Blog Posts

IIT launches multimedia communication product offerings

5/19/2015

It's been a busy year so far. We have been busy working on new initiatives. As a result of these efforts, we're excited to announce the addition of Multimedia Communication offering to our portfolio of technology related services.

Applications for this service include Public Safety Training, Online Training Courseware Framework, Election Communication, Emergency Communication, Shareholder Presentations and various others. Initial focus will be the government sector (state, local and federal) and affiliated public safety organizations.

IIT has partnered with leaders in the field to provide our clients turnkey solutions, including video production / post-production, website optimization, broadband TV channel development, drone cinematography, digital marketing and advertising.

0 Comments

IT Jobs Growth - November 2014

11/12/2014

0 Comments

According to this report from TechServe Alliance, after 9 consecutive months of a downward trend in the rate of growth in IT employment, the number of IT jobs grew 0.2 percent sequentially last month.

The US economy has added over 100,000 new IT jobs in 2014. On a year-over-year basis, IT employment has grown by 3.5% since October 2013 adding 159,300 IT workers. Now there are over 4.7MM IT workers employed in the US.

To review details of this report, click here

0 Comments

Inc. 500 ranks IIT #1 on its 2014 list-companies in North East US, in IT Services with over $10MM reveneus

9/17/2014

1 Comment

Inc. Magazine has named IIT Inc. to its 33rd Annual Inc. 500 / Inc. 5000 list. See Official Press release here

As an Inc. 500 honoree, IIT now shares a pedigree with companies like Microsoft, Oracle, Dell, Under Armor, Jamba Juice, Pandora and Zappos. Highlights of IIT's rankings include:

1. IIT ranked #1 on this list - among companies in "North East United States" in the "IT Services" sector and over $10MM in revenues.

2. IIT ranked #5 on this list - among companies in "United States" in the "IT Services" sector and over $10MM in revenues.

We are honored to be recognized in this year's Inc. 500 list. This achievement demonstrates our continued commitment to deliver exceptional client service when performing IT Consulting, Staffing, Outsourcing and RPO engagements for our diverse clients in Government and Private sector. I know it is our people that set us apart, and the Inc. 500 list serves to confirm our collective efforts. I would like to thank our clients for their trust, and the IIT team for their dedication. What makes IIT's inclusion all the more gratifying is that IIT accomplished this growth from 2010 to 2013, in the midst of a historically sluggish economy. “Privately held companies on average ended 2013 with annual sales growth of 5.4%, the slowest rate of growth since 2009,” reported Forbes. This is in contrast to IIT’s results which averaged over 300% growth during each of last 3 years, for a cumulative 3 year total of 1,446% growth.

The 2014 Inc. 500, unveiled in the September issue of Inc. Magazine, is the most competitive crop in the list's history. To be included, companies had to have achieved a staggering minimum of 918% in sales growth from 2011. Complete results of the Inc. 500, including basic company profiles and an interactive database that can be sorted by industry, region and revenues, can be found at http://www.inc.com/inc5000/list/2014

1 Comment

Wearable Technology – What is Apple iWatch

7/31/2014

0 Comments

Ten years ago, you probably thought that smartphones and tablets would never be a part of every household, let alone corporate America. Smartphones were seen as expensive cell phone alternatives and tablets were a luxury for Apple fans only. Today, however, most people have a smartphone, tablet or both. And we have seen integration of these products in the corporate applications. So is there a need for Apple’s iWatch in Corporate environment?

Last month, we discussed Google Glass, another wearable technology. Unlike Google Glass, the iWatch hasn't launched yet, but rumors say that it will debut in October 2014, just in time for the holiday season. This is consistent with past Apple strategy, where new technology is launched for the consumer market, and when it matures and the kinks have been worked out, it is repositioned as a “corporate accessory” (a necessity in some cases).

Gadget fans should be happy to know that the investment is much less than Glass. Experts speculate that the iWatch will debut at $250-$299.

