Beta signups are already available on the company’s website, which soon would be updated to full version for regular business use. Click here to try the Beta version of the product.

According to an article published by searchsecurity,

“This model allows a company to reduce capital expenditures, scales up or add new networks under end point security protection on demand, and frees up the IT team from getting involved into huge amount of efforts required to maintain the server . The most compelling aspects of SaaS is its lower Total Cost of Ownership (TCO). According to McKinsey & Company, companies realise a 30% lower TCO when using a SaaS-based solution instead of an on premise solution. This value comes from several sources: reduced deployment time, no supporting infrastructure, no application testing, lower training requirements, no ongoing business process change management, all costs are visible in the service fee (no need to aggregate power and data center costs, licenses, pro rata allocations of infrastructure costs, etc …), and no unscheduled downtime.”

About the Product

uHook enterprise is a state of art DLP product for computer networks having enterprise data distributed in a WAN (Wide Area Network). uHook uses its ACTIVE EPS (End Point Security) technology, which was used in the first personal version of the award winning product, uHook Personal..

What is Active EPS?

ACTIVE EPS is the name give  to the core DLP engine in the agents which helps uhook detect and block any kind of malicious device which can be used to steal data. Besides, having its unique detection mechanism uHook Enterprise agents uses very low memory footprint, supports almost all windows versions including Vista and Windows 7 and interestingly communicates with the server without opening any port on your system making it less vulnerable unlike other desktop based application which communicates in the network. The product is based on both SaaS and non SaaS versions, which offer you limitless possibilities like controlling multiple office from one single admin console accessible from anywhere in the world, having unlimited capacity of storing your reports as long as you want and allowing you to scale up the control to over 2000 PCs with one single server license of uHook Enterprise.

Business Benefits:-

1. Control and monitor device access activities at different location of the globe sitting in one place
2. Protect your data and prevent malicious users with strong ACTIVE EPS technology
3. Scale up to thousands of machines within a very short time
4. No complex deployments and server installations are required
5. Unlimited storage of reports and policies
6. Regular updates of server and agents

Features:-

1. Easy to use device control over network
2. No port is opened on the agent thereby reducing the risk of other vulnerabilities
3. Password protected uninstall of the agents
4. Fast workflow of device control and policy implementation
5. Both SaaS based as well Dedicated Server support
6. SSL secured access of admin console
7. 128 bit encryption is used for client server communication
8. ACTIVE EPS technology ensures identification of a device uniquely out of millions of devices
9. Unlimited backup & storage of reports and policies
10. Regular updates of agents and servers
11. Flexible reporting
12. Email alerts and warnings of malicious activities on the end points

The B-Plan Event Navkriti 2009

The major advantages in winning, as the Dataresolve team feels were having a really innovative approach along with technology to solve the problem of enterprise data theft from large number of small storage devices coming in the market and expected to keep on increasing in coming years. Fully automated sales system, targeting international customers and being able to bag 9 international deals in last 8 months were also felt to be important.

The jury members consisted of Anand Lunia from, Seedfund Advisors,Mr Sameer Guglani from Morpheus Ventures, Mr Rahul Chaudhri from Helion Ventures etc. Some  of NITIE’s  esteemed associates also included TIE Mumbai, NEN, and  Nexus India Capital.
Winners of this competition have the opportunity of being considered by Seedfund for a potential seed fund upto 5 crores INR.

Dataresolve was founded and incubated in August,2008 from IIT Kharagpur,one of the the elite institutes of the country,  under an incubation program called TIETS. The company was  founded by IIT Kharagpur Alumni with the support of institute’s professors and industry experts with a vision to build one of the strongest product based technology company in Information Security. With most IT companies in India being service based, Dataresolve proudly claims itself to be one of the very few software product companies from India and probably the only company in DLP.

The Dataresolve Team receiving the trophy for the event Navkriti

The first and free home version product of the company called uHook USB Disk Security have already generated a lot of good response from internet community with over 20,000 users worldwide and the product being graded by PC QUEST under top 55 security products of 2009, helped the company build an appealing profile to market the enterprise version of the product.

