Many of you have been calling or emailing me about the new version 8.0 of AVG.

AVG does this once or twice a year where it will ask you to “upgrade”. During this upgrade AVG will take the opportunity to try and up sell you to a paid version of their product. This is a question of conscious. In my opinion, AVG makes a fine anti-virus product, however, if you are going to PAY for an anti-virus product there are better ones on the market. AVG does allow you to continue to use their free version, and if you read each screen in the “upgrade” process carefully you will see links to the free version.

However to short cut all of this I have put a copy of AVG Free up on the TaborCG website under the “Software” section.

If you like, you can download it from there and install it on your system. The installation is straight forward, read each screen and click “next”. The only two things I would suggest are to select “Standard Install” (which is default), and to uncheck the box when it asks you is you want to install the AVG Toolbar (because adding extra toolbars is just dumb).

After the install, the software will ask you some configuration questions. I recommend you set the daily scan to happen at 2:00am, and that you NOT register the software. Everything else, just leave as default.

The install will overwrite AVG Free 7.5 automatically and after the restart you’ll have the new version.

The Look and Feel of AVG 8.0 is different than AVG 7.5, I have to say I kind of like it.

Recently I have been working on different types of encryption. Back in March
on all the Systems at TCG we complete a project to do whole drive encryption. I’ve
been happy to report that after some time of operation, these experiments have gone
incredibly well. We have been running whole drive encryption on all systems with
no loss in speed or data. The only unexpected thing we came across was doing
complete upgrades. In the past when we have needed a larger hard drive in
a system, we have done one of two things. First and easiest, we use a program
nominally called “Ghost” which copies all the data as a block. With this process
you simply do a mirror copy of the old drive, but leave free the larger space
on the new drive. We also have used this time to keep a whole image back-
up of the drive for backup proposes. If we feel that enough time has passed however,
sometimes we elect to uses another choice in drive upgrading. Microsoft
encourages Windows users to format an reinstall thier OS on a 18 month cycle,
especially if the user installs and uninstalls a lot of software, which we do. We will
take the new drive opportunely to do a fresh install of Windows. In all cases, the old
hard drives are “Quarantined” for a period of no less than 90 days in our vault, to
insure a smooth transition and no data loss. Regardless of how many times we do this,
sometimes thing to not get copied over. Better to be safe than sorry.

Most ironically, the thing we encountered when trying to Ghost with whole drive
encryption is that you have to “decrypt” the drive before using our copy tools.
Subsequently then we would have to re-encrypt the new drive and/or the old one before
sending them to either the vault, or back into production. These additional setups add
an overnight element or two to the process, but I think it’s a small price to pay for the
greatly added security.

Encryption now has a new dimension. One of the down sides to encryption is that it
is recognizable to a person who knows what they are looking at. So while your data is
absolutely secure, it is pretty obvious that you have something to hide. I think it’s a sad com-
mentary on our society that we feel as if a person with something to hide is guilty of some
type of crime, but unfortunately that is a common perception. Times are changing, there is
hope. I feel that much like the ideology racism, this perception of guilt is slowly fading.
in the mean time until such perceptions do change, the art of “hiding” data may be just as
necessary as encrypting data. I have been working on in acutely not much encryption but
kind of “hiding” messages, especially in plain sight. This is both a software problem and social
intrigue exercises. Hiding a message is only as good as both parties KNOW where to look for the
nefarious text. Of course the best way to do this would be to both encrypt and then hide, thus
greatly deceasing the odds of discovery.

Our jewel of tools, Truecrypt, has a feature of Hidden Volumes and Plausible Deniability. Un-
fortunately, this does not extend to whole drive encryption. It would be very cool with this for
you to be able to “boot” a hidden “safe” area on a laptop that would be sanitized for public
observation, but that feature is not yet in Truecrypt. In most cases of targeted data theft or
unwanted data search, the opposition does not have enough time to inspect every file.

My quest for hidden data has leaded me to look into a technology called Steganography.
Conceptually, the ideal is to “hide” data within data. Mostly in the Internet world this
has involved hiding text inside of Jpeg Images. But there are other program to hide
text inside of MP3s, move files, or my favorite, hiding clear text inside of clear text.

I have started to use a new open source program called “TrueCrypt” and I wanted to share some of my first impressions.