The watch runs on iOS, which is the same operating system as your iPhone or iPad. Apple is reportedly designing iOS 8 with iWatch in mind. The watch has a 4-5 day battery life and biometric sensors. Some reports indicate that iWatch will come with different screen sizes, up to 2.5 inches diagonally.

iWatch will perform some tasks independently, and for some, it be dependent on a compatible iOS device for functions like receiving messages, voice calls, and notifications. iWatch is also expected to feature wireless charging and mapping abilities. NFC (Near Field Communication) that allows wireless communication with other devices (e.g. Bluetooth) is also one of the expected features.

While the concept sounds interesting, I can’t imagine typing on an iWatch screen or reading meaningful data on its small screen. But I foresee voice recognition as a viable “input” to applications residing on the iWatch. Assuming Apple can improve its Voice Recognition technology (Siri), I can see some acceptance in Corporate America, for “input” sensitive applications with negligible “screen output” (how much readable text can you really cram into a 2.5 inch screen). But, if a future version of the watch can project hologram type of images to make more of readable text appear, I can see Corporate applications like email, usable mapping, intranet document access as a viable option. But without this projected image, I don’t see corporate America lining up in October 2014 outside Apple stores.

There are some conceptual drawings with larger screen sizes, but these drawings make this wearable technology more like women bracelets. Once again, I don’t see men accepting this look.

We have seen similar technology launches from Nike (Fuelband), Sony and Samsung. But I am yet to see many people using these products. However, Apple has been known to create right features with relevant marketing to attract consumers. Remember what happened with iPod. Other Mp3 players existed from various manufacturers for a while, but it wasn’t until iPod that portable mp3 players became a commodity. And then iPhones practically took over Blackberry devices.

I predict, at least until a hologram projector can be integrated, iWatch will remain a consumer domain gadget and not a corporate device. So I don’t think corporate IT staff need to worry about deploying and managing one more device in the near term.

What do you think?

0 Comments

12 Tips to Screen and Select Temporary IT Staffing Vendors

7/30/2014

9 Comments

IT Staffing is probably the second or third largest expense in most mid to large size companies (#1 being cost of their internal IT employees). First know the difference… the process for hiring ‘contract/temporary’ staff versus hiring ‘permanent/employee’ staff is very different. Know that a typical vendor will not be an expert at both. Ideally, you want to have 2 separate pools of vendors – one for contract/temporary hiring and one for permanent/employee hiring.

This article focuses on contract/temporary staffing vendors, and may be useful for Procurement and IT departments at all size companies in preparing a RFP for "Temporary Staffing / Staff Augmentation / Contingent Staffing Services". It may also be useful for IT and Corporate Management to learn the Staffing Vendor Selection issues.

From a client perspective – try to understand your vendor's business involving their processes, costs, challenges etc. Once you do, you will be better armed than your competition in order to give your internal departments and vendors relevant data, which will eventually lead to your vendors coming through with the best talent with lower risk.

1. Basic Vendor Screening
   • How long in business (experience counts). Don’t give credit to “individuals” industry experience – you want to know about “company” experience. When hiring temporary staff, company is more important than the individual(s) you deal with. Minimally, the vendor should have been in business 10 years, and gone through a few different economic cycles and recessionary environments.

   • Ask for types of clients they have experience with. Have they worked with clients in an industry similar to yours?

   • Meet some of the vendor staff. See if you have access to vendor’s senior management. Many companies have offshored their initial candidate sourcing. But quality produced by these offshore recruiters is significantly lower than US based recruiters. Are these the people you want to represent your company? What is the turnover among the client facing “account management” and “recruiting” staff.

   • Ask what type of background checks they perform on the candidates. Minimally, they should be verifying US employment eligibility (not hiring illegal aliens) and criminal background checks. See related article “11 tips on hiring and IT Consultant”.

   • Are they adequately insured? Typically, you want to look for Commercial General Liability, Professional Liability (Errors and Omissions), Employers Liability and State mandated Workers Compensation and Disability policies that carry at least $2MM per claim limits.

2. Capacity and Hiring Volume
   • Ask how many consultants do they currently have deployed at clients sites. If you want to be extremely thorough, ask them for some proof (e.g. using 10,000 per month as an average cost per consultant, if their bank statement shows payments of $100K in a month, that means they have approx. 10 consultants).

