Having a phone from the company that makes the Xbox makes it feel a little less "enterprise". That is best described as a halo effect. A senior figure at the anti-virus giant McAfee once told this writer the security industry was a mess. There were too many vendors trying to do too many things. But what the industry mirrors is the threat landscape it is trying to calm down.Just look at what’s happened in the past six months. Two of the most significant breaches in the history of the web have occurred, with the attacks on US retailing firm Target and auction giant eBay. There was also the small matter of the Heartbleed vulnerability in OpenSSL, one of the most high-profile web security flaws to date. From a security perspective, things aren’t letting up and there appears to be no end in sight.One common, depressing problem that’s emerged from each of these issues is that many people just aren’t doing the old basics right. The whole security sector, from vendors to customers, needs to be sensible in its response, says Javvad Malik, analyst from 451 Research.
“The industry’s been messy for a while now and it’s important the industry responds in a pragmatic and unified manner to try and win back confidence of businesses that investing in security isn’t a completely lost cause. We’re still bad at managing the basics, patching, privilege identity management, tools that overload users with alerts within which important issues can be missed,” Malik says.Whilst IT teams are often told they need a new approach to protecting the business, they have to get the old problems nailed first.Beyond the rudimentary matters, though, coping with these manifold problems effectively will require traditional protections to change and new ones to emerge from research labs and find their way into businesses. “As the internet touches more and more areas of our lives – smart devices, currencies such as Bitcoin, cloud and virtualisation – simply reacting to threats is no longer the most effective way to protect both individuals and organisations,” says David Emm, senior security researcher at Kaspersky Lab.That does not mean killing anti-virus, however, even if the traditional signature-based approaches have failed. Modern AV systems, the best ones, at least do some heuristic and reputation analysis, rather than just try to detect malicious software that’s already been seen in the wild.
Emm says malware detection technologies should look beyond the static and evaluate objects or applications within the context of a specific environment, questioning what it’s doing there, what it’s connecting to and what it has been designed to do compared with its expected behaviour.“This enables security experts to identify anything that is being used for nefarious purposes before an attack has been carried out,” he adds.“There have been those who have said that ‘AV’ protection is dead but what this really means is that we have to go beyond traditional signature-based protection and use more sophisticated technologies including heuristics, sandboxing, proactive behaviour detection, cloud-enabled threat intelligence, application control, automatic exploit prevention, secure banking and more.”Outside of malware problems, the rise of mobile has brought about a dismantling of the IT perimeter. That’s why the firewall has also taken a battering in recent years. And yet it still survives as a technology, whether in the traditional or “next-generation” sense. Rather than taking down the firewall, the response to the death of the perimeter should be based on a layered approach, not a rip and replace strategy, says Professor Alan Woodward, of the computing department at the University of Surrey.“I think we can take lessons from how physical security has been mounted historically: something as simple as a castle didn’t have just one wall. There were layers of walls and eventually a redoubt within which the most precious items were kept,” Woodward says.
“Defence in depth has to be seen as the default approach. With the rise of insider threats and spear phishing attacking those with privileged access, the perimeter is becoming less of an absolute barrier to intruders but is still causing some attacks to bounce off so it would seem a little silly to simply let it crumble.”Emm says such an approach needs to focus more on the individual, rather than attempt blanket security measures. “People do still work in the office, connecting to corporate servers so that network still needs to be protected. However, the workspace has become more diverse in that many people will work from home on a laptop or on the move with their smartphone or tablet,” Emm adds.“This leads to a host of additional security issues - from people logging on to insecure Wi-Fi networks that could potentially be being watched by cybercriminals, to losing their device on public transport - and it is these devices that are not protected by traditional policies, firewalls, endpoint protection and mail filtering that exist in offices.
