Encrypted backups

A friend recently asked, "I want to copy my files for backup but encrypt them so if I happen to lose a CD, DVD, or USB key that contains personal info, I won't have to worry about it. How can I do this?"

I've found it kind of depends on how you’re doing the backup and the media type you’re storing the backup image to.

• If you want to back up just a few hundred folders and files, then Winzip works OK, and the most recent version includes AES encryption. The cost is $30.
• If you’re storing to a USB flash drive, Winzip will also work, or you can use the flash drive supplier’s vault software (if any). I’ve used the EncryptX software for securely storing a few data file and doc backups OK.
• For large partition image backups, the backup software (for example, Dantz Retrospect or Acronis True Image Home) often includes built-in support for password protection or encryption.

I haven’t used free PGP, full-featured commercial PGP, or Gnu PG for encrypting backup images, but I suppose they will work, too. It's probably worth checking out freshmeat.net for open source options, too.

Remember that encryption has the potential to throw a wrench in the works when attempting to access the file later. I’ve had issues with Windows Vista, and it’s possible on other platforms, too. So make sure you have a secure backup of the root encryption key or certificate for this reason. Most encryption software supports exporting the encryption key or certificate in some fashion. If you are using file and folder encryption on Windows, check out Microsoft's Best Practices article for useful tips.

Advanced Home Networking

I reconnected with a past engineering friend on LinkedIn this week, and found out that he received the 2007 "Best Overall Home Networking" award from Cisco Systems. Congratulations, Andrew!

Check out his Blog at http://westcoastsmarthome.com/blog/

Scrum

Scrum refers to an Agile product development methodology that was new to me, so I looked it up on Wikipedia and found a good background description there.

We were sort of doing Scrum at my last job intuitively, without knowing it, except the part for "standing up at Scrum meetings" to intentionally keep them short!

Biting off just what you can chew makes a lot of sense. And fixed, incremental cycles of chewing is one way to finish a meal gracefully or, in the case of Scrum, to keep product software moving forward without losing momentum.

Disk drive backup and management

What's your favorite way to manage and backup a Windows or Linux hard drive? Especially if you maintain a dual-boot system?

I've had generally good experience with Acronis True Image because it's flexible. I've also had some issues with it, like when I tried to restore a Linux backup on a dual boot system, and the boot path lost all notions of the Windows OS. In that case, I had to do some creative dancing, just to get the boot path into shape again. But it eventually worked, and all was happy again :)

BTW, I've seen mention that Acronis doesn't work well with the new solid state drives. So heads up there; your mileage may vary.

Bye Bye PDA!

After working through four generations of Palm OS PDAs, it's clear I won't be upgrading to a new one. It's not because I don't want to, it's because Palm's become a phone company. The shift occurred quickly, once the Treo succeeded in integrating phone and PDA functionality.

Now, I'm in a rut. I still like the pocket fit and five-function management of the PDA. Of course, I can upgrade to a smartphone. But I really don't want the on-going cost of the pricey service plan.

The other options are:

• HP iPAQ: A nice device, but it looks pretty lonely out there. Doesn't give me good feelings for its longevity.
• Netbook: Yeah, it'll do what I want. But it won't fit in my pocket, so it's a luggable as far as I'm concerned.
• iPod Touch: Probably my best option, assuming Apple sticks with it. It'll do the basic five functions (calendar, mail, contacts, to do, and notes), sync with a PC, and more.

Hey, I think Apple's found another market opportunity :-)

Jeremiah Grossman

Another "must see" speaker. I've heard him speak twice at local OWASP meetings and both times it was a jaw dropping experience. Jeremiah shows how easy it is for an intermediate or injected proxy to take control of a browser or even the entire Windows desktop. You'll never feel quite as confident spending that next paycheck on-line, but hey, you'll be educated about what to look out for, too. Jeremiah makes it clear why security matters, and why it should be a design/implementation consideration from the beginning for any application on the network.

See his Blog at http://www.jeremiahgrossman.blogspot.com/

Oh, and check out the WASC website, too.

Secure inter networking?

Something I often wonder about: What will be involved to provide fundamentally secure inter networking?

It's generally accepted that TCP/IP was not designed with security in the forefront. However, considering the increasing amounts of commerce occuring on the Internet, it's ostrich-like to assume current secure networking methods will scale well or eventually become ubiquitous.

I suppose IPsec will help. But without pre-registering end-to-end security, is there a way that a client or server can expect it?

The typical vulnerabilities seem to reside in a few key areas:

• Proxy-based (man in the middle)
• Denial of Service (distributed or otherwise)
• Phishing (impersonation)
• Injection leading to loss of control (trojans, worms, poison packets and pages, botnets, etc.)

Will TCP/IP ultimately have to be re-designed or replaced to address these vulnerabilities? That seems unlikely at best.

Thoughts?

How to tick off your customers

OK, I'm not a Microsoft basher in general. I use Windows daily, and it's generally made my day to day computing life easier and more productive (gasp, a true confession!) However, there have been recent practices that have gotten my goat, so bear with me as I vent.

NB: These are good examples of how to tick off your customers (perhaps others can avoid them!)

1. Start charging for features that were previously free. I'm specifically thinking about the Encrypted File System (EFS), which was included in Windows XP Pro, but now costs $ in Vista.
2. Add injury to insult: Put EFS only in the Windows Ultimate Edition.
3. Require all OEMs to ship only Windows Vista (but not specifically the Ultimate Edition).
4. Inflict a complete Windows recast on the customer, followed by a robust, reliable version a year later (e.g., Vista -> Windows 7) Therefore, after already spending more $ to upgrade to Vista Ultimate, I have nothing better to do than spend $ to upgrade to Windows 7, too, right?

My point: Customer satisfaction is a many-faceted gem. It not only includes product features, reliability, and a timely delivery - but subtle factors as well - such as perceived value, clear messaging, and keeping migration and upgrades simple.

Windows 7

The buzz is "They finally got it right" and "Windows 7 is what Vista should have been".

After taking a look I agree :-)

Windows 7 features a "Back to basics, lean and mean" approach. It gets Windows out of the way, and puts the spotlight back on the applications software.

I installed it on a Lenovo ThinkCentre P-IV box with 4GB RAM. A straightfoward desktop, not cutting edge.

Observations:

• It installs faster than previous Windows versions
• It starts up and shuts down faster than Vista
• Just the basic features are evident on the UI and desktop (as mentioned: lean and mean)
• UAC finally works without being so annoying :-)
• It will install and run under the free VMware server. However, the usual vmnet virtual network adapter didn't work for me, so the VM had no networking capability.

Now, will MS sell just a few editions of the OS, instead of the confusing array offered with Vista? Last I heard, the plan is to offer half a dozen different editions, so unfortunately that confusing Vista legacy will remain.

Ease of Use

Ever wonder "Wouldn't it be handy if Linux had a command to set permissions along the entire pathname?"

Or "Why can't I click on a process in Windows Task Manager and select Go to File?"

These are examples of why software will never be finished. There will frequently be ease of use improvements that can be made.

I believe such optimizations add compelling value. They should be given serious weight, not just designated to some enhancement request black hole.

Good news: In Windows Vista, you can now do the "Go to File" trick. That's a nice value add :-)