   • Also ask for a list of new consultants they have placed in the last 12 months. This will help you understand the “volume” of business they do on an active basis. For example, if they have 100 consultants currently, but placed 10 in last 6 months (meaning 90 of them were placed more than 6 months back), that does not demonstrate an “active” recruiting team, just shows long term engagements.

3. Recruiting Process
   • Identify the depth of their process and the quality checkpoints.

   • Ask them types of questions they ask candidates during the recruitment and screening process

   • Ask about their candidate interview process. In IT industry, it is very common for consultants to be located in different states, where an in-person meeting is not feasible. Your vendors should be interviewing these candidates using some video conferencing technology. See related article “11 tips on hiring and IT Consultant”.

   • Ask sources of recruitment (e.g. online job boards, internal databases, referrals etc.). If they are able to substantiate 10%+ hires via referrals, you will have access to candidates not easily available to their competitors.

4. Financial health
   • This is very important as temporary staff gets paid by the staffing services provider, and there are co-employment and other legal issues at stake. There have been cases where you need data from a vendor going several years back. Therefore, you need to deal with a vendor who has good chances of surviving through all kinds of economic cycles.

   • Ask for their Revenues, P&L statement, Balance Sheet etc. A reliable vendor should be profitable, but profit should not be high like 30% of the revenues. Ideal vendors will have profit between 5% to 15% of revenues. Anything less implies “risk” and anything more implies “fat margins”.

   • If you want to be extremely thorough, ask them for some proof. Once again, bank statements can show a lot, but not many vendors will be willing to share this data.

5. Candidate Payment Process
   • Assure and impose process for candidate payments. Regardless of who employs the candidate, the candidate should be getting paid once every two weeks, and no later than once a month. If candidate does not get paid at least once a month, they will leave.

   • In worst case scenario, the vendor should be paying their subcontractors within 5 business days of receiving payment from you, the client organization. (Note: subcontractor is not same as consultant working at your site)

6. Co-Employment Issues
   • What checks are in place, in case a government audit is requested, the client company does not end up being recorded as candidate’s “employer”. There was a case a few years back, when Microsoft fought a battle with government entities on this issue. You want to assure that you are taking appropriate measure to protect your company.

7. Markups and Costs
   • Understand the vendor’s markups and costs (i.e. how much do they markup after all their costs). Know about vendor costs, as each vendor has different structure. Some vendor offer health benefits / paid vacation etc, whereas others do not. Regardless, there will be some costs such as employment taxes, workers compensation and other state mandated statutory costs. Ask them for breakdown of these costs. When doing this analysis, keep in some IT candidates you hire will not be employed by the vendor you deal with, but another subcontractor (which is acceptable and encouraged - see related article “11 tips on hiring and IT Consultant”). Typical markup are in the 25% to 50% ranges, depending on benefits, costs and other variables.

8. Industry affiliations
   • Is the vendor affiliated with an accredited industry staffing association? If yes, you have some confidence that they are aware of trends, laws and best practices. If they are not, you should ask yourself “why”. Why is this vendor not willing to invest in themselves?

   • Ask for technology vendor partnerships e.g. IBM, Oracle, Microsoft etc. While this is not critical, it will help you understand the vendor’s specialties. If they are associated with some technology vendor as a partner, ask if candidates have access to exclusive learning material and training provided by these industry partners

9. Timesheets and Invoicing
   • Ask about their timesheet collection / time reporting and invoicing process. If you, as a client, already use an internal time reporting application, ask the vendor if they will accept this data, which will remove the headache of consultants working at your site of by filling out multiple timesheets.

10. Temp to Perm Conversion
   • Ask the vendor of their policies regarding hiring their consultant as your employee. You should be aware that many times the consultant is not directly employed by the vendor you are dealing with, and the vendor may have “non-solicitation” clauses with their subcontractors. Don’t impose Temp to Perm conversion, as that will limit access to good talent. But it is important for you to know what you are getting.

