Unless you have been living under a rock, there is a good chance you
have caught wind of Microsoft’s latest operating system. Those eager to
see what the new OS is all about had their first chance to take a peek
back in February when Microsoft released the Windows 8 Consumer Preview.
More than a million downloads took place within the first day of the
preview's release, but users were in for a shock as major changes
awaited them. By far the most controversial
has been the replacement of the Start menu for the new Start screen,
and inherently, Microsoft's decision of doing away with the Start button
on desktop mode.
For the first time since Windows 95 the Start button is no longer a
centerpiece of the operating system, in fact it's gone for good.
On the final version of Windows 8, clicking the bottom-left corner of
the screen -- where the Start button would normally be located --
launches the Metro interface (or whatever it is they are calling it
now). The new tile-based interface is radically different from anything
used on a Windows desktop and resembles what we've successfully seen
working on the latest iterations of Windows Phone.
However, many users seem to be struggling to get their head around
it. Personally, in spite of using Windows 8 for several months, I'm
still undecided if I like the new interface or not. It certainly takes
some time getting used to and for that reason I'm not jumping to
conclusions just yet.
My opinion aside, there are countless users that have already shunned
the new interface and many of them made their thoughts heard in our
recent editorial "Windows 8: Why the Start Menu's Absence is Irrelevant". Yet, while everyone loves to try and remind Microsoft about how much of a flop
some previous operating systems such as ME and Vista were, and that
Windows 8 will be no better, we believe the new operating system still
has a lot to offer.
Microsoft's PR machine has been hard at work over the past few
months, trying to explain the numerous improvements Windows 8 has
received on the backend. The good news is that it shows.
Coming from the two previews and now the final release of Windows 8,
the OS seems smoother than Windows 7. It has been well documented that
Windows 8 starts up and shuts down faster, so that wasn’t much of a
surprise. Maybe it's the inevitability of bloating an OS installation
that is a couple of years old (in the case of Windows 7), but there's
this sense of when you move from a hard drive to an SSD, things just
appear slightly quicker. This was surprising as I had not expected to
notice much of a difference for general usage.
Of course, this is merely an informal observation and we are here to
back up those impressions with hard numbers (read: lots of benchmarks in
the coming pages).
Back when Vista first arrived I remember comparing how it performed
to XP and being extremely disappointed with the results. Vista was
generally rough around the edges and that included drivers, so gaming
and productivity applications were more often than not slower in the new
OS.
For comparing Windows 7 and Windows 8 we will measure and test the
performance of various aspects of the operating system including: boot
up and shutdown times, file copying, encoding, browsing, gaming and some
synthetic benchmarks. Without further ado...
The following benchmarks were conducted using our high-end test system which features the Intel Core i7-3960X processor, 16GB of DDR3-1866 memory and a GeForce GTX 670
graphics card, all on the new Asrock X79 Extreme11 motherboard. The
primary drive used was the Samsung Spinpoint F1 1TB, while the Kingston SSDNow V+ 200 256GB SSD was used for the AS SSD Benchmark and Windows Explorer tests.
Using the Samsung Spinpoint F1 1TB HDD we saw OS boot up times
reduced by 33%. Going from 27 seconds with Windows 7 to just 18 seconds
with Windows 8 is obviously a significant improvement and it means SSD
users will be able to load Windows 8 in a matter of a few seconds.
A similar improvement is seen when measuring shutdown time. Windows 8
took 8 seconds versus the 12 seconds it took an identically configured
Windows 7 system.
We tested wake-up from sleep times using a standard hard disk drive.
Windows 8 shows a marked improvement here as well, however we still
thought 10 seconds was too long. We then tested Windows 8 using our SSD
and the exact same 10 second window was repeated. With <5 second wake
up from sleep times being touted by today's Windows 7 laptops, we
imagine the operating system detects when you are using a laptop and
that there are special power saving features on a mobile system that
make a difference.
3Dmark 11 is used primarily to measure 3D graphics performance,
meaning graphics card drivers play a vital role here. Still the
performance was very similar on both operating systems, though the more
mature Windows 7 was slightly faster.
Multimedia performance is said to be another of the strengths of
Windows 8, and as you can see when testing with PCmark 7, it was 9%
faster than its predecessor.
Using the Mozilla Kraken benchmark we compared the performance of
Windows 7 using IE9 and Windows 8 with IE10. As you can see the desktop
version of the IE10 browsers on Windows 8 delivered virtually the same
performance as IE9 on Windows 7. The Metro version of IE10 was 3%
faster, reducing the completion time to just 3926ms. Update: We've added benchmarks for the latest
versions of Firefox and Chrome on both operating systems. Besides
beating IE to the punch on these synthetic benchmarks, the take away
here is that both browsers tend to perform slightly better under Windows
8.
Google V8 is another browser test we used. In this case it gives a
score, so the larger the number the better. Again we see that the
desktop version of the IE10 browser in Windows 8 is very similar to IE9
from Windows 7. Though this time the Metro version is actually much
slower, lagging behind by a 21% margin.
Chrome and Firefox take a huge lead compared to IE, and on both counts the browsers behave better running on Windows 8.
PCmark7 showed us that Windows 8 was faster than Windows 7 in
multimedia type tests and this has been confirmed by the x264 HD
Benchmark 5.0 which favored Microsoft’s latest operating system by a 6%
margin in the first pass test.
Although the margin was very small when testing with HandBrake, we still found Windows 8 to be 1.5% faster than Windows 7.
03. Benchmarks: Excel, File Copy, Gaming
Comparing Windows 8 armed with the new Office 2013 suite we found
that it was 10% faster when running our Excel MonteCarlo test against
Windows 7 using Office 2010. Even when comparing apples to apples, with
both operating systems running Excel 2010, Windows 8 is more efficient
using the CPU cycles to its benefit on our MonteCarlo simulation.
The AS SSD Benchmark was used to measure the performance of the
Kingston SSDNow V+ 200 256GB SSD. Here we see that Windows 8 and Windows
7 delivered virtually the same sequential read and write performance.
Despite delivering similar sequential read/write performance we found
in the ISO benchmark that Windows 7 was 9% faster based on an average
of three runs.
Windows 8 features a new Explorer interface for transferring files,
which provides more accurate data on transfer speeds and estimated time
of completion. It also stacks multiple transfer windows together. The UI
is awesome, but on the performance side of things there is little
difference when transferring multiple large files together or
individually. Windows 8 and Windows 7 deliver similar performance in
both situations.
When transferring thousands of smaller files we also found that Windows 7 and Windows 8 offer the same performance.
Finishing up we looked at gaming performance using Just Cause 2, Hard
Reset and Battlefield 3. Similar to the previous 3DMark test, this
relies on graphics drivers more than anything else. As you can see both
operating systems provide similar performance with a very slight edge to
Windows 7's advantage.
