Showing posts with label Daily IT News. Show all posts
Showing posts with label Daily IT News. Show all posts

Friday, September 14, 2012

The future of IT will be reduced to three kinds of jobs



There’s a general anxiety that has settled over much of the IT profession in recent years. It’s a stark contrast to the situation just over a decade ago. At the end of the 1990s, IT pros were the belles of the ball. The IT labor shortage regularly made headlines and IT pros were able to command excellent salaries by getting training and certification, job hopping, and, in many cases, being the only qualified candidate for a key position in a thinly-stretched job market. At the time, IT was held up as one of the professions of the future, where more and more of the best jobs would be migrating as computer-automated processes replaced manual ones.
Unfortunately, that idea of the future has disappeared, or at least morphed into something much different.
The glory days when IT pros could name their ticket evaporated when the Y2K crisis passed and then the dot com implosion happened. Suddenly, companies didn’t need as many coders on staff. Suddenly, there were a lot fewer startups buying servers and hiring sysadmins to run them.
Around the same time, there was also a general backlash against IT in corporate America. Many companies had been throwing nearly-endless amounts of money at IT projects in the belief that tech was the answer to all problems. Because IT had driven major productivity improvements during the 1990s, a lot of companies over-invested in IT and tried to take it too far too fast. As a result, there were a lot of very large, very expensive IT projects that crashed and burned.
When the recession of 2001 hit, these massively overbuilt IT departments were huge targets for budget cuts and many of them got hit hard. As the recession dragged out in 2002 and 2003, IT pros mostly told each other that they needed to ride out the storm and that things would bounce back. But, a strange thing happened. IT budgets remained flat year after year. The rebound never happened.
Fast forward to 2011. Most IT departments are a shadow of their former selves. They’ve drastically reduced the number of tech support professionals, or outsourced the help desk entirely. They have a lot fewer administrators running around to manage the network and the servers, or they’ve outsourced much of the data center altogether. These were the jobs that were at the center of the IT pro boom in 1999. Today, they haven’t totally disappeared, but there certainly isn’t a shortage of available workers or a high demand for those skill sets.
That’s because the IT environment has changed dramatically. More and more of traditional software has moved to the web, or at least to internal servers and served through a web browser. Many technophobic Baby Boomers have left the workforce and been replaced by Millennials who not only don’t need as much tech support, but often want to choose their own equipment and view the IT department as an obstacle to productivity. In other words, today’s users don’t need as much help as they used to. Cynical IT pros will argue this until they are blue in the face, but it’s true. Most workers have now been using technology for a decade or more and have become more proficient than they were a decade ago. Plus, the software itself has gotten better. It’s still horribly imperfect, but it’s better.
So where does that leave today’s IT professionals? Where will the IT jobs of the future be?

1. Consultants

Let’s face it, all but the largest enterprises would prefer to not to have any IT professionals on staff, or at least as few as possible. It’s nothing personal against geeks, it’s just that IT pros are expensive and when IT departments get too big and centralized they tend to become experts at saying, “No.” They block more progress than they enable. As a result, we’re going to see most of traditional IT administration and support functions outsourced to third-party consultants. This includes a wide range from huge multi-national consultancies to the one person consultancy who serves as the rented IT department for local SMBs. I’m also lumping in companies like IBM, HP, Amazon AWS, and Rackspace, who will rent out both data center capacity and IT professionals to help deploy, manage, and troubleshoot solutions. Many of the IT administrators and support professionals who currently work directly for corporations will transition to working for big vendors or consultancies in the future as companies switch to purchasing IT services on an as-needed basis in order to lower costs, get a higher level of expertise, and get 24/7/365 coverage.

2. Project managers

Most of the IT workers that survive and remain as employees in traditional companies will be project managers. They will not be part of a centralized IT department, but will be spread out in the various business units and departments. They will be business analysts who will help the company leaders and managers make good technology decisions. They will gather business requirements and communicate with stakeholders about the technology solutions they need, and will also be proactive in looking for new technologies that can transform the business. These project managers will also serve as the company’s point of contact with technology vendors and consultants. If you look closely, you can already see a lot of current IT managers morphing in this direction.