11. Vendor Pool
   • Ask about their experience when competing with other vendors. Ideally, you as a client, depending on your company size, would want to have between 5 to 25 active vendors. If you have less than 5, you may not be accessing a large enough candidate pool, and if you have more than 25, your vendors are not very motivated to work in an environment with excessive competition. You need to find a balance, and need to work with a vendor that has experience in environment such as your.

12. Post-Sale Follow Up
   • What is the process of vendor follow ups, after they place a consultant?
Good vendors should have a process for consultant and client follow ups, like 30-day, 6 month, and one year? In addition, senior management should meet with you at least once a year, with quarterly in-person meetings with your account manager.

To summarize, identify the pain points of your current job. If having inadequate IT staff is amongst the top 3 reasons of your current challenges, you need to invest time in forming, screening, developing and maintaining relationships with the right staffing partners.

9 Comments

What is Google Glass and how does it fit in business environment?

6/30/2014

1 Comment

Google Glass is one of the more popular wearable technologies on the horizon. It sits on your face just like a pair of glasses. A glass prism sits right above the eye on the right side of the frame. Some people question if the glass prism creates an obstacle in front of the eye, but it sits above the eye and isn't intrusive. As a matter of fact, you can't see the glass image if you sit the frame too low on the face due to the angle that directs light to the eye.

Glass uses your smartphone's Bluetooth connection to synchronize your data. You use your smartphone's hotspot to connect Glass to the Internet. Because Glass is a wearable computer, it needs storage space. You get 16GB of storage space for videos, images and apps.

Google Glass is still in its beta stage, which Google calls "Explorer." You need an invite to get a pair of Google Glasses, and just being a beta tester costs you $1500 plus shipping expenses. Glass is wearable technology, which isn't at all innovative today, but the way Google Glass works is brilliantly different from any of its predecessors.

Glass was a catalyst for several app ideas for the visually impaired. The glass prism displays a clear image into the eye that can be used to help people identify unseen objects around them. Glass uses voice commands, so the wearer can take video and images without using his hands.

Some people criticize Glass as a hobbyist's toy, but it has potential and enough testers to possibly become the next wearable computer that people won't leave home without. It could even improve the lives of people with disabilities.

But is Google Glass only an end-consumer item? When smartphones and other tablets initially showed up, consumers were the first adopters. This also allowed the manufacturers to tweak their technologies, and allowed software developers to create useful apps for the business environment. With a plethora of apps now available, these devices have become a “Corporate” item. We have witnessed these devices in use in various corporate environments already. Any corporate websites built these days typically have to go through mobile/tablet testing, which means that corporate decision makers acknowledge that users will use their websites using mobile devices.

I see similar future for Google Glass. I’ve already heard apps being developed for the Glass platform that include GPS, iPod like music player, texting, personal fitness, sports simulation and others. They all typically fall under “consumer” space. But that’s no different from smartphones and tablets when they were first introduced. So how will Corporate America use these new wearable devices? Some ideas I foresee that could translate to business apps include a Presentation Projector, corporate database information lookup, inventory check-in/checkout in a warehouse environment (with a built in bar code reader add-on), and lets not forget the all important app “reading corporate emails”.

While I don’t see Google Glass in an office/desk environment, but I see uses for this device in mobile/active workforce not tied to a desk like me :-)But then again, when I am at my desk, I am typically using a PC, but when away from my desk, I do find myself using my smartphone and tablet devices.

So IT managers should get ready to handle more ‘wearable technology’ devices and integrating them with your current IT infrastructure.

What do you think?

1 Comment

11 Tips on hiring an IT Consultant

6/30/2014

39 Comments

In the last two weeks I had 6 conversations with our current and prospect clients who discussed their challenges when hiring an IT Consultant. There was one clear theme. They all 'interviewed' the submitted Contractor candidates for technical skills, focusing on the technical nuts and bolts. But 5 out of 6 had poor experiences with the performance after the consultant was on-boarded on the project. Does this sound like you?