“We therefore need to look at a security solution that protects the individual, taking into account new devices and policies and procedures for untrusted environments – i.e. ‘follow-me’ security.”This all points to a need for better intelligence systems, ones that can alert organisations to anomalies on the network caused by zero-day threats and access inconsistencies, whilst allowing for greater analysis of attacker behaviour. The most effective are likely to be based on Big Data technology, ones that can draw together different data types to determine the nature of the threat. Use of Hadoop and big data warehousing projects will likely be the domain of large enterprises. Security Information and Event Management (SIEM) technologies will likely be suitable for smaller enterprises, the most attractive being those that allow for actionable intelligence and pull in as many different sources as possible.Proper intelligence solutions aren’t just thought to be useful in understanding the adversary, they’re also likely to save businesses money. Research from the Ponemon Institute last year, looking at 234 breached organisations, showed those who invested in security intelligence systems gained average cost savings of nearly $2m in comparison to those who didn’t.Microsoft has pitched its Surface Pro 3 as a "tablet that can replace your laptop." That is unless, it seems, you want to repair or upgrade your laptop.
Teardown specialists iFixit have posted their initial dissection of the latest Redmond tablet, and they've concluded that the surface on the Surface is poor for service.The third generation of Microsoft's high-end tablet received a repairability score of one out of a possible 10 – iFixit's lowest.Among the issues noted by the company was the use of non-standard connectors, an unreplaceable battery, and extensive use of heavy adhesives that make opening and servicing components in the tablet nearly impossible.Perhaps the biggest worry with the Surface Pro 3, says iFixit, is the screen itself. During the early steps of the teardown process, loosening and prying open the outer casing from the display, the researchers spotted cracks.The small fissure quickly spread through the screen, and the iFixit crew said that it had to tape up the display in order to prevent it from falling apart outright."The delicate and arduous opening procedure leaves no room for mistakes: one slip-up, and you'll be out a screen," they wrote.Even if one can pull open the display, the Surface take-apart effort found that other measures from Redmond make servicing the device extremely difficult. While the SSD was found to be accessible and fairly easy to replace, other components such as the battery pack were glued into the tablet's casing to the point of being impossible to remove without causing permanent damage.
To be fair, few if any tablet systems these days fall under most peoples' definitions of repairable. Vendors are able to squeeze a tablet's guts into their svelt enclosures by using glue to secure components, along with other space-saving measures that make DIY repairs difficult to impossible. Apple, for example, receives similarly low repairability scores for many of the same reasons.That the Surface Pro 3 wouldn't even survive a case opening, however, could be seen as cause for concern about overall durability.The team at iFixit has performed hundreds of such teardowns in the past, and hardly qualifies as ham-fisted when it comes to handling delicate components. Indeed, the company makes its living selling users the very tools that allow for the opening of mobile devices without cracking screens or warping battery packs."Microsoft went to great lengths to make the Surface Pro 3 super portable, thinning it down from the Pro 2's 0.53in to a mere 0.36in thick," the DIY repair site noted.
As with all of our Surface products, Surface Pro 3 is engineered with high-quality components to be as thin, light and powerful as possible and is designed to be serviced by professionals. All Surface products come with a one-year limited hardware warranty and customers have the option of additional warranty protection with Microsoft Complete, which gives customers two years of limited hardware warranty coverage that includes accidental damage protection.
Impressively, there's no sign of bargain basement build quality, something that couldn't really be said of the first generation MeMO Pad 7. The whole thing feels as solid as a rock while the screen is made from some sort of toughened glass. The nicely rounded matt finish rear is rather pleasant to the touch too.Physically the new Asus is par for the 7-inch tablet course. At 113.7 x 189.3 x 9.6mm and weighing 295g, to all intents and purposes, it’s the same as the MkII Nexus 7.The only ergonomic hitch is the positioning of the power and volume buttons on the right. They are too much on the back rather than the side and don't fall easily to the touch, something exacerbated by the power button being below the volume rocker which feels the wrong way around to me. The memory card slot doesn't have a cover but cards slot far enough in for this to not be an operational problem.