3. Developers

By far, the area where the largest number of IT jobs is going to move is into developer, programmer, and coder jobs. While IT used to be about managing and deploying hardware and software, it’s going to increasingly be about web-based applications that will be expected to work smoothly, be self-evident, and require very little training or intervention from tech support. The other piece of the pie will be mobile applications — both native apps and mobile web apps. As I wrote in my article, We’re entering the decade of the developer, the current changes in IT are “shifting more of the power in the tech industry away from those who deploy and support apps to those who build them.” This trend is already underway and it’s only going to accelerate over the next decade.

Friday, May 4, 2012

The 10 worst Web application-logic flaws that hackers love to abuse

By , Network World

Hackers are always hunting to find business-logic flaws, especially on the Web, in order to exploit weaknesses in online ordering and other processes. NT OBJECTives, which validates Web application security, says these are the top 10 business-logic flaws they see all the time.

1. Authentication flags and privilege escalation

Since applications have their own access-control lists and privileges, if the implementation of the authorization is weak, it opens up vulnerabilities that can be exploited, such as accessing another's content or becoming a higher-level user with greater permissions. What's needed is identifying parameter names that have something to do with ACL/permission that could become a target, and the tester can use fuzzing tools to try and change bit patterns or permission flags, which may show the point at which exploitation, escalating privileges or bypassing authentication can be achieved by an attacker.
2. Critical parameter manipulation and access to unauthorized information/content
HTTP GET and POST requests are typically accompanied with several parameters when submitted to the application, typically in the form of name/value pairs, JSON, XML and so forth, but they can be tampered with and guessed by predicting. Tests for this look for easily guessable values and whether a parameter's value can be changed in order to gain unauthorized access.

3. Developer's cookie tampering and business process/logic bypass

Cookies are often used to maintain state over HTTP, but developers are not just using session cookies, but are building data internally using session-only variables. Application developers set new cookies on the browser at important junctures which exposes logic holes. The danger is that these cookies can be reverse engineered or have values that can be guessed or deciphered and attackers try to identify these holes that are easy to exploit. Tests here typically involve analysis of cookies delivered during profiling, and looking for easily guessable values, and whether a cookie value can be changed.

4. LDAP parameter identification and critical infrastructure access

LDAP is becoming an important aspect for large applications and may get integrated with "single sign-on" as well. Many infrastructure layer tools like SiteMinder and Load Balancer use LDAP for both authentication and authorization. LDAP parameters can carry business-logic decision flags that can be abused or leveraged. Attackers can find business-layer bypasses and logical injections if the application is not doing enough validation. Tests for this focus on finding parameters linked with LDAP, such as those taking email or usernames, which are prospective targets.

5. Business constraint exploitation

The application's business logic should have defined rules and constraints, but if poorly designed, attackers can crawl them and browse through hidden fields and understand their context. So it's necessary to test hidden parameters and values, checking business-specific calls that can become a target and manipulated.

6. Business flow bypass

Applications include flows that are controlled by redirects and page transfers. However, in many cases, this flow can be bypassed, which can lead to an error condition or information leakage, which can help an attacker identify critical backend information. It's necessary to test whether business functionality and parameters can be tampered with through a proxy.

7. Exploiting client-side business routines embedded in JavaScript, Flash or Silverlight

Many business applications now run on rich Internet application frameworks leveraging JavaScript, Flash and Silverlight, and in many cases the logic is embedded in the client-side component. These can be reverse engineered, and if it is Flash and Silverlight, both of these files can be decompiled and the actual logic used by the application can be discovered. JavaScript can be debugged line by line to identify embedded logic. This could include logic for cryptography algorithms, credential storage, privilege management and other security. This may lead to possible exploits. To check for these kind of weaknesses, it's necessary to analyze the Document Object Model (DOM), identify variables on a browser stack, and look for suspicious values and parameters that can be exploited in DOM.

8. Identity or profile extraction

A critical parameter in authenticated applications, the user's identity is maintained using session or other forms of tokens. Attackers can identify these token parameters in poorly designed and developed applications, opening up the potential for abuse and systemwide exploitation. The token may only be using a sequential number or guessable username. To test for this, it's necessary to look for parameters that are controlling profiles; if it's possible to decipher, guess or reverse engineer tokens, the game is all but finished.