You've screened them for Technical, Business and Interpersonal skills. But are you done? There are many other steps you should be considering, including

1 - Do you check how many layers of vendors are there between you (the client) and the actual individual who will be performing services for you. I feel the number should be 1 or 2. I've heard some of my clients voice that the number should only be 1, to which I disagree. No one vendor has access to all Consultant resources, and they frequently work with subcontractors with certain niche skill sets. These vendors have invested time and resources into building a realtionship with, and screening from a large pool of subcontractors. So if you believe that the layer number should be only 1, you may be missing out on a larger talent pool available through the vendor's subcontractor network.

2 - Did you do only conduct Phone interview? We've heard stories of "Bait and Switch" i.e. a client interviews a candidate on the phone, hires the candidate, but a different candidate shows up on their first day. I understand that there are issues interviewing candidates who are located on the opposite side of the country. My in my experience, video interviews using free technology like Skype has proven beneficial. You may use Skype video + telephone simulataneously (disable Skype audio, or putting your PC speakers down), to improve the interview experience. There are other 'pay for' solutions available for video interviews. Which one you use is less important than using one.

3 - Did you give them an Online Technical Test - Again, I have heard stories of "Bait and Switch". One candidate takes the online test, and a different candidate shows on their first day. Considering the scenario that the candidate may be located on the opposite side of the country, what are you supposed to do? I personally like interviewing candidates and asking them questions for which there are no online tests. I talk to them about my project, and explain to them one particular issue I may be having. I look for their thought process, mastery of overall subject. I give them points even if the answer to the problem is incorrect, as long as they show their mastery of the subject matter. Why? I feel anyone can Google any question, and find the correct answer. What I am looking for is not the correct syntax for a line of code, but their ability to understand a problem, and then their thought process on their approach to solving the problem

4 - There have been some projects where my needs were to screen candidates for the 'syntax'. In this case, Id did a screen share with them - and showed them our code. And them I let them control my PC. What I was looking for was to see how quickly they can grasp the code. Then I asked them for suggestions on improving the code. I felt this process assessed their critical thinking, and problem solving skills.

5 - Where's their immediate family / spouse / children etc. Does their spouse work? What I learnt was most of us are not single and have some attachments to some people in our lives. I've noticed that when you remove people from these attachments, and the distance is large, there is turnover. So this is something I am always curious about

6 - Don't waste time on Reference checks - I feel 7 out of 10 candidates give references of people who will give them good references. So if you want to ask a reference "How were they at their job" expect an answer "Great". While I still see a value of reference checks, but getting accurate references can sometimes be very difficult. Sometimes insisting on this has resulted in me loosing some good candidates, where my competition hired that resource before I could finish reference checks. So if I have a need to check references, and I absolutely can't do without it, I would look at employers/projects where a candidate may have worked, and do my independent investigation on the candidate, calling people from my personal network, rather than relying on a reference provided by a candidate.

7 - Impose minimum wage rate to the actual assigned personnel working on your site. If the vendor tells you a bill rate of $100/hr. but is paying the assigned personnel $25/hr., you can bet that you will not have that candidate working at your site for too long. The candidate will soon find another opportunity that pays them a fair market value. Most consultants are fairly well educated about their market value, but sometimes circumstances lead them to 'accept' your assignment, only to see them leave within a couple of months. So I like to see in my contracts that the assigned personnel is getting paid a fair market value, which could vary between 40% to 80% of the bill rate (depending on layers, and whether you are hiring a Deloitte consultant or an IIT Consultant). I wouldn't impose on vendors a number like 80%, but different vendors have different costs. But sometimes I do ask them about their costs, and what percent of bill rate goes to the assigned personnel. My vendors work hard, and they deserve to make a living, and as long as I get a fair rate, I just want them not to abuse the assigned personnel.

8 - Ask candidates if they have any planned time off / vacations. This area is sometimes overlooked. Imagine hiring a consultant, who has a wedding planned right when you have your major roll out planned.

9 - Honestly identify who you 'really' are - Is your company a Tier-1 player, Tier-2 player etc... hire a consultant at the same level as you.. Lets say you are Google or Apple, then you can afford to hire a Tier-1 consultant. But if you are not, and want longevity in assigned personnel, get realistic about your expectations. I feel you can hire mediocre people, put them in a good environment with excellent processes, and receive 'superior' work. So invest in your process, culture and environment, and hire personnel that are a good fit. And in many circumstances, superstars are not a good fit in various environments.