According to India’s Manufacturer Association for Information Technology (MAIT), laptops accounted for 25% of total PC sales in India in 2007-2008. The current ratio of laptops to desktops in India is 20:80 and is predicted to reach 50:50 in the next 3 years.

Accelerating the rising demand for laptops are their sleek & attractive designs, enhanced security functions & modules and various built-in accessories. The enterprise sector particularly favors faster processors, increased portability and connectivity, according to industry analysts.

But the major pitfall of this growth in laptop sales would also most likely boost another dangerous aspect of the PC industry – Laptop Theft. Keeping your information in highly portable devices like laptops and PDAs is bound to trigger a huge security issue revolving around data & hardware thefts.

Here are some ways how you can increase security of your laptop and minimize chances of data loss.

The security of laptops is a huge field which can be broadly divided into two main segments:

1. External Security or what is more commonly called Physical Security
2. Internal Security or what is more commonly called Software Security

External Security tends to address issues like Laptop Thefts while Internal Security is more oriented towards protecting it from Data Thefts.

Elements of External Security

i. Get custom Engraving done on the Laptop

Permanently marking (or engraving) the outer case of the laptop with your company name, address, and phone number may greatly increase your odds of getting it returned to you if you happen to forget it somewhere carelessly. Websites like www.engraveyourtech.com and www.razorlabs.com do custom engravings.

ii. Get your Laptop registered with your manufacturer

This not only helps you to track your laptop if it arrives at any maintenance shop but also helps you get regular updates and support.

iii. Use a Cable Lock

Using a custom Cable Lock will help you secure your laptop to an immovable object beside the place where you keep your laptop. This ensures that nobody just walks in and then walks away with your laptop. You can get a cable lock for $15-$30. Cable Locks can be purchased from sites like www.securitykit.com, www.computersecurity.com , etc.

iv. Use a Chain/Cable Lock while in Car

Using a cable lock while using your laptop in the car ensures that nobody can steal your laptop even when you are outside the car.

v. Use a Docking Station

While in office always place your laptop to a docking station where you can fix your laptop. 50% of laptop thefts occur from offices because of poorly screened housekeeping staff and disgruntled employees.

vi. Use third party devices like Hard Drive Locks, Motion Detectors and Trackers

Hard Disk Locks are great to lock in your hard disk inside your laptop so that no one can just open your laptop and walk away with your hard disk. Remember, your hard drive is the main storehouse of all information.

You can also have special Motion Detectors like Caveo installed in the PCI bay of your laptop that trigger an alarm whenever the laptop is moved without your permission.

Laptop Trackers inform the authorities about the whereabouts of the laptop whenever a stolen laptop is connected to the Internet or the telephone. Nowadays GPS trackers have the ability to track your laptop using satellite data but they are more costly.

vii. Get a Laptop with biometric identification

Biometric Identification reads your thumb finger print and unlocks your system. Without the thumb impression of the authorized individual, the laptop cannot be unlocked. In this way your laptop is safe from prying eyes trying to steal your account password.

viii. Use Handy Laptops backpacks which you will always carry wherever you go

Laptops backpacks are better in the context that you can always place it on your shoulder comfortably and go anywhere thereby eliminating the worries of losing or forgetting your laptop. Be it washroom or conference room or transport station, your laptop goes with you everywhere.

Elements of Internal Security

i. Get a secure Operating System with the Latest Updates

Always try to get a genuine copy of your operating system with the latest updates. For Windows XP users, get the XP Service Pack 3 installed on your laptop for maximum security. Every Service pack eliminates past vulnerabilities and incorporates greater security features in your OS.

ii. Always use the NTFS file system

The NTFS file system is far better than the FAT32 file system in the sense that it is more secure and more crash-proof. The data corruption rates is very low and even if you lose your data through format or partitioning or deleting, you can still recover it through special Hard Disk Recovery or File Recovery softwares.

iii. Disable Guest Account

The Guest account is hacker’s golden gateway. Check from you User’s Panel if it is On. The best possible thing to do is disable your Guest Account. Otherwise, you can keep it on but make sure, you protect it with a password by making use of the Computer Management Panel (to access this, type compmgmt.msc in Start>Run) of Windows.