9. File or unauthorized URL access and business information extraction

Business applications contain critical information in their features, in the files that are exported and in the export functionality. Users can export their data in a selected file format (PDF, XLS or CSV) and download it. If this functionality is carelessly implemented, it can enable asset leakage. To test for this, it's necessary to identify call functionalities based on parameter names like file, doc, and dir, which will point you to possible unauthorized file-access vulnerabilities, and then a good test is doing basic brute force or guesswork to fetch another user's files from a server.

10. Denial of service (DoS) with business logic

Denial-of-service vulnerabilities for business applications pose serious issues because if exploited, the application can be brought down for a length of time or at a critical juncture. Sometimes attackers can identify a loophole and try to exploit it during a DoS condition. There are no universal DoS attacks like TCP flooding on networking at the application layer, but in some cases, infinite loops implemented in the application layer can lead to a DoS condition. It's important to test applications against a threat model and provide defense at the application layer.
In its report on the "Top 10 Business Logic Attack Vectors," NT OBJECTives says identifying business-logic flaws in custom-designed Web applications is not just a matter of automated scan testing but also a manual review of the application security and logic with "human intelligence."
Ellen Messmer is senior editor at Network World, an IDG publication and website, where she covers news and technology trends related to information security.


Friday, October 14, 2011

Top 10 IT pro's to follow on Twitter



IT website, v3, has published a list of IT executives to follow on Twitter to help you keep up with the latest IT news.
So below, courtesy of v3, is the top 10;
Padmasree Warrior, Cisco chief technology officer@padmasree 
With over one million Twitter followers, the Cisco CTO is a shining example not only of how tech execs can embrace social networking, but of how women can break through the glass ceiling to take high-profile IT roles.
Matt Asay, open source advocate @mjasay
Matt Asay recently left his role as chief operating officer at Ubuntu developer Canonical to join mobile apps startup Strobe. We'd recommend following Asay for his insights on the latest tech and products without constantly pushing a corporate message.
Matt Cutts, head of the Webspam team at Google @mattcutts
The Googler uses his Twitter account to share the latest Google news and to offer tips and advice to his followers.
Chris Anderson, TED curator @TEDchris
Chris's Twitter feed is a mirror of what the Technology, Entertainment, Design (TED) non-profit organisation aims to achieve - spread ideas. Follow Chris for his views on the big news stories of the day, as well as snippets on the latest technology and other TED talks.
Michael Dell, Dell chairman and CEO @MichaelDell
Not many technology CEOs have their own Twitter account, and when they do, it's often filled with impersonal posts and plugs for the firm. Michael Dell's account is refreshingly personal, and he uses Twitter not only to update his followers on the latest at Dell, but to talk directly to customers and others in the industry.
Kevin Rose, founder of Digg @kevinrose
The founder of the community content site is very active on Twitter, on everything from his latest Milk venture to Macbook Airs and Spotify.
Evan Williams, Twitter co-founder @ev
The farmboy from Nebraska offers some useful tidbits of information, as well as his views on all things tech.
Mike Chambers, principal product managerof Adobe Flash @mesh
A useful source for Adobe updates, as well as hands-on tech advice.
Stefan Weitz, Microsoft search executive @stefanweitz 
Follow Stefan to keep up with the latest industry search news.
Chuck Hollis, EMC VP Global Marketing CTO @chuckhollis 
Chuck is a big fan of Twitter, judging by the very frequent updates, and offers an entertaining flow of information about tech along with some more random insights.
Story Source: http://www.v3.co.uk/v3-uk/news/2096208/technology-executives-follow-twitter

Apple release iOS 5 update


Over 200 new features boast company



Apple have released the final long awaited iOS 5 software after 7 beta versions since it's first appearance in March, 2011.
Available as a free update, iOS 5 boasts over 200 new features say Apple, including iMessage which allows users to chat and text free of charge.
The new software which powers the iPhone, iPad and iPod Touch, is deeply tied to Apple's iCloud service that moves photos, apps and settings between iOS devices and acts as a backup solution for users.
Downloadable from iTunes, iOS 5's new features in full are;
iOS 5 Software Update