10 - Don't hire friends / family / close referrals.. They are hard to fire.. I don't think I need to comment more on this subject

11 - Give interviewed candidate a takeaway question, and ask them to email you back with a response (don't propose a deadline) (see how soon they respond, and look at quality of their written and their analytical skills further)

I am sure there are many other ideas out there, to improve this process further. Do you have one?

39 Comments

4 Tips to improve Windows 8 performance

6/29/2014

0 Comments

Upgrading to a new operating system is a major undertaking for the enterprises. While IT managers are concerned with deployment and integration, rolling out Windows 8 in the enterprise comes with its own challenges. While the underlying code on Windows 8 is inherited from its predecessor Windows 7 architecture, Windows 8 presents a significantly revised user interface demonstrating Microsoft’s push to make its platforms relevant on mobile devices.

From an end user perspective, IT managers need to be concerned about training end users on the new interface, as well as delivering an improved user experience for best adoption of the new platforms.

This article focuses on improving user experience, via improved performance at the desktop level.

Windows 7 was an operating system that provided a significant increase in performance over previous Windows iterations. Windows 8, the successor to Windows 7, has been designed to provide an even bigger increase in performance due to efficient memory and CPU management. However, you will not see much of a boost in performance if you are running Windows 8 on a low-end computer or laptop. Fortunately, you can make Windows 8 run much faster by tweaking certain aspects of the operating system.

Windows 8 has let go of a number of visual effects that were found in Windows 7, but it still has enough effects left to cause a major strain on memory and processing power. If you are experiencing screen tearing and lag when opening, closing or moving applications around the screen, your computer may not have the resources available to run the default user interface normally. This issue can be remedied by using a built-in configuration tool named Performance Options. To open Performance Options, go to “Search” on the Charms Bar, select “Settings” and then enter “Performance Tools” into the search box. Now select “Performance and Information Tools” to open Performance Options. Next, select the “Visual Effects” tab, then click the radio button next to “Adjust for best performance.” Click “Apply” to save the changes. Applications will now start to run faster due to the freed up memory and processing power that were previously dedicated for visual effects.

Defragmenting your hard drive using a disk defragmenter is another great way to make Windows 8 run faster on older hardware. Grouping together file fragments makes it easier for the hard drive to access data, therefore speeding up data transfer rates considerably. Windows 8 comes with a built-in disk defragmenter that has the ability to defragment select partitions. To get to the disk defragmenter, open File Explorer and click “Computer” on the left-side navigation pane. Right click the partition that contains the Windows 8 installation and select “Properties.” Now select the “Tools” tab and click “Optimize.” Once again, select the Windows 8 partition on the “Optimize Drives” window and click “Optimize” to defragment the partition.

If you had used Windows 8 for some time, you would have noticed the User Account Control notifications that pop up whenever you make changes to applications or important system files. These notifications are accompanied by a dimming effect that taxes the resources on older hardware. Fortunately, you can lower the amount of UAC notifications that show up by changing the UAC security level. First, open the “Charms Bar” and select “Search.” Click “Settings” and type “User Account Control” into the search box. Now press “Enter” to open the User Account Control Settings window. Move the slider to a level below the default security level and click “OK.”

Running your computer on the latest drivers available can also create a huge impact on performance. Using the latest drivers for your video card and motherboard not only increases your computer’s performance, but also fixes issues that were present in older drivers. Windows 8 comes included with drivers for most hardware devices, but using latest drivers downloaded directly from a device manufacturer’s website provides additional configuration tools that you can use get the maximum performance from each device.

Disclaimer: This article and other articles provided on this electronic medium is not intended to be an advise of any kind, and provided by IIT Inc. as a value to our readers in a form of information and discussion. We recommend verifying this information, and performing your own analysis prior to using any information provided herein.