04. Benchmarks: Excel, File Copy, Gaming
Comparing Windows 8 armed with the new Office 2013 suite we found
that it was 10% faster when running our Excel MonteCarlo test against
Windows 7 using Office 2010. Even when comparing apples to apples, with
both operating systems running Excel 2010, Windows 8 is more efficient
using the CPU cycles to its benefit on our MonteCarlo simulation.
The AS SSD Benchmark was used to measure the performance of the
Kingston SSDNow V+ 200 256GB SSD. Here we see that Windows 8 and Windows
7 delivered virtually the same sequential read and write performance.
Despite delivering similar sequential read/write performance we found
in the ISO benchmark that Windows 7 was 9% faster based on an average
of three runs.
Windows 8 features a new Explorer interface for transferring files,
which provides more accurate data on transfer speeds and estimated time
of completion. It also stacks multiple transfer windows together. The UI
is awesome, but on the performance side of things there is little
difference when transferring multiple large files together or
individually. Windows 8 and Windows 7 deliver similar performance in
both situations.
When transferring thousands of smaller files we also found that Windows 7 and Windows 8 offer the same performance.
Finishing up we looked at gaming performance using Just Cause 2, Hard
Reset and Battlefield 3. Similar to the previous 3DMark test, this
relies on graphics drivers more than anything else. As you can see both
operating systems provide similar performance with a very slight edge to
Windows 7's advantage.
05. Faster, Slower, Better?
It's often been the case with new Windows OS releases that it takes
some time before performance is up to par or above the level of its
predecessor. Possibly the most extreme example I can recall was the move
from Windows XP to Windows Vista,
though that was partly due to immature drivers on the all-new platform,
and partly to do with the fact that Vista was a resource hog.
Microsoft seemed to hit full stride with Windows 7,
developing a fast and efficient operating system. Thankfully it seems
Windows 8 continues to build on that pattern as we found it to be on par
with and ocassionally faster than 7.
The improvements that have been made to startup and shutdown times
are self-evident, and no doubt a major focus on the new OS' development
as this will particularly benefit laptop and tablet users. Another
notable improvement was seen in multimedia performance. This was first
observed when running PCMark 7 and later confirmed when we ran x264 HD
Benchmark 5.0 and our HandBrake encoding test.
Most of the other tests saw little to no difference between the two
operating systems. This was especially true for the gaming benchmarks,
but most surprising on the IE tests which we figured would have shown a
big advantage for IE10, but not so.
Both AMD and Nvidia seem to be on top of their drivers for Windows 8
from day zero, as we were able to achieve the same level of performance
in Windows 8 as we did in Windows 7 using the GeForce GTX 670 and the
Radeon HD 6570.
From a performance standpoint Windows 8 appears to offer a solid
foundation from the get-go. Although there are only a few select areas
where it is faster than Windows 7, we are pleased that it's able to
match it everywhere else.
Looking beyond benchmarks, Windows 8 appears more polished than
Windows 7, even if you plan to live on the desktop and aren't too fond
of the Start screen, general usage is smoother and appears to be faster
on Windows 8, which I found most noticeable on our somewhat
underpowered Athlon II X4 system. If anything, it's a great start, now
the Metro/Modern style will have to prove itself as a cross-platform OS
that marries desktop, laptop and tablet PCs.
A
comprehensive article that touches on cyber-crime laws, the limits to overcoming cyber-crime and the opportunity in the collective security of the human race.
With the advent of the computer age, legislatures have been struggling
to redefine the law to fit crimes perpetuated by computer criminals. This crime
is amongst the newest and most constantly evolving areas of the law in many
jurisdictions. The rise of technology and online communication has not only
produced a dramatic increase in the incidence of criminal activity, it has also
resulted in the emergence of what appears to be some new varieties of criminal
activity. Both the increase in the incidence of criminal activity and the possible
emergence of new varieties of criminal activity pose challenges for legal
systems, as well as for law enforcement.
The news said that another person had their identity stolen.
It happened again. You might even know of someone that had it happen to them.
We often hear of percentages - and they are surprisingly high. Enforcement is
taking place, but we have to wonder if computer crime laws are really having
any effect against cyber crime.
Defining Cyber Crime
Computer crime refers to any crime that
involves a computer
and a network.The
computer may have been used in the commission of a crime, or it may be the
target. Net-crime refers to criminal exploitation of the Internet.Cyber-crimes
are defined as: "Offenses that are committed against individuals or groups
of individuals with a criminal motive to intentionally harm the reputation of
the victim or cause physical or mental harm to the victim directly or
indirectly, using modern telecommunication networks such as Internet (Chat
rooms, emails, notice boards and groups) and mobile phones (SMS/MMS)"
Hacking has a rather simple
definition to it. Basically it is defined as the unauthorized use of a computer
- especially when it involves attempting to circumvent the security measures of
that computer, or of a network.
Beyond this, there are two basic types of hacking.
Some only hack because they want to see if they can do it - it is a challenge
to them. For others, however, it becomes an attack, and they use their
unauthorized access for destructive purposes. Hacking occurs at all levels and
at all times - by someone, for some reason. It may be a teen doing it to gain
peer recognition, or, a thief, a corporate spy, or one nation against another.
Effectiveness of
Computer Hacking Laws
Like any other law, the effectiveness must be determined by its deterrence.
While there will always be those that want to see if they can do it, and get
away with it (any crime), there are always the many more who may not do
something if they are aware of its unlawfulness - and possible imprisonment.
In the early 1990's, when hacker efforts stopped AT&T communications
altogether, the U.S. Government launched its program to go after the hackers.
This was further stepped up when government reports (by the GAO) indicate that
there have been more than 250,000 attempts to hack into the Defense Department
computers. First there were the laws - now came the bite behind it. One of the
effects of computer hacking brought about focused efforts to catch them and
punish them by law.
Then, more recently, the U.S. Justice Department reveals that the National
Infrastructure Protection Center has been created in order to protect our major
communications, transportation and technology from the attack of hackers.
Controlling teens and hackers has become the focus of many governmental groups
to stop this maliciousness against individuals, organizations, and nations.
One of the most famous for his computer crimes hacking was
Kevin Mitnick, who was tracked by computer, and caught in 1995. He served a
prison sentence of about five years. Others have likewise been caught. Another
case is that of Vasily Gorshkov from Russia, who was 26 years old when
convicted in 2001. He was found guilty of conspiracy and computer crime.
Other individuals have also been found guilty and sentenced
-and many others remain on trial. If you are one who pays much attention to the
news, then you know that every now and then, you will hear of another hacker
that has been caught, or a group of hackers that have been arrested because of
their criminal activities. The interesting thing is that it is often others who
had learned hacking techniques, and are now using them to catch other criminal
hackers.