Data protection is quickly becoming the number one priority in computer security. In fact it could be argued that the data carried on your computer is more valuable than the computer itself. For example, last year the Nashville Election Commission had stolen a laptop containing data on every Nashville voter. With this data a criminal could have assumed the identify of any Nashville voter and done any of the typical “identify theft” things such as opened credit card accounts under that ID, opened/closed utilities, etc, etc. Fortunately Nashville got the laptop back, but the other data loss situations are popping up all the time.

It’s a fact of life that someone is going to lose a computer component that will have sensitive data on it. Be it a laptop, desktop hard drive, backup tape, or USB thumb drive, accidental loss or just plan theft will occur. Of course when that laptop is stolen, did the thief just steal it to pawn for drug money, or was it a calculated attack aim at getting sensitive data? Who’s to say that even if it did get pawned, what if the new owner finds the data and sells it? The only sure defense for your data is to encrypt it, and that is what TrueCrypt does.

TrueCrypt takes different approaches to how it encrypts your data. One method is the concept of using a “virtual drive” or “drive image”. Basically, a “virtual drive” or “drive image” is a file on the hard drive which the OS (Windows in this case) “mounts” as a normal drive in and of itself. So the file in My Documents called “Some_cd_image.iso” is mounted to look like it’s the “L:” Drive. Any data read or written to the “L:” Drive actually goes into “Some_cd_image.iso” in My Documents. Mac users are more accustom to this concept because Mac Software from the Internet is generally distributed using a “.dmg” file, which is a drive image. People who “back up” there CD ROMs also work with drive images, because those backups are simply sector-by-sector image copies of the original optical disk. But I digress.

One method for TrueCrypt is to create a file which is then mounted as a drive image. TrueCrypt will then automatically encrypt and decrypt data as it written or read from the “drive”/file.

TrueCrypt can also encrypt whole drives, so rather than having an encrypted file which is then mounted as a virtual drive, you can choose to encrypt an entire thumb drive, or a second hard disk. Again, once the drive in created and mounted, you can read and write data to it just like any drive. TrueCrypt handles the encryption and decryption automatically.

TrueCrypt also has a “whole drive encryption” feature for the system drive. This is the really COOL feature in which you can encrypt your ENTIRE computer. When your computer boots, TrueCrypt will ask for a password (this is the encryption key), after you enter the correct password, your system will boot and run as normal. If your computer is lost or stolen, your data is safe. TrueCrypt isn’t a password, it’s encryption, so even if they thief took the hard drive out and put it into a another system, they would not be able to “see” any of the data on it. Because you only have to enter your password at boot time, there is no consent “in-your-face” element to TrueCrypt, all new data, email, or programs, you put on your system are safe.

TrueCrypt also has some other features which I really like.

1. Total lack of data structure in a secured file. This means that if you had a file you mounted as a drive image, there is no way for anyone to tell what exactly that file is or how full that “virtual drive” might be without knowing your encryption key (password). In fact, a TrueCrypt file is nothing more than random “noise” before you use your encryption key, thus someone could not actually PROVE that the file they are looking at is even an encrypted file.
2. Hidden Volumes and Plausible Deniability. TrueCrypt lets you create a “file within a file”. Let’s say that you have a situation where you are forced by some means to give over your encryption key (password). There are many far-fetched examples on why this would happen such as “someone has a gun to your head”. However a more realistic example would be “you are under court order to turn over a password”. With Hidden Volumes and Plausible Deniability you could have 2 passwords, one opens up your real secret stuff, the other opens up somewhat secret stuff. If forced you simply give up the “somewhat secret stuff” password. There is NO technical way to prove that you gave up the wrong one.
3. Key Files. These are files which you can use in place of, or along with, a password. For example, you have a picture, or ten pictures, which you can use as “passwords”. You simply tell TrueCrypt to use the “hashed sums” from that or those image files as the password. A “hashed sum” is a mathematical representation of a computer file which is always the same so long as the file does not change. What makes the use of “hashed sums” of key files interesting is that you can avoid using the keyboard to input the key to unlock your data. Criminals have used “key board loggers” which record every key stroke to record passwords from victim’s computers.

I have really stared to beat the drum about security with my clients here at TCG. TrueCrypt is perhaps the best tool I have found thus far for the lay-person to help guard against data theft.