0 Comments

7 Tips to Harden Your Apache Installation on Linux

6/27/2014

1 Comment

Hackers are constantly discovering ways to gain access to Web servers to send spam, launch synchronized attacks on other servers, steal personal information and deface websites. Because Apache is the most commonly used Web server software, hackers focus many of their efforts on trying to discover vulnerabilities they can leverage on an Apache server. After you install Apache from the default APT package on Debian or Ubuntu, or from the default Yum package on Red Hat, CentOS or Fedora, you can strengthen the security of your installation with these seven tips to harden your Apache Web server.

1.      Keep Your OS Updated. The Apache community is very active and alert to security issues. Make sure that you frequently apply patches for your operating system, which will include security patches for Apache. Update your installation with either Apt or Yum:

apt-get update && apt-get upgrade (Debian/Ubuntu)

yum update (RHEL/CentOS/Fedora)



2.      Suppress OS Information When Errors Occur. When an error occurs, the default behavior in Apache is to display the Apache version and the operating system flavor and version, for example, "Apache2/2.22 (Debian) Server at 10.16.2.100 Port 80." This gives hackers valuable information they don't need to know. To suppress this information, edit your Apache configuration file:

           /etc/apache2/apache2.conf (Debian/Ubuntu)

           /etc/httpd/conf/httpd.conf (RHEL/CentOS/Fedora)

Add the following two settings:

           ServerSignature Off

           ServerTokens Prod

And restart your server:

           /etc/init.d/apache2 restart (Debian/Ubuntu)

           service httpd restart (RHEL/CentOS/Fedora)

             3.      Turn Off Directory Listings. If a visitor navigates to a Web page that doesn't have an index.html, index.php or other valid index file, Apache displays a list of all files in the directory to the visitor. The visitor who can click to open each file and use the listing to navigate the file system on the server. Disable this option using an Options directive in your Apache configuration file:

           <Directory /var/www>

     Options -Indexes

           </Directory>

           4.      Disable the Trace HTTP Request. In a cross-site scripting attack, a hacker can trick the HTTP Trace request into displaying the HTTP cookies to steal the session. Disable the option by editing your Apache configuration file:

           /etc/apache2/apache2.conf (Debian/Ubuntu)

           /etc/httpd/conf/httpd.conf (RHEL/CentOS/Fedora)

Add the following setting:

           TraceEnable Off

And restart your server:

           /etc/init.d/apache2 restart (Debian/Ubuntu)

           service httpd restart (RHEL/CentOS/Fedora)

               5.      Protect Your Root Directory. A website visitor should never have access to your root directory. If a hacker finds his way there, protect the directory with the Order option:

           <Directory />

                 AllowOverride None

       Order deny,allow

       Deny from all

           </Directory>

6.      Disable unnecessary modules. More modules mean more ways for a hacker to exploit your system. Generate a list of modules that are enabled:            cat /etc/apache2/mods-enabled (Debian/Ubuntu)

           grep LoadModule /etc/httpd/conf/httpd.conf (RHEL/CentOS/Fedora)

Disable the modules you don't need:

           unlink /etc/apache/mods-enabled/<module>.so (Debian/Ubuntu)

           vim /etc/httpd/conf/httpd.conf and prefix the LoadModule line with a "#" (RHEL/CentOS/Fedora)

Then restart your server:

           /etc/init.d/apache2 restart (Debian/Ubuntu)

           service httpd restart (RHEL/CentOS/Fedora)

Some modules you might not need include autoindex, include, imap, info, suexec, and userdir.

7.      Limit outgoing connections. An Apache server should have very few instances where it needs to initiate a connection. Use IPTABLES to place Apache output connections in a specific chain, and only accept the connections on valid ports. For example, to reject all outgoing connections except outgoing email on ports 25 and 143 use the following iptables configuration:

            iptables --new-chain apache2_out

            iptables --append OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

            iptables --append OUTPUT -m owner --uid-owner <user> -j apache2_out

            iptables --append apache2_out -p tcp --syn -d 127.0.0.1 --dport 25 -j RETURN

            iptables --append apache2_out -p tcp --syn -d 127.0.0.1 --dport 143 -j RETURN

            iptables --append apache2_out -j REJECT

Substitute www-data for <user> on Debian/Ubuntu or nobody for <user> on RHEL/CentOS/Fedora.