iv. Disable Administrative Shares

Windows by default keeps all the partitions in your Hard Disk shared in the form of hidden administrative shares like C$, D$, E$, etc. This is a big security risk for your laptop specially when it is connected to a Wireless/Wired Network.  Go to the Computer Management Panel and Disable sharing them permanently.

v. Rename the Original Administrator Account

A hacker is always on the lookout for an account named administrator that Windows creates by default while being installed. Take the essential step of renaming your Administrator account from Computer Management Panel to some other name. This would delay the hacker’s intrusion attempt by some time.

vi.Create a dummy Administrator Account

While this is not so effective, but it can stop amateurs hackers from compromising your system. Delete your old Administrator account and make a new account with the name Administrator and assign limited privileges to this account.

vii. Disable the IR Port

The Infra Red Port is one of the deadly information leak channels in your laptop. Anybody could connect to your laptop through an unsecured IR port and copy your data. With the task bar notification turned off, it won’t even ever strike you how your data was stolen and who connected to your laptop.

viii. Switch on the Bluetooth Port only when required

The Bluetooth high speed transfer port is another communication medium through which data can be accidentally lost. Be careful to choose which incoming Bluetooth connections to accept and which to reject. Never connect your laptop to an unknown Bluetooth device.

ix. Always install Antivirus and Antispyware in your laptop

Any good antivirus with regularly update databases and bundled with an antispyware is a must for your laptops. A great deal of security concern arises from Viruses, Malware, Spywares, Trojans and Rootkits in your laptop that would otherwise get installed in your system in the absence of an antivirus without your knowledge. Remember, the main purpose of these malicious programs are not to corrupt your laptop OS or bug you or freeze your system but to manipulate the system in such a way that you unintentionally and forcefully expose your vital information to these programs which then happily transmit it to their owners sitting in different countries through the Internet. Antivirus like AVG, QuickHeal, NOD32, CA , Symantec are professional software providers in these fields.

x.  Switch on firewalls for Wired and Wireless Connections

Firewalls control the information that is sent to and fro across your Network connections. It has the ability to stop malicious programs from stealing sending vital information from your laptop to another computer outside. With the good configurable policies, firewalls really add good value to your security of your laptop. Keep firewall always enabled for all your connected Wireless/Wired Connections. Komodo, ZoneAlarm, SonicWall, ESET Firewall, etc. are great firewalls to start with initially.

xi. Store your important files and documents in a single place and keep them encrypted

The greatest loss that is realized after a laptop is stolen is not the price of the laptop but the price of the information it had been carrying. If you are always weary about the sensitivity of the information that you carry in your laptop then make sure you keep these documents organized properly in a particular partition of your hard drive and then encrypt the whole partition with strong 128 bit encryption.

This way even if the stolen laptop gets into the hands of your enemies or competitors, it will take them more than a lifetime to decode the information even with very powerful computers. By that time, that information would have lost its face value.

The industry standard encryption programs are TrueCrypt, Jetico, CryptoForge, DeltaCrypt, etc. that can offer 128 bit encryption level and even military grade encryptions.

xii. Implement more control over removable Storage Devices and CD/DVD Drives

Use special Data Loss Prevention softwares that implement a higher level of access control over your laptop which the Windows is otherwise unable to provide. You can set permissions for different devices and different users in your laptop thus controlling storage devices access to your laptop. You can even maintain a file log audit and session audits for each file transfer. This can help you a lot to trace where your information is going and how to stop it.  Some well know personal DLP softwares are Devicelock, myUSBonly, uHook USB Disk Security and other End Point Protection softwares.

xiii. Be careful when connecting to a new Wireless Network

When connecting to a Wifi hotspot in a place, first make sure about the security of the network from the local authorities. Cross check the name of the network and then connect carefully to the network. You can easily confuse one Wi-fi Network with the other and end up connecting to a high risk network instead of the secured one.

xiv. Use firewalls effectively on USB Modems which you use to access Internet

With the arrival of the new High Speed Internet Access (HSIA)  and 3G Network connectivity, portable USB Modems and mobile Internet access have become successfully connected to the lifestyle and requirements of a major section of Internet users. But these modems are highly insecure unless well monitored and controlled using Information Flow control softwares and Firewalls.