Exchange is Microsoft’s “Messaging and Collaboration” server. In plain English, Exchange is the server which an office can use to receive e-mail and share address books and schedules with each other. It is quite possibly the single best product offered by Microsoft, and the one that works most reliably.

Most people think of e-mail in the POP3 dial-up ISP model. They open up their e-mail program and “download” messages from the internet to Outlook Express or Mail.app. Of course anyone who has tried to use the same e-mail address from the office and from home knows the great limiting factor. If you download a message at the office, you won’t have access to it at home or vice-versa. There have been several “hacks” over the years to try and get around this, the most notable one being “leave a copy of mail on server”. But here you are forced to sort through mail that you may or may not have read, and you do not have access to messages to may have already sent, or that you were in the process of writing. The final great downside to this style of e-mail is that you must have an e-mail program configured for each place you may want to get you mail. For most business professionals this turns out to be 3 places, office, home, laptop.

One way of addressing these problems has been the rise of wed based e-mail, yahoo.com, hotmail.com, and gmail.com. While these fix most of the problems with the POP3 model, they still have a few serious drawbacks. Chief of which is that they are not corporate e-mail systems. You lose the professional face of joe.user@mycompany.com in favor of finding an awkward e-mail address with the service, juser-mycomp1977@gmail.com. I cannot over state how deeply unprofessional it is for me to get a business card with an “@aol.com”, or “@gmail.com” address. There are again “hacks” to make web based systems look more corporate, but these systems are still “single user” and thus sharing your data across the office is not easily done.

Enter Microsoft Exchange. Exchange has solved the problem of multiple locations (work, home, road), and the problem of installed software (Exchange can be accessed from either Outlook or via a web browser). Exchange also has the advantage of being a corporate e-mail system (i.e. @mycompany.com), and allowing each user of the server to share out his or her address book and schedule so that other people in the office know what’s going on. Except for answering the phone, it’s about the only communication service/server you will ever need.

Exchange also has a mobile e-mail access feature which is exactly like ubiquitous Blackberry, but without the ridiculous Blackberry costs. Microsoft calls this “Push Email”. A message sent to joe.user@mycompany.com not only shows up in Joes Outlook Inbox, but also a copy is sent to his Windows Mobile Phone. If he reads the e-mail on his phone, the message is marked as read when he sits down at his computer. If he replies to the e-mail from his phone, then the reply is also in his Outlook folders for him to refer back to.

In fact it is the sync of Exchange that is its greatest virtue. No mater were you use it from, Mobile, Outlook, Office, Home, or via the Web, it always looks the same, has the same messages, and the same read/not-read statuses. The Contacts and Calendars are the same. In fact address books and schedules are automatically synced to your cell phone over the air. This means that if you enter an address in Outlook it will be on your phone (no more tying to type in a name and number of the keypad). If you run into someone and schedule a meeting while waiting in line at the post office, you can put that meeting right into your cell phone and then it will show up at the office. No need to plug in your phone to your computer, it just works.

Exchange is not at all expensive. A typical small office can have all of the virtues of exchange, for less than $1500. There are some additional “data plan” coasts from the cell phone provider if you want to use Push e-mail, but those are only $10 to $15 a month depending on carrier, where Blackberry services can be $50 per-month in total or more. Of course your office will also have to have internet access via broadband.

I’m really enjoying working with Word Press. Long I have searched for a good CMS (content management system), and this seems to be the one I’ve liked best. Even though my team and I have work on our own in house CMS for now 5 years, I am seriously considering moving new web projects to WP. We can focus our design efforts on the visual front end, using WP theme system, and let clients manage their own data input through the page and blog system.

Some of the advantages of WP I’ve seen thus far are:

1. Fully installable on our servers, we (clients and us) control the content, no relying on third parties which may or may not be there a year from now
2. Highly customizable, both on a visual level and a technical level.
3. Highly extendable via plugins/widgets
4. It’s free and Open Source, no additional cost to the client
5. It’s LAMP (Linux, Apache, MySQL, PHP), no Windows Server Complications
6. Very eye candy, for those who are impressed by such trivial things

The TCG Site is now fully under its management with our custom work. Let’s see how it works.

I’ve been working on an update to our local Hospice’s site, and I’m leaning to using WP for Article Publishing and Events Calendar Management. It will be a good test of the system to see if we can take a WP CMS site and “module” it into our existing home grown framework.

I Love My Job!