Then restart IPTABLES:

           /etc/init.d/iptables restart (Debian/Ubuntu)

           service iptables restart (RHEL/CentOS/Fedora)

Disclaimer: This article and other articles provided on this electronic medium is not intended to be an advise of any kind, and provided by IIT Inc. as a value to our readers in a form of information and discussion. We recommend verifying this information, and performing your own analysis prior to using any information provided herein.

1 Comment

Let’s Discuss Net Neutrality

5/29/2014

0 Comments

Net Neutrality means that the ISP gives identical access to each packet of information (those little bits and bytes) travelling on the Internet backbone, disregarding the origin of the packet. That means ISP does not interfere whether the information originated from Amazon, Facebook, Twitter, your Corporate Servers or Netflix.

Various Internet Service Providers (ISPs) are pushing to take control of the internet traffic, and manipulate it as they see fit.

Since ISPs are the last segment on various hops information and data takes, from its origination, before getting to the end customer (you), the ISPs want to control how fast they deliver the information to you, depending on information's origin and information type.

According to some reports, video and other streaming services, like the ones offered by NetFlix, Amazon and Youtube, consume a third of total available internet bandwidth. This fluctuates depending on time of the day (more streaming traffic during evenings), slowing down other users not streaming videos etc. There have been some news that an ISP took efforts to slow down video streaming, causing 'buffering' errors when the end users were trying to watch online videos. This manipulation by ISP created a debate, whether ISPs have the right to create special fast lanes or slow lanes on the information highway.

While I have my opinions, I can see both sides of the argument. Let’s use some analogies to discuss this argument.

One example that comes to mind is E-ZPass (those electronic devices installed in our cars, that allow us to go through faster lanes on a highway). I recall when E-ZPass was first rolled out, drivers paid less to go thru toll lanes with E-ZPass. Drivers saved money as well as the toll collectors, as they needed to deploy less personnel to collect those tolls. That seemed to be a win-win scenario, which also laid the ground work for a fast adoption of the E-ZPass technology. Then the toll collectors got smart. They started charging the same toll, whether you paid cash or whether use you used E-ZPass. Drivers still continued using these devices as they were hooked on the convenience factor. Is there some parallel between E-ZPass and Net Neutrality?

Another example I can think of is equivalent of “Fast Pass” used in Amusement Parks like Six Flags and Disney’s attractions in Florida. These parks offer regular tickets, where customers have to stand in long lines before entering an attraction. They also offer, for an additional cost, “Fast Pass”. These are frequently more than the actual price of the admission to the park. There are customers for both – customers who buy regular priced tickets and choose to stand in long lines, as well as “Fast Pass” customers who are willing to pay extra, for the convenience of standing in much shorter lines, thereby improving their experience of the “day at the park”. Is there some parallel between Fast-Pass and Net Neutrality?

One difference I can see between above examples and Net Neutrality is that Internet was founded and promoted “initially” by US Government, whereas above examples involve “initial” services from the private sector. While private sector has certain amount of freedom on how it charges its customers, and “menu” of services it chooses to offer its customers, public sector domain is frequently bound by laws. However, while the internet may have been a gift from the public sector, it would be an understatement to say that the private sector commercial enterprises dictate the functioning of the internet as it exists today.

A couple of related comments below from Wikipedia

“Neutrality proponents claim that telecom companies seek to impose a tiered service model in order to control the pipeline and thereby remove competition, create artificial scarcity, and oblige subscribers to buy their otherwise uncompetitive services”
“Opponents of net neutrality claim that broadband service providers have no plans to block content or degrade network performance. Despite this claim, there has been a single case where an Internet service provider, Comcast, intentionally slowed peer-to-peer (P2P) communications. Still, other companies have begun to use deep packet inspection to discriminate against P2P, FTP, and online games, instituting a cell-phone style billing system of overages, free-to-telecom "value added" services, and bundling”

While I will restrict my opinions on the issue itself, I feel confident to say that “Attorneys from commercial enterprises will keep fighting this issue until they win. There is too much money at stake. Net neutrality will be a thing of the past. I give it three years.”

What do you think?

0 Comments