xv. Lock your Laptop whenever you are away

Whenever you leave your laptop and go somewhere for even a second, make sure you that you press the Windows Key+L  key combo to lock your computer and bring up the login screen, in which all the user accounts show up. Make sure all the accounts are password protected. This prevents just anybody from accessing your computer whenever you are afk.

xvi. Always keep backup of your files in another central computer or server or external Hard Disk

It is imperative to always keep a mirror image of your hard disk data in another central company server or another fixed computer. You can also use an external hard disk with which you can periodically synchronize your data to keep a ready backup of your most important files.

xvii. Protect your PC with a good BIOS password

The easiest way to penetrate a stolen laptop is to just format it instantly. Sometimes all the data is lost or otherwise anyone can format one partition of your laptop and then get unauthorized data from another partition just by overwriting your OS. So it is better that you lock your BIOS settings and at the same time disable booting from anywhere other than the  Hard Disk Drive. This partly prevents your system from being formatted.

The most Important step amongst the above steps is to show greater vigilance and concern for your laptop and your data that is preserved in your laptop. Being self-aware while being dynamic is the ultimate solution to Data Loss problems.

These incidents have not only lead to major data security breach in companies but also harsh inconvenience to employees as well as clients of the companies. Much time is spent on damage minimization half of which could have been otherwise spent on continual security audit of existing policies within the organization and their subsequent improvisation. If you ponder deep into these policies of data security enforcement, the biggest threat doesn’t comes not from backdated or non-improvised security policy but from lack of awareness, discipline and sense of conviction from the employees of the organization, in the area of data security.

Employee Awareness

The first step towards minimizing these incidents is to make your employees aware about the high importance of information they handle every day, that in today’s world, information is everything – resource, business, money, power or whatever you can think of. Without Information, business is blind. If an employee thinks, he is safe from data theft, then it is the first step of making himself a target of data theft. Ignorance is never a blissful option here.  In your everyday life, you have to educate your employees and keep them updated with the latest security threats that could affect anybody. An employee should know where and when to store which data. Employees should be trained on information handling just as they are trained on their core expertise.

Employee Discipline

The second step is to inculcate discipline regarding information handling. Lack of discipline, proper standard procedure and improper placement of information generally leads to data leaks. You should be twice careful to give access of particular information to a particular person without validating his information access level. They say you should treat your credit card as if it were your money. Similarly, treat your data as if it were your own money and be responsible for where it goes. Keep trace of information movement paths within the organization. If you transfer valuable information to another employee, you should hold him twice responsible as you would be. In that way, he would be more careful about it or twice careful before misusing or unknowingly leaking it.

Employee Conviction

The third step is to imbibe a sense of conviction within yourself and your fellow employees. Remember, how careful you are while doing a credit card transaction? You check for validity of the website, SSL security of the transaction, company credibility, check for keyloggers, try to use visual keyboards, take printouts of transactions, and even call up or email customer support. Why do you do so many things to ensure that everything is right? Because your sense of conviction tells you that you could end up losing a valuable asset like money. If anything goes wrong, you will end up losing something that could directly affect your life. This is exactly what needs to be applied to information as well. Business Organizations should either imbibe this sense of conviction within their employees or take steps that could affect the lives of the employees directly if they end up losing information. If an employee is found lacking discipline regarding information handling, then he should be made accountable for the data that he lost.

autorun.inf viruses uses the autorun feature of microsoft Windows to spread itself on computers wherever autorun.inf is enabled.The virus then, makes a copy of the autorun.inf file to the root or main directory of all the drives on your computer, internal and / or external disks including sd cards, pen drives, ipods etc, to make the virus runs every time the external disks like pendrives or USB drives are inserted or every time you double-click the drives through the windows explorer.

