstitute.com
(replace Foster Institute’s web site with your own actual website)

Hopefully, Google will tell you that the search did not match any documents. However, either way, it is still possible you are vulnerable. Ask your IT Pros to make sure your web server does not use Linux.

Please forward this to everyone that you know if you want to help him or her be secure against the ShellShock vulnerability!

The rest of this document is more technical, intended for your IT Pros.

There is a patch, but the patch only solves part of the problem. To see if the patch is in place, you can execute the bash command:
env x='() { :;}; echo vulnerable’ bash -c “echo patch this system”
There will be an error message anyway, but if you do see the words “patch this system” displayed as output, then the patch hasn’t been applied.

Even after you apply the patch, as of the time of this blog posting, your system is still vulnerable. To demonstrate, issue this command:

env X='() { (a)=>\’ bash -c “echo date”

You will see error messages similar to:
bash: X: line 1: syntax error near unexpected token `=’
bash: X: line 1: `’
bash: error importing function definition for `X’
Then, to find out if you are vulnerable, look at the contents of the file echo by issuing the command:
cat echo
If the response shows the date, then you are vulnerable:
Fri Sep 26 02:07:16 UTC 2014

To learn more reference CVE-2014-6271 and CVE-2014-7169

Please post your comments below…

The post Shellshock: Check Your Web Server appeared first on Foster Institute.