Another criminal hacker, who called himself Tasmania, made big news when he
fled Spain on various charges of stealing into bank accounts online, and banks,
and went to Argentina. There he went into operation again. He was quickly
tracked to Argentina, and the governments of Spain and Argentina went after him
with surveillance, first. Before long, he was arrested, along with 15 other
men, and was then extradited back to Spain (in 2006) where he could face up to
40 years in prison.
The simple truth is, these criminal hackers/cyber attackers get smarter
everyday and they do everything possible to cover their tracks, making it
difficult to find or locate them. We can’t help but wonder if this computer
crime laws have any impact on the rate of computer crimes being committed day
after day. We wonder if the existing laws in place
are adequate tocombat cyber
crime and consequently if amendmentsneed
to be put in place.
Today, criminal organizations are very active in the development and diffusion
of malware that can be used to execute complex fraud with minimal risks to the
perpetrators. Criminal gangs, traditionally active in areas such as human or
drug trafficking, have discovered that cyber-crime is a lucrative business with
much lower risks of being legally pursued or put in prison. Unethical
programmers are profitably servicing that growing market. Because today’s ICT
ecosystem was not built for security, it is easy for attackers to take over
third party computers, and extremely difficult to track attacks back to their
source. Attacks can be mounted from any country and hop through an arbitrary
number of compromised computers in different countries before the attack
reaches its target a few milliseconds later. This complicates attribution and
international prosecution.
SO, WHAT LAWS DO WE HAVE IN
PLACE TO COMBAT CYBER CRIMES?
1.THE COMPUTER
MISUSE ACT OF 1990: A law in the UK that makes illegal certain
activities, such as hacking
into other people’s systems, misusing software, or helping a person to gain
access to protected files of someone else's computer.
Sections 1-3 of the Act introduced
three criminal offences:
a) Unauthorised access to
computer material, punishable by 6 months' imprisonment or a fine "not exceeding
level 5 on the standard scale"
(currently £5000);
b) unauthorised access
with intent to commit or facilitate commission of further offences, punishable
by 6 months/maximum fine on summary conviction
or 5 years/fine on indictment;
c) unauthorised
modification of computer material, subject to the same sentences as section 2 offences.
2.COMPUTER FRAUD
AND ABUSE ACT: A law passed by
the United States Congress in 1986, intended to
reduce cracking of computer systems and to address
federal computer-related offenses. The Act (codified as 18 U.S.C.§ 1030) governs
cases with a compelling federal interest, where computers of the federal
government or certain financial institutions are involved, where the crime
itself is interstate in nature, or where computers are used in interstate and
foreign commerce.
It was amended in 1989, 1994, 1996, in 2001 by the USA
PATRIOT Act, 2002, and in 2008 by the Identity Theft Enforcement and
Restitution Act. Subsection (b) of the Act punishes anyone who not only commits
or attempts to commit an offense under the Act, but also those who conspire to
do so.
3.ELECTRONIC
COMMUNICATIONS PRIVACY ACT:Passed in 1986, Electronic Communications Privacy Act (ECPA) was anamendment
to the federal wiretap law, the Act made it illegal to intercept storedor
transmitted electronic communication without authorization.11 ECPA set outthe
provisions for access, use, disclosure, interception and privacy protections ofelectronic communications. Which is defined as “any transfer of signs,
signals,writing, images, sounds, data, or intelligence of any nature
transmitted in wholeor in part by a wire, radio, electromagnetic, photo
electronic or photo opticalsystem that affects interstate or foreign
commerce." The Act prohibits illegalaccess and certain disclosures
of communication contents. In addition, ECPAprevents government
entities from requiring disclosure of electroniccommunications by a
provider such as an ISP without first going through aproper legal
procedure.
4.CYBER SECURITY ENHANCEMENT ACT: Cyber Security Enhancement Act (CSEA) was
passed together with theHomeland Security Act in 2002, it granted
sweeping powers to the lawenforcement organizations and increased
penalties that were set out in theComputer Fraud and Abuse Act.
The Act also authorizes harsher sentences for individuals who knowingly
or recklessly commit a computer crime that results in death or serious bodily
injury.
The sentences can range from 20 years to life. In addition CSEA
increases penalties for first time interceptors of cellular phone traffic, thus
removing a safety measure enjoyed by radio enthusiasts.
5.Other Laws Used to Prosecute Computer Crimes
In addition to laws specifically tailored to deal with computer crimes,
traditional laws can also be used to prosecute crimes involving computers. For
example, the Economic Espionage Act (EEA) was passed in 1996 and was created in
order to put a stop to trade secret misappropriation. 15 EEA makes it a crime
to knowingly commit an offense that benefits a foreign government or a foreign agent.
The Act also contains provisions that make it a crime to knowingly steal trade
secrets or attempt to do so with the intent of benefiting someone other than the
owner of the trade secrets. EEA defines stealing of trade secrets as copying, duplicating,
sketching, drawing, photographing, downloading, uploading, altering, destroying,
photocopying, replicating, transmitting, delivering, sending, mailing, communicating,
or conveying trade secrets without authorization. The Act, while not
specifically.
While we can’t measure all the computer crime laws here, different
countries have different laws laid down to fight cybercrime and to prosecute
the guilty ones.
BUT
EVEN WITH THE PRESENCE OF THESE LAWS:
We’ve discovered that internationally,
both Governmental and non-state actors engage in cybercrimes, including espionage, financial
theft, and other cross-border crimes. Activity crossing international
borders and involving the interests of at least one nation-state is sometimes
referred to as cyber warfare. The international legal system is attempting to
hold actors accountable for their actions through the International Criminal
Court.
And this
leads us to discussing invasive monitoring by governments. Wikileaks claims
that mass interception of entire populations is not only a reality; it is a
secret new industry spanning 25 countries. Wikileaks has published 287 files
that describe commercial malware products from 160 companies
(http://wikileaks.org/the-spyfiles.html). These files include confidential
brochures and slide presentations these companies use to market intrusive
surveillance tools to governments and law enforcement agencies. This industry
is, in practice, unregulated. Intelligence agencies, military forces and police
authorities are able to silently, and en masse, secretly intercept calls and
take over computers without the help or knowledge of the telecommunication
providers. Users’ physical location can be tracked if they are carrying a
mobile phone, even if it is only on standby (think RFID).
To get a
glimpse of the potential market size, the U.S government is required by law to
reveal the total amount of money spent spying on other nations, terrorists and
other groups. In 2010, the United States spent $80 billion on spying
activities. According to the Office of the Director of National Intelligence,
$53.1 billion of that was spent on non-military intelligence programmes.
Approximately 100,000 people work on national intelligence. These figures do
not include DARPA’s “Plan
X” which seeks to identify and track the vulnerabilities in tens of
billions of computers connected to the Internet, so they can be exploited.