There are five different ways you can block usb drives from your pc:-

a. Using commercial softwares : There are several applications available on internet which can help you block your usb drives from unauthorized access. The cost ranges from 6 USDs up to around 90 USDs depending on the kind of flexibility and control you need. It is recommended that whenever you go for a commercial usb security application be careful to analyze all the features available with that application, otherwise you might end up paying more for lesses  features. Avoid using new products because sometime, it might also make your system unstable. If you going for an enterprise wise USB security application with a commercial product, test the trial version of the software either in a virtual machine or a test machine

b. Through windows registry tweaks : You can follow following steps in order to block usb storage devices from registry  provided, you have the administrator rights on the machine :- (warning : Please be careful while editing the registry because if you make a mistake accidently, your system might become unstable):-

1. Click on start and then click on run

2. Type regedit in the textbox that appear and click ok

3. A registry editor window will open up, where you have two panels each on the right and left

4. Click on HKEY_LOCAL_MACHINE on the left panel, a list will open up

5. Click on SYSTEM on the opened up list and then click on CurrentControlSet in the new branch of list that opens up (see the picture below), then again follow the same with services until you can see a usbstor in the list

 

blocking usb drives with registry

6. Click on usbstor, and then double click on start on the right pane, a pop will appear as shown in the picture below

blocking usb drives with registry

7. Change the value field to 4, select the radiobutton to hexadecimal(if it is not already selected) and press ok

8. Quit the registry editor and you are done.

c. By making changes in the bios : Nowadays, most of the computer manufacturers supports the feature of disabling USB ports from bios.

 Follow following steps to disable usb from bios:-

1. Boot your pc

2. Press F2 or whatever shortcut is there on your PC to access the bios

3. Go to advanced tab on the bios and look for USB Port

4. You should be able to find out an option for disabling usb ports

5. Save and the bios settings and reboot the machine 

User might go back to bios and re enable the usb ports, so, you should also set bios password in order to prevent that. But, then again, opening the chassis and placing the bios battery after removing it will reset the bios password. You might consider it to be an issue of physical security.

d. Using glues to block the USB ports 

Carefully fill all your usb ports with a thick epoxy adhesive . But, this technique might damage your system and you will not be able to use even the necessary usb functions such as printers which are connected to usb ports etc. This method is highly not recommended.  

e. Physically removing USB ports from your PC

Although a bit difficult, but you might also consider physically removing usb ports from your motherboard. If the usb  port is onboard, then, there is a very high risk that you end up damaging your motherboard because you will have to use a soldering machine to carefully take out the USB ports. This technique faces the same disadvantages as blocking the usb ports with glues because you will never be able to use your USB ports for necessary functions such as printing etc.

A great new Monday morning! Ben was busy updating himself about the status of the work when he realized that something was missing from his pockets. His purse?  No! His credit card?  No! A chill went through his spine with blazingly fast thoughts of impending consequences. Ben realized he had accidentally left his pen drive in the cab. The company employee payroll data with a collection of social security numbers in now free to be surfed upon by 1 billion people of this world on the internet. Ben once told that his favorite USB drive had made his life easy for sure but now he realized that the same USB drive might make his life highly miserable. Well there goes down one more fan of USB drive!

Even more surprisingly there is at least 1 Ben in every company in this world. And every Ben either had the same experience or will have the same experience in the future. The problem with most of us is that we think we are immune to these kinds of incidents until one great day the same thing happens to us.

It is not necessary that sensitive data will be always stolen from the company. In other cases, employees tend to misplace or lose data unknowingly which leads to the loss of the company itself.

Nowadays IT managers focus more on IT administration, IT maintenance and governance and Management Information Systems. But the most important fact is that even if IT infrastructure is there to store and process data but as long as the data is not safe, IT is useless no matter how fast it processes your data, automates business processes and accelerates your business. Protecting business is as important as making it grow.

As a matter of fact, each and every company should set aside a part of their annual budget exclusively for information security and Data Loss Prevention, be it through Physical end-points like USB drives, CD/DVD, printers or through Network paths like Emails or Instant Messengers.

In a preview interview with Dark Reading, Gartner security analyst Adam Hills said that security projects and functionality are gaining attention in the corporate boardroom and claiming a larger portion of the IT budget pie. “IT spending in 2009 is basically flat, with some companies making cuts, but we’re seeing security spending increase slightly,” Hills says.  “If both of those hold true throughout the year, then it’s clear that security spending will end up comprising a larger portion of the total IT budget [than in 2008].”According to Gartner, most importantly,  security is gaining attention at the highest levels of the organization.