This update contains over 200 new features, including the following:

Notifications
  • Swipe from the top of any screen to view notifications in one place with Notification Center
  • New notifications appear briefly at the top of the screen
  • View notifications from lock screen
  • Slide the notification app icon to the right on the lock screen to go directly to the app

iMessage
  • Send and receive unlimited text, photo, and video messages with other iOS 5 users
  • Track messages with delivery and read receipts
  • Group messaging and secure encryption
  • Works over cellular network and Wi-Fi*

Newsstand
  • Automatically organizes magazine and newspaper subscriptions on Home Screen
  • Displays the cover of the latest issue
  • Background downloads of new issues

Reminders for managing to do lists
  • Syncs with iCloud, iCal and Outlook
  • Location-based reminders when you leave or arrive at a location for iPhone 4S and iPhone 4

Built-in support for Twitter
  • Sign-in once in Settings and tweet directly from Camera, Photos, Maps, Safari and YouTube
  • Add location to any tweet
  • View twitter profile pictures and usernames in Contacts

Camera improvements for devices with cameras
  • Double click the home button when device is asleep to bring up a camera shortcut on iPhone 4S, iPhone 4, iPhone 3GS and iPod touch (4th generation)
  • Volume Up button to take a picture
  • Optional grid lines to line up shots
  • Pinch to zoom in the preview screen
  • Swipe to camera roll from preview screen
  • Tap and hold to lock focus and exposure, iPad 2 and iPod touch (4th generation) only support exposure lock

Photo improvements for devices with cameras
  • Crop and rotate
  • Red eye removal
  • One tap enhance
  • Organize photos into albums

Mail improvements
  • Format text using bold, italic, or underlined fonts
  • Indentation control
  • Drag to rearrange names in address fields
  • Flag messages
  • Mass mark messages as flagged, read or unread
  • Customize mail alert sounds
  • S/MIME

Calendar improvements
  • Year view on iPad and new Week view for iPhone and iPod touch
  • Tap to create an event
  • View and add event attachments

Game Center improvements
  • Use personal photos for your Game Center account
  • Compare your overall achievement scores with your friends
  • Find new Game Center friends with friend recommendations and friends of friends
  • Discover new games with custom game recommendations

AirPlay Mirroring for iPad 2 and iPhone 4S

Multitasking Gestures for iPad
  • Use four or five fingers to pinch to the Home Screen
  • Swipe up to reveal the multitasking bar
  • Swipe left or right to switch between apps

On-device setup, activation and configuration with Setup Assistant

Software updates available over the air without tethering

iCloud support

  • iTunes in the Cloud

  • Photo Stream

  • Documents in the Cloud

  • Apps and Books automatic download and purchase history

  • Backup

  • Contacts, Calendar, and Mail

  • Find My iPhone


  • Redesigned Music app for iPad

    Hourly weather forecast

    Real-time stock quotes

    Wireless sync to iTunes

    Keyboard improvements
    • Split keyboard for iPad
    • Improved autocorrection accuracy
    • Improved Chinese and Japanese input
    • New Emoji keyboard
    • Personal dictionary for autocorrection
    • Optionally create keyboard short cuts for frequently used words

    Accessibility improvements
    • Option to light LED flash on incoming calls and alerts for iPhone 4S and iPhone 4
    • Custom vibration patterns for incoming calls on iPhone
    • New interface for using iOS with mobility-impairment input devices
    • Option to speak a selection of text
    • Custom element labeling for VoiceOver

    Exchange ActiveSync improvements

  • Wirelessly sync tasks

  • Mark messages as flagged, read or unread

  • Improved offline support

  • Save a new contact from a GAL service


  • More than 1,500 new developer APIs

    Bug fixes

    Products compatible with this software update: iPhone 4S, iPhone 4, iPhone 3GS, iPad 2, iPad, iPod touch (4th generation), iPod touch (3rd generation)

    Story Source: http://www.apple.com/ios/features.html