It is
increasingly common for governments to use monitoring tools, viruses and Trojans
to infect computers and attack civilians, dissidents, opponents and political
oppositions. The purpose is to track the victim’s operation on the web, gather
information about their activities and the identity of collaborators. In some
cases, this can lead to those targeted being neutralized and even ruthlessly
suppressed.
According to
F-Secure “News from the Lab” blog, during the Syrian repression the
government discovered that dissidents were using programmes like SkypeTM to
communicate. After the arrest of a few dissidents, the government used their
Skype accounts to spread a malware programme called “Xtreme RAT” hidden in a
file called “MACAddressChanger.exe” to others activists who downloaded and
executed the malware. The dissidents trusted the MACAddressChanger programme
because other files with that name had been successfully used in the past to
elude the monitoring system of the government. The Xtreme Rat malware falls
into the “Remote Access Tool” category. The full version can easily be bought
online for €100. The IP address of the command and control server used in those
attacks belonged to the Syrian Arab Republic — STE (Syrian Telecommunications
Establishment).
In the Trend
Micro “Malware Blog”, experts at Trend Micro found that the Syrian government
was also using the DarkComet malware to infect computers of the opposition
movement. The malware steals documents from victims. It seems that it was also
spread through Skype chat. Once executed, the malware tries to contact the
command and control (C&C) server to transfer the stolen information and
receive further instructions. It has been observed, in this example that the
C&C server is located in Syria and the range of IP addresses are under the
control of the Government of Syria.
What the above partially
illustrates is the very real conflict of interest in organizations and
governments responsible for securing our digital world.
African countries have been
criticized for dealing inadequately with cybercrime as their law enforcement agencies
are inadequately equipped in terms of personnel, intelligence and infrastructure,
and the private sector is also lagging behind in curbing cybercrime. African
countries are pre-occupied with attending to pressing issues such as poverty,
the AIDS crisis, the fuel crisis, political instability, ethnic instability and
traditional crimes such as murder, rape and theft, with the result that the
fight against cybercrime is lagging behind. It is submitted that international
mutual legal and technical assistance should be rendered to African countries
by corporate and individual entities to effectively combat cybercrime in
Africa.
CONCLUSION:
While there is no silver bullet for dealing
with cyber crime, it doesn’t mean that we are completely helpless against it.
The legal system is becoming more tech savvy and many law enforcement departments
now have cyber crime units created specifically to deal with computer related
crimes, and of course we now have laws that are specifically designed for
computer related crime. While the existing laws are not perfect, and no law is,
they are nonetheless a step in the right direction toward making the Internet a
safer place for business, research and just casual use. As our reliance on
computers and the Internet continues to grow, the importance of the laws that
protect us from the cyber-criminals will continue to grow as well.
Efforts at combating cyber-crimes will all
continue to produce futile results as long as governments and the OPS (organized
public sector) are insincere in their drive towards protecting the sanity of
the internet.
Whatever efforts we make, we shouldn't
ignore the fact that an enlightened citizenry is the key to safety of the
internet but then, the battle of sovereign supremacy will continue to undermine
our collective safety online.
It behooves every one of us on the globe to
look inward and think ahead that our collective safety is greater than the
greed and ferocity of hegemonist both in the private sector and supremacist in
government.
References:
“2003 CSI/FBI Computer Crime and Security Survey”. http://www.usdoj.gov/criminal/cybercrime/CSI_FBI.htm
BackTrack is a well-known specialized Linux distribution focusing
on security tools for penetration testers and security professionals,
but it now offers a lot in terms of forensics…
Pros: BackTrack 5 has all the tools you need for testing network security and its nicely presented.
Cons: Documentation is scarce and often outdated & upgrading from previous release isn’t supported Backtrack homepage
The advantage of BackTrack 5 (BT5) is that it offers a slew of
security and forensic tools on a live DVD, ready to use. It’s based on
Ubuntu Lucid (10.04 LTS) with Linux kernel 2.6.38 and some patched WiFi
drivers to allow injection attacks. You can download the distribution in
a GNOME or a KDE version, for 32-bit or 64-bit x86 machines. It’s a
live DVD ISO file, which you can burn to a DVD or write to a USB stick.
On the desktop of the live session, there’s an installer icon if you
want to install BackTrack permanently. For the first time, the project
also has an image for ARM, which you can run on your smartphone or
tablet to test the security of a wireless network.
BackTrack 5 allows you to boot into a stealth or a forensics mode
BackTrack’s boot menu gives you various options. The
default option just starts a live session (a stylish framebuffer
console, in which you can start GNOME or KDE with startx), but there’s
also a stealth mode which boots the distribution without generating any
network traffic: you have to enable networking manually later. This is
interesting if you want to hide your presence on the network
temporarily. Another nice option is the forensics mode, which doesn’t
automatically mount the computer’s drives and also doesn’t use any swap
space it finds. When forensically investigating a system, this
guarantees that you don’t accidentally wipe out hidden traces.
BackTrack organizes all tools in various menus
BackTrack is filled with a collection of more than 300 open source
security tools, which you can find organized in different submenus of
the “Backtrack” menu: “Information Gathering”, “Vulnerability
Assessment”, “Exploitation Tools”, “Privilege Escalation”, “Maintaining
Access”, “Reverse Engineering”, “RFID Tools”, “Stress Testing”,
“Forensics”, “Reporting Tools”, “Services”, and “Miscellaneous”. Each
submenu is further subdivided into subcategories. The developers have
added a nice touch to menu items of commandline utilities: when you
click on such a menu item, it opens a terminal window with the tool
showing its usage, e.g. with the –help option.
Sniff a network with Wireshark
BT5′s software collection is really a security professional’s dream.
It has all you need to pentest a network, such as the exploit framework
Metasploit, the network scanner Nmap, the network analyzer Wireshark,
the browser exploitation framework BeEF, the information gathering tool
Maltego, and so on. One disadvantage of BT5 is that you can’t upgrade to
it from BT4, which is a pity if you have installed and configured a BT4
installation in the past. Moreover, some interesting tools like Pyrit,
which uses your GPU’s processing power to accelerate WPA password
cracking, and the vulnerability scanner OpenVAS have been dropped in
BT5, although they can be installed manually.
Scan all hosts on a network with Zenmap
The bad thing about BackTrack is the documentation. It’s scarce,
fragmentary, and often outdated. Many tips and tutorials we found on the
BackTrack website and its wiki were for older versions and didn’t work
on BT5, and other documents didn’t spell out which version they were
talking about. However, there are also some extremely detailed and very
good documents on the website, and obviously documentation is a work in
progress, so depending on what you need your mileage may vary.