IT Security spending is increasingly becoming a Board-Level Decision.

uHook Enterprise gives administrator a powerful tool to block all kinds of USB storage devices and control and monitor the activities of the employees using these devices from a single console. With its rich reporting module and configurable policy settings uHook Enterprise is the basic necessity of every organization’s IT security portfolio.

[View with PicLens]

Online sales of uHook enterprise is not available currently. Send purchase request to sales at dataresolve.com for details

From the words of times of India:-

“On June 24, someone who goes by the name Praveen Rai walked out of two branch offices of State Bank of India in Mumbai, pocketing a cool Rs 90,000 that he had allegedly siphoned off the account of a Kolkata-based trader. The crime shook not only the businessman, but also the city’s police and e-fraud experts. For, the next target could be you. Or just about anyone doing e-banking. Police are desperately looking for Rai, who is believed to be in the early 30s. They also have a photograph of him (the one he submitted to open the SBI account), but more than a month after the crime, there is no trace of him. The victim, trader Akhilesh Bagla, is probably the first from the city to have had his account hacked. But it opens the risk of a racket operating in the web world. ”

Now, if we look into the incident closely, it turns out that at some point of time, the culprits had access to the bank account details of the victim including the internet banking id and password.

How did they get access to such information?

Either the victim himself gave them the information or the information came from somewhere else. It might be suspected that, an insider trading of confidential information happened. And a usb thumb drive could have been one of the tools used by the culprits to achieve their mission. The possibility of using an email could also not be ruled out. But, most of the businesses now a days use their own in-house emailing system along with monitoring all inbound and outbound emails.

Some of our so called IT security experts comment that “I think the bank account was hacked”.

But, there is a very simple logic to make you understand that any kind of hacking or network penetration was not attempted in this case. Why would a hacker take so much pain to gain access to the gateways of SBI, penetrate into the network and then, when he has access to all the bank accounts selects only one of them to steal some 2.6 Laks of money.

So, what we conclude now is that, there was loss of information somewhere which was only limited to a particular bank account which led to this incident. And , if we want to avoid such incidents to happen in future we need to fix all our security holes both at the network level and at the end points.

Now, there are good points and some bad points about monitoring your employees.

The good points are:-

1. You are assured that your employees will not make a mistake of leaking out your confidential data

2. You are assured that any outsider\disgruntled insider who is temporarily using one of your computers will not be able to steal your critical data

3. You know well who is trying to access what kind of data

4. You can even find out if people are actually working or watching youtube videos during their work hours

The bad points are:-

1. You are breaking privacy of your own people

2. Employee monitoring might create serious de motivation and unhappiness among your employees

3. There could be few legal complications in some of the ways of employee monitoring

4. If access to the data generated from the monitoring gets in to wrong hands, you can imagine well what could happen next

There could be lot of other good and bad points about employee monitoring which i might have missed.

Now, lets try to find out what do you have when you start monitoring all the personal computers in your organization:-

1. You have record of every keystroke, which will have emails, passwords, credit card number, may be social security numbers, bank account details, health information etc etc

2. You will have access to thousands of screenshots and videos of the personal compters used in your organziation tracking every activity on that machine

3. You will have access to the online behavior of each and every person in your organization

It looks like you feel like going for an online monitoring systems and in fact lot of companies are doing that for a very long time. But, what about the bad points?

Its simple,why should a person buy a Christmas gift during working with his credit card. Why john should write an email to his girlfriend at the time when he is supposed to finish the proposal his boss told him to. Why bill should be trying to send a job application to another company because he wants a better job. It should have been all right if these people would have done these things from their own personal computer.

So, you see, you can justify that you should monitor your people. But, whats the proof? and what about legal complications?

There is something call job contract which is a list of points you want to have in agreement with the person you are working with and both of you sign on that only if both of you agree with those points. So, i hope you understand how can you handle those legal complications and thats a really good passport to allow you for monitoring might not be the way you want, but to some extent.

Regarding the demotivation and unhappiness crap, i dont have a clue how to get this sorted out. But, i hope all those smart CEOs and Management Gurus should be able to handle it.