Find all information you can about a website with Maltego
BackTrack is also more about the tools than about the
distribution, so the lack of consistent documentation shouldn’t be such a
big problem. Moreover, BT5 is really Ubuntu 10.04 under the hood, so
most of the documentation about the latter applies. BackTrack is
sponsored by the company Offensive Security, and they offer a
“Penetration testing With BackTrack” course if you want to train your
penetration testing skills. Upon completion of this course, you are
ready to take a security challenge in an unfamiliar lab, and after
successful completion you receive the Offensive Security Certified
Professional (OSCP) certification.
Verdict: 4/5
If you run BackTrack 5 on your laptop, you have all you need to test the
security of a network. Of course you still have to know what you’re
doing, but at least you have all the relevant tools at your fingertips.
If you’re really serious about pentesting don’t leave home without it.
How secure is
Windows Remote Desktop?
Remote Desktop sessions operate over an encrypted channel, preventing anyone
from viewing your session by listening on the network. However, there is a
vulnerability in the method used to encrypt sessions in earlier versions of
RDP. This vulnerability can allow unauthorized access to your session using a man-in-the-middle
attack. Remote Desktop can be secured using SSL/TLS in Windows Vista,
Windows 7, and Windows Server 2003/2008.
While Remote Desktop is more secure than remote administration tools such as
VNC that do not encrypt the entire session, any time Administrator access to a
system is granted remotely there are risks. The following tips will help to
secure Remote Desktop access to both desktops and server that you support.
Basic Security Tips
for Remote Desktop
Use strong
passwords
Use a strong password on any accounts with access to Remote Desktop. This
should be considered a required step before enabling Remote Desktop.
Update your
software
On advantage of using Remote Desktop rather than 3rd party remote admin
tools is that components are automatically updated to the latest security fixes
in the standard Microsoft patch cycle. Make sure you are running the latest
versions of both the client and server software by enabling and auditing
automatic Microsoft Updates. If you are using Remote Desktop clients on other
platforms, make sure they are still supported and that you have the latest
versions. Older versions may not support high encryption and may have other security flaws.
Restrict access
using firewalls
Use firewalls (both software and hardware where available) to restrict
access to remote desktop listening ports (default is TCP 3389). Using an RDP
Gateway is highly recommended for restricting RDP access to desktops and
servers (see discussion below). As an alternative to off-campus connectivity, you
can use a VPN software to get a private IP address,
and add the VPN network address pool to your RDP firewall exception rule.
Enable Network
Level Authentication
Windows Vista, Windows 7, and Windows Server 2008 also provide Network Level
Authentication (NLA) by default. It is best to leave this in place, as NLA
provides an extra level of authentication before a connection is established.
You should only configure Remote Desktop servers to allow connections without
NLA if you use Remote Desktop clients on other platforms that don't support it.
To enable NLA for Windows XP SP3 clients, see http://support.microsoft.com/kb/951608.
Limit users who can
log in using Remote Desktop
By default, all Administrators can log in to Remote Desktop. If you have
multiple Administrator accounts on your computer, you should limit remote
access only to those accounts that need it. If Remote Desktop is not used for
system administration, remove all administrative access via RDP and only allow
user accounts requiring RDP service. For Departments that manage many machines
remotely, remove the local Administrator account from RDP access at and add a
technical group instead.
Under Local Policies-->User Rights Assignment, go to
"Allow logon through Terminal Services." Or “Allow logon through
Remote Desktop Services”
Remove the Administrators group and leave the Remote
Desktop Users group.
Use the System control panel to add users to the Remote
Desktop Users group.
A typical MS operating system will have the following setting by default as
seen in the Local Security Policy:
The problem is that “Administrators” is here by default, and your “Local
Admin” account is in administrators. Although a password convention to
avoid identical local admin passwords on the local machine and tightly
controlling access to these passwords or conventions is recommended, using a
local admin account to work on a machine remotely does not properly log and
identify the user using the system. It is best to override the local security
policy with a Group Policy Setting.
To control access to the systems even more, using “Restricted Groups” via
Group Policy is also helpful.
If you use a “Restricted Group” setting to place your group e.g. “TECH-GURUS”
into “Administrators” and “Remote Desktop Users”, your techies will still have
administrative access remotely, but using the steps above, you have removed the
problematic “local administrator account” having RDP access. Going forward,
whenever new machines are added in the OU under the GPO, your settings will be
correct.
By
setting your computer to lock an account for a period of time after a number of
incorrect guesses, you will help prevent hackers from using automated password
guessing tools from gaining access to your system (this is known as a
"brute-force" attack). To set an account lockout policy:
Go to Start-->Programs-->Administrative
Tools-->Local Security Policy
Under Account Policies-->Account Lockout Policies,
set values for all three options. 3 invalid attempts with 3 minute lockout
durations are reasonable choices.
Best Practices for Additional
Security
Change the listening port for
Remote Desktop
Changing
the listening port will help to "hide" Remote Desktop from hackers
who are scanning the network for computers listening on the default Remote
Desktop port (TCP 3389). This offers effective
protection against the latest RDP worms such, as Morto. To do this, edit the following
registry key (WARNING: do not try this unless you are familiar with the Windows
Registry and TCP/IP): HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal
Server\WinStations\RDP-Tcp.
Change the listening port from 3389 to something else and remember to update
any firewall rules with the new port. Although this approach is helpful, it is
security by obscurity which is not the most reliable security approach. You
should ensure that you are also using other methods to tighten down access as
described in this article.
Use RDP Gateways
Using a RDP Gateway is strongly recommended. It provides a way to tightly
restrict access to Remote Desktop ports while supporting remote connections
through a single "Gateway" server. When using an RD Gateway server,
all Remote Desktop services on your desktop and workstations should be
restricted to only allow access only from the RD Gateway. The RD Gateway server
listens for Remote Desktop requests over HTTPS (port 443), and connects the
client to the Remote Desktop service on the target machine.
There are many online documents for configuring this embedded Windows 2008
component. The official documentation is here: http://technet.microsoft.com/en-us/library/dd983949(WS.10).aspx
Installing and configuring the role service is mostly as described; however,
using a Calnet issued trusted Comodo
certificate is recommended. Using a self-signed cert is ok for testing, and
using a CalnetPKI cert can work if all clients have
trusted the UCB root. The Comodo cert is usually
better accepted so that your end users do not receive certificate warnings.
Configuring your client to use your RD Gateway is simple. The official
documentation for the MS Client is here: http://technet.microsoft.com/en-us/library/cc770601.aspx
In essence, a simple change on the advance tab of your RDP client is all
that is necessary:
Tunnel Remote
Desktop connections through IPSec or SSH
If using an RD Gateway is not feasible, you can add an extra layer of
authentication and encryption by tunneling your Remote Desktop sessions through
IPSec or SSH. IPSec is
built-in to all Windows operating systems since Windows 2000, but its use and
management is greatly improved in Windows Vista/7/2008 (see: http://technet.microsoft.com/en-us/network/bb531150).
If an SSH server is available, you can use SSH tunneling for Remote Desktop
connections. See https://kb.berkeley.edu/kb1266
for more information on IPSec and SSH tunneling.
Use existing
management tools for RDP logging and configuration
Using other components like VNC or PCAnywhere are not recommended because
they may not log in a fashion that is auditable or protected. With RDP, logins
are audited to the local security log, and often to the domain controller
auditing system. When monitoring local security logs, look
for anomalies in RDP sessions such as login attempts from the local
Administrator account. RDP also has the benefit of a central management
approach via GPO as described above. Whenever possible, use GPOs or other
Windows configuration management tools to ensure a consistent and secure RDP
configuration across all your servers and desktops.
By enforcing the use of a RDP gateway, you also get a third level of
auditing that is easier to read than combing through the domain controller
logins, and is separate from the target machine so is not subject to tampering.
This type of log can make it much easier to monitor how and when RDP is being
used across all the machines in your environment.
Use Two-factor
authentication on highly sensitive systems
Departments & Organizations with sensitive data should also consider
using a two-factor authentication approach. That is beyond the scope of this
article, but RD Gateways do provide a simple mechanism for controlling
authentication via two factor certificate based smartcards. Other two factor
approaches need another approach at the Remote Desktop host itself e.g. YubiKey, RSA.
Additional security
with Network Access Protection (NAP)
Highly motivated admins can also investigate the use Network Access
Protection (NAP) with an RD Gateway, however, that technology and standard is
not well developed or reliable yet. Many clients will not work if you enforce
it, although by following the documentation, you can audit the system to see if
it *thinks* the clients are security compliant.
The most successful people in
business approach their work differently than most. See how they think--and why
it works.
I'm fortunate enough to know a
number of remarkably successful people. Regardless of industry or profession,
they all share the same perspectives and beliefs.
And they act on those beliefs:
1. Time doesn't fill me. I fill
time.
Deadlines and time frames establish
parameters, but typically not in a good way. The average person who is given
two weeks to complete a task will instinctively adjust his effort so it actually
takes two weeks.
Forget deadlines, at least as a way
to manage your activity. Tasks should only take as long as they need to take.
Do everything as quickly and effectively as you can. Then use your
"free" time to get other things done just as quickly and effectively.
Average people allow time to impose
its will on them; remarkable people impose their will on their time.
2. The people around me are the
people I chose.
Some of your employees drive you
nuts. Some of your customers are obnoxious. Some of your friends are selfish,
all-about-me jerks.
You chose them. If the people around
you make you unhappy it's not their fault. It's your fault. They're in your
professional or personal life because you drew them to you--and you let them
remain.
Think about the type of people you
want to work with. Think about the types of customers you would enjoy serving.
Think about the friends you want to have.
Then change what you do so you can
start attracting those people. Hardworking people want to work with hardworking
people. Kind people like to associate with kind people. Remarkable employees want
to work for remarkable bosses.
Successful people are naturally
drawn to successful people.
3. I have never paid my dues.
Dues aren't paid, past tense. Dues
get paid, each and every day. The only real measure of your value is the
tangible contribution you make on a daily basis.
No matter what you've done or
accomplished in the past, you're never too good to roll up your sleeves, get
dirty, and do the grunt work. No job is ever too menial, no task ever too
unskilled or boring.
Remarkably successful people never
feel entitled--except to the fruits of their labor.
4. Experience is irrelevant.
Accomplishments are everything.
You have "10 years in the Web
design business." Whoopee. I don't care how long you've been doing what
you do. Years of service indicate nothing; you could be the worst 10-year
programmer in the world.
I care about what you've done:
how many sites you've created, how many back-end systems you've installed, how
many customer-specific applications you've developed (and what kind)... all
that matters is what you've done.
5. Failure is something I
accomplish; it doesn't just happen to me.
Ask people why they have been
successful. Their answers will be filled with personal pronouns: I, me, and the
sometimes too occasional we.
Ask them why they failed. Most will
revert to childhood and instinctively distance themselves, like the kid who
says, "My toy got broken..." instead of, "I broke my toy."
They'll say the economy tanked.
They'll say the market wasn't ready. They'll say their suppliers couldn't keep
up.
They'll say it was someone or
something else.
And by distancing themselves, they
don't learn from their failures.
Occasionally something completely
outside your control will cause you to fail. Most of the time, though, it's
you. And that's okay. Every successful person has failed. Numerous times. Most
of them have failed a lot more often than you. That's why they're successful
now.
Embrace every failure: Own it, learn
from it, and take full responsibility for making sure that next time, things
will turn out differently.
6. Volunteers always win.
Whenever you raise your hand you
wind up being asked to do more.
That's great. Doing more is an
opportunity: to learn, to impress, to gain skills, to build new
relationships--to do something more than you would otherwise been able to do.
Success is based on action. The more you volunteer, the
more you get to act. Successful people step forward to create opportunities.
Remarkably successful people sprint
forward.
7. As long as I'm paid well, it's
all good.
Specialization is good. Focus is
good. Finding a niche is good.
Generating revenue is great.
Anything a customer will pay you a
reasonable price to do--as long as it isn't unethical, immoral, or illegal--is
something you should do. Your customers want you to deliver outside your normal
territory? If they'll pay you for it, fine. They want you to add services you
don't normally include? If they'll pay you for it, fine. The customer wants you
to perform some relatively manual labor and you're a high-tech shop? Shut up,
roll 'em up, do the work, and get paid.
Only do what you want to do
and you might build an okay business. Be willing to do what customers want you
to do and you can build a successful business.
Be willing to do even more and you
can build a remarkable business.
And speaking of customers...
8. People who pay me always have the
right to tell me what to do.
Get over your cocky, pretentious,
I-must-be-free-to-express-my-individuality self. Be that way on your own time.
The people who pay you, whether
customers or employers, earn the right to dictate what you do and how you do
it--sometimes down to the last detail.
Instead of complaining, work to
align what you like to do with what the people who pay you want you to do.
Then you turn issues like control
and micro-management into non-issues.
9. The extra mile is a vast,
unpopulated wasteland.
Everyone says they go the extra
mile. Almost no one actually does. Most people who go there think,
"Wait... no one else is here... why am I doing this?" and leave,
never to return.
That's why the extra mile is such a
lonely place.
That's also why the extra mile is a
place filled with opportunities.
Be early. Stay late. Make the extra
phone call. Send the extra email. Do the extra research. Help a customer unload
or unpack a shipment. Don't wait to be asked; offer. Don't just tell employees
what to do--show them what to do and work beside them.
Every time you do something, think
of one extra thing you can do--especially if other people aren't doing that one
thing. Sure, it's hard.
But that's what will make you
different.
And over time, that's what will make
you incredibly successful.
Article courtestv of:
Jeff Haden
learned much of what he knows about business and technology as he
worked his way up in the manufacturing industry. Everything else he
picks up from ghostwriting books for some of the smartest leaders he knows in business. @jeff_haden
A comprehensive article that touches on cyber-crime laws, the limits to overcoming cyber-crime and the opportunity in the collective security of the human race.
SO, WHAT LAWS DO WE HAVE IN PLACE TO COMBAT CYBER CRIMES?1. THE COMPUTER MISUSE ACT OF 1990: A law in the UK that makes illegal certain activities, such as hacking into other people’s systems, misusing software, or helping a person to gain access to protected files of someone else's computer.Sections 1-3 of the Act introduced three criminal offences:a) Unauthorised access to computer material, punishable by 6 months' imprisonment or a fine "not exceeding level 5 on the standard scale" (currently £5000);b) unauthorised access with intent to commit or facilitate commission of further offences, punishable by 6 months/maximum fine on summary conviction or 5 years/fine on indictment;c) unauthorised modification of computer material, subject to the same sentences as section 2 offences.2. COMPUTER FRAUD AND ABUSE ACT: A law passed by the United States Congress in 1986, intended to reduce cracking of computer systems and to address federal computer-related offenses. The Act (codified as 18 U.S.C. § 1030) governs cases with a compelling federal interest, where computers of the federal government or certain financial institutions are involved, where the crime itself is interstate in nature, or where computers are used in interstate and foreign commerce.It was amended in 1989, 1994, 1996, in 2001 by the USA PATRIOT Act, 2002, and in 2008 by the Identity Theft Enforcement and Restitution Act. Subsection (b) of the Act punishes anyone who not only commits or attempts to commit an offense under the Act, but also those who conspire to do so.3. ELECTRONIC COMMUNICATIONS PRIVACY ACT: Passed in 1986, Electronic Communications Privacy Act (ECPA) was an amendment to the federal wiretap law, the Act made it illegal to intercept stored or transmitted electronic communication without authorization.11 ECPA set out the provisions for access, use, disclosure, interception and privacy protections of electronic communications. Which is defined as “any transfer of signs, signals, writing, images, sounds, data, or intelligence of any nature transmitted in whole or in part by a wire, radio, electromagnetic, photo electronic or photo optical system that affects interstate or foreign commerce." The Act prohibits illegal access and certain disclosures of communication contents. In addition, ECPA prevents government entities from requiring disclosure of electronic communications by a provider such as an ISP without first going through a proper legal procedure.4. CYBER SECURITY ENHANCEMENT ACT: Cyber Security Enhancement Act (CSEA) was passed together with the Homeland Security Act in 2002, it granted sweeping powers to the law enforcement organizations and increased penalties that were set out in the Computer Fraud and Abuse Act.The Act also authorizes harsher sentences for individuals who knowingly or recklessly commit a computer crime that results in death or serious bodily injury.The sentences can range from 20 years to life. In addition CSEA increases penalties for first time interceptors of cellular phone traffic, thus removing a safety measure enjoyed by radio enthusiasts.5. Other Laws Used to Prosecute Computer CrimesIn addition to laws specifically tailored to deal with computer crimes, traditional laws can also be used to prosecute crimes involving computers. For example, the Economic Espionage Act (EEA) was passed in 1996 and was created in order to put a stop to trade secret misappropriation. 15 EEA makes it a crime to knowingly commit an offense that benefits a foreign government or a foreign agent. The Act also contains provisions that make it a crime to knowingly steal trade secrets or attempt to do so with the intent of benefiting someone other than the owner of the trade secrets. EEA defines stealing of trade secrets as copying, duplicating, sketching, drawing, photographing, downloading, uploading, altering, destroying, photocopying, replicating, transmitting, delivering, sending, mailing, communicating, or conveying trade secrets without authorization. The Act, while not specifically.While we can’t measure all the computer crime laws here, different countries have different laws laid down to fight cybercrime and to prosecute the guilty ones.BUT EVEN WITH THE PRESENCE OF THESE LAWS:We’ve discovered that internationally, both Governmental and non-state actors engage in cybercrimes, including espionage, financial theft, and other cross-border crimes. Activity crossing international borders and involving the interests of at least one nation-state is sometimes referred to as cyber warfare. The international legal system is attempting to hold actors accountable for their actions through the International Criminal Court.And this leads us to discussing invasive monitoring by governments. Wikileaks claims that mass interception of entire populations is not only a reality; it is a secret new industry spanning 25 countries. Wikileaks has published 287 files that describe commercial malware products from 160 companies (http://wikileaks.org/the-spyfiles.html). These files include confidential brochures and slide presentations these companies use to market intrusive surveillance tools to governments and law enforcement agencies. This industry is, in practice, unregulated. Intelligence agencies, military forces and police authorities are able to silently, and en masse, secretly intercept calls and take over computers without the help or knowledge of the telecommunication providers. Users’ physical location can be tracked if they are carrying a mobile phone, even if it is only on standby (think RFID).To get a glimpse of the potential market size, the U.S government is required by law to reveal the total amount of money spent spying on other nations, terrorists and other groups. In 2010, the United States spent $80 billion on spying activities. According to the Office of the Director of National Intelligence, $53.1 billion of that was spent on non-military intelligence programmes. Approximately 100,000 people work on national intelligence. These figures do not include DARPA’s “Plan X” which seeks to identify and track the vulnerabilities in tens of billions of computers connected to the Internet, so they can be exploited.It is increasingly common for governments to use monitoring tools, viruses and Trojans to infect computers and attack civilians, dissidents, opponents and political oppositions. The purpose is to track the victim’s operation on the web, gather information about their activities and the identity of collaborators. In some cases, this can lead to those targeted being neutralized and even ruthlessly suppressed.According to F-Secure “News from the Lab” blog, during the Syrian repression the government discovered that dissidents were using programmes like SkypeTM to communicate. After the arrest of a few dissidents, the government used their Skype accounts to spread a malware programme called “Xtreme RAT” hidden in a file called “MACAddressChanger.exe” to others activists who downloaded and executed the malware. The dissidents trusted the MACAddressChanger programme because other files with that name had been successfully used in the past to elude the monitoring system of the government. The Xtreme Rat malware falls into the “Remote Access Tool” category. The full version can easily be bought online for €100. The IP address of the command and control server used in those attacks belonged to the Syrian Arab Republic — STE (Syrian Telecommunications Establishment).In the Trend Micro “Malware Blog”, experts at Trend Micro found that the Syrian government was also using the DarkComet malware to infect computers of the opposition movement. The malware steals documents from victims. It seems that it was also spread through Skype chat. Once executed, the malware tries to contact the command and control (C&C) server to transfer the stolen information and receive further instructions. It has been observed, in this example that the C&C server is located in Syria and the range of IP addresses are under the control of the Government of Syria.What the above partially illustrates is the very real conflict of interest in organizations and governments responsible for securing our digital world.African countries have been criticized for dealing inadequately with cybercrime as their law enforcement agencies are inadequately equipped in terms of personnel, intelligence and infrastructure, and the private sector is also lagging behind in curbing cybercrime. African countries are pre-occupied with attending to pressing issues such as poverty, the AIDS crisis, the fuel crisis, political instability, ethnic instability and traditional crimes such as murder, rape and theft, with the result that the fight against cybercrime is lagging behind. It is submitted that international mutual legal and technical assistance should be rendered to African countries by corporate and individual entities to effectively combat cybercrime in Africa.CONCLUSION:While there is no silver bullet for dealing with cyber crime, it doesn’t mean that we are completely helpless against it. The legal system is becoming more tech savvy and many law enforcement departments now have cyber crime units created specifically to deal with computer related crimes, and of course we now have laws that are specifically designed for computer related crime. While the existing laws are not perfect, and no law is, they are nonetheless a step in the right direction toward making the Internet a safer place for business, research and just casual use. As our reliance on computers and the Internet continues to grow, the importance of the laws that protect us from the cyber-criminals will continue to grow as well.Efforts at combating cyber-crimes will all continue to produce futile results as long as governments and the OPS (organized public sector) are insincere in their drive towards protecting the sanity of the internet.Whatever efforts we make, we shouldn't ignore the fact that an enlightened citizenry is the key to safety of the internet but then, the battle of sovereign supremacy will continue to undermine our collective safety online.It behooves every one of us on the globe to look inward and think ahead that our collective safety is greater than the greed and ferocity of hegemonist both in the private sector and supremacist in government.References:
I'm fortunate enough to know a number of remarkably successful people. Regardless of industry or profession, they all share the same perspectives and beliefs.And they act on those beliefs:1. Time doesn't fill me. I fill time.Deadlines and time frames establish parameters, but typically not in a good way. The average person who is given two weeks to complete a task will instinctively adjust his effort so it actually takes two weeks.Forget deadlines, at least as a way to manage your activity. Tasks should only take as long as they need to take. Do everything as quickly and effectively as you can. Then use your "free" time to get other things done just as quickly and effectively.Average people allow time to impose its will on them; remarkable people impose their will on their time.2. The people around me are the people I chose.Some of your employees drive you nuts. Some of your customers are obnoxious. Some of your friends are selfish, all-about-me jerks.You chose them. If the people around you make you unhappy it's not their fault. It's your fault. They're in your professional or personal life because you drew them to you--and you let them remain.Think about the type of people you want to work with. Think about the types of customers you would enjoy serving. Think about the friends you want to have.Then change what you do so you can start attracting those people. Hardworking people want to work with hardworking people. Kind people like to associate with kind people. Remarkable employees want to work for remarkable bosses.Successful people are naturally drawn to successful people.3. I have never paid my dues.Dues aren't paid, past tense. Dues get paid, each and every day. The only real measure of your value is the tangible contribution you make on a daily basis.No matter what you've done or accomplished in the past, you're never too good to roll up your sleeves, get dirty, and do the grunt work. No job is ever too menial, no task ever too unskilled or boring.Remarkably successful people never feel entitled--except to the fruits of their labor.4. Experience is irrelevant. Accomplishments are everything.You have "10 years in the Web design business." Whoopee. I don't care how long you've been doing what you do. Years of service indicate nothing; you could be the worst 10-year programmer in the world.I care about what you've done: how many sites you've created, how many back-end systems you've installed, how many customer-specific applications you've developed (and what kind)... all that matters is what you've done.Successful people don't need to describe themselves using hyperbolic adjectives like passionate, innovative, driven, etc. They can just describe, hopefully in a humble way, what they've done.5. Failure is something I accomplish; it doesn't just happen to me.Ask people why they have been successful. Their answers will be filled with personal pronouns: I, me, and the sometimes too occasional we.Ask them why they failed. Most will revert to childhood and instinctively distance themselves, like the kid who says, "My toy got broken..." instead of, "I broke my toy."They'll say the economy tanked. They'll say the market wasn't ready. They'll say their suppliers couldn't keep up.They'll say it was someone or something else.And by distancing themselves, they don't learn from their failures.Occasionally something completely outside your control will cause you to fail. Most of the time, though, it's you. And that's okay. Every successful person has failed. Numerous times. Most of them have failed a lot more often than you. That's why they're successful now.Embrace every failure: Own it, learn from it, and take full responsibility for making sure that next time, things will turn out differently.6. Volunteers always win.Whenever you raise your hand you wind up being asked to do more.That's great. Doing more is an opportunity: to learn, to impress, to gain skills, to build new relationships--to do something more than you would otherwise been able to do.Success is based on action. The more you volunteer, the more you get to act. Successful people step forward to create opportunities.Remarkably successful people sprint forward.7. As long as I'm paid well, it's all good.Specialization is good. Focus is good. Finding a niche is good.Generating revenue is great.Anything a customer will pay you a reasonable price to do--as long as it isn't unethical, immoral, or illegal--is something you should do. Your customers want you to deliver outside your normal territory? If they'll pay you for it, fine. They want you to add services you don't normally include? If they'll pay you for it, fine. The customer wants you to perform some relatively manual labor and you're a high-tech shop? Shut up, roll 'em up, do the work, and get paid.Only do what you want to do and you might build an okay business. Be willing to do what customers want you to do and you can build a successful business.Be willing to do even more and you can build a remarkable business.And speaking of customers...8. People who pay me always have the right to tell me what to do.Get over your cocky, pretentious, I-must-be-free-to-express-my-individuality self. Be that way on your own time.The people who pay you, whether customers or employers, earn the right to dictate what you do and how you do it--sometimes down to the last detail.Instead of complaining, work to align what you like to do with what the people who pay you want you to do.Then you turn issues like control and micro-management into non-issues.9. The extra mile is a vast, unpopulated wasteland.Everyone says they go the extra mile. Almost no one actually does. Most people who go there think, "Wait... no one else is here... why am I doing this?" and leave, never to return.That's why the extra mile is such a lonely place.That's also why the extra mile is a place filled with opportunities.Be early. Stay late. Make the extra phone call. Send the extra email. Do the extra research. Help a customer unload or unpack a shipment. Don't wait to be asked; offer. Don't just tell employees what to do--show them what to do and work beside them.Every time you do something, think of one extra thing you can do--especially if other people aren't doing that one thing. Sure, it's hard.But that's what will make you different.And over time, that's what will make you incredibly successful.
Jeff Haden
learned much of what he knows about business and technology as he
worked his way up in the manufacturing industry. Everything else he
picks up from ghostwriting books for some of the smartest leaders he knows in business. @jeff_haden
