Windows 7: The 10 Things to Do First for Windows 7: "
Getting ready for Windows 7 may seem like a Herculean job—but there are plenty of ways to maximize the OS’s new features while minimizing disruptions in your organization. This offer spells out 10 steps that can help streamline your efforts and smooth the transition.
Bill Boswell
"(Via TechNet Magazine: RSS Feed.)
Distinctive S.F. neighborhood restaurants: "San Francisco is defined by neighborhoods, each with a distinctive character. One of the best ways to get a taste of each area is through the restaurants. Following are restaurants that capture the spirit of their locale. Pacific Heights and Presidio Heights...
"
(Via SF Gate BayArea.)
Article: The Complete Guide to Managing iTunes Videos: "In late 2005, Apple added video capabilities to the fifth-generation iPod - a long-awaited step for the world’s most popular music player. But with this change came a need for iTunes to manage video content, especially videos that users added by themselves rather than downloading from Apple’s international iTunes Stores. The problem was, and is, simple: most iPod owners outside the United States have very limited access to Apple-provided…
Fun ways to transform your face online: "If you're looking to find unique ways to share your photo with friends and family online, look no further than our roundup. We list the right tools to make it happen."
(Via Cnet.)
In Depth: How computer viruses work: "
All of us know the importance of having adequate antivirus protection before venturing online. But how exactly does a virus work?
What makes viruses differ from worms, and how has the sophistication of both increased over the years?
Ever since it started to develop alongside the first home computers, malware has become an increasingly virulent and ingenious threat. But that threat is evolving fast.
Nowadays, it's not only internet users who are at risk, but also website owners, whose poorly written web applications are being exploited and used to plant malicious code that infects others through the browser.
Vectors of infection
There's a saying in nursing that 'germs don't jump'. That is, they can't escape the Petri dish and spread by themselves. Human viruses such as influenza, for example, require poor hygiene to help them spread. This is called an 'infection vector'.
In a similar way, computer viruses need to be shifted from one place to another by users, accidentally or not.
When the first modern viruses hit home computers in the 1980s, the infection vector was the boot sector of floppy disks. One of the first such viruses was Elk Cloner, which was written in 1981 by a 15-year-old high school student from Pittsburgh, Rich Skrenta.
Elk Cloner lived in the boot sector of Apple II system disks. When the machine booted up using an infected floppy disk, it would run as part of the operating system and then stay running, watching for the insertion of any subsequent disks.
This form of operation makes it a 'resident' virus. When a second user booted his own machine with the copied disk, the virus would run on that system, too. With every fiftieth boot of an infected machine, Elk Cloner would display a little poem. This was the virus's 'payload'.
ELK CLONER: Ironically, one of the first 'viruses' was written for the Apple II
The subroutine within Elk Cloner that watched for a new floppy disk insertion is now generally known as a 'target locator' (or sometimes a 'finder module'). The target locator in a resident virus waits for the OS to perform a specific task. Executing a file is a good example. When this happens, the target locator knows that the file in question can be infected.
Infection itself is handled by code called the 'infection propagator'. Unlike today, early antivirus software didn't always check RAM properly for resident infections before scanning files, so opening executables to scan them could also infect them.
As well as resident viruses, there are also 'non-resident' viruses. These attach themselves to executables and wait for them to be run.
When the user starts an infected application, the target locator runs first and finds other executables to infect. It then hands control to the infection propagator, which infects the found executables. Finally, the virus hands control to the application as if nothing had happened.
Because of this, reinstalling a fresh copy of an infected application on a system infested with a non-resident virus makes little difference, because it can quickly become reinfected by other applications.
With the rise in popularity of Microsoft Office in the early 1990s, virus programmers began to use another non-resident virus technique. Office documents allow you to embed macros written in Word Basic that run automatically when you open the file. If the macro is malicious, you're in trouble.
This is how the Concept virus of 1995 worked. This virus is thought by some to be the most widespread virus infection of all time. Social engineering has always played a huge part in spreading viruses. Everyone loves free stuff, and virus writers often infect pirated software in order to spread their work. Others write Word documents purporting to contain passwords for porn sites and infect them with macro viruses.
The Melissa virus of 1999 was a good example of this ploy. Its payload tried to mass-mail the infected document to the first 50 people in the infected user's Outlook Express address book.
While true viruses only infect files on a single system (unless users decide to swap files), Melissa could copy itself to new computers without human intervention. Because of this, it's classed as a computer worm.
MELISSA: Modern viruses can not only infect your machine but it could infect everyone in your Outlook file
The same basic technique was used to spread the famous I Love You virus of 2000, whose malicious payload also made changes to infected systems.
In a worm, the target locator might use a variety of techniques to find new machines to infect. It may, for example, raid your address book and send emails to everyone you know containing a copy of itself in an attachment, the Melissa did.
Some target locators generate a range of random IP addresses to try and infect. Others simply raid your computer's DNS cache and hosts file for addresses. Some use all of these techniques and more besides. Once the target locator finds another host running a suitable OS, it passes control to the infection propagator to find an infection vector.
Once a worm infects a new computer, it deploys its payload as well as propagating further. The payload might be something productive – collecting credit card details, perhaps – but many are simply destructive, as was 2004's Witty worm. Its payload deleted sections of the victim's hard disk.
Unlike virus writers, however, worm writers needn't simply fire and forget their work. In the mid-1990s, they began making their progeny call home to receive updates, new payloads and new infection vectors through control modules. And so, the 'botnet' worm was born.
Operated by criminal gangs and often consisting of upwards of a million infected machines, the great skill in creating a botnet is to build a command-and-control structure that's difficult to trace and resilient against attack while simultaneously open for the owner to issue orders, code updates and new payloads at will.
The average computer owner must therefore thwart several decades of continued, and often ingenious, malware development. Here's a technique that can give you 100 per cent protection, even after infection.
A digital Petri dish
We live in a world filled with very tempting free utilities served from obscure websites. However, we also live in a world where it's very easy to infect yourself by making hasty decisions. An abandoned website offering an executable for download offers the virus writer a stationary target.
Hacking the site of someone who has written a cool utility and then lost interest is an excellent way of starting a new worm infection. With the site cracked, the virus writer can infect the utility and re-upload it in place of the original.
If the virus uses a 'zero day' exploit, the infection will go unnoticed until a network security researcher finds it, a patch is released and antivirus companies issue an update.
In the meantime, you have no protection from the virus. Your machine may refuse to boot, your disk may become corrupt or you may be overrun with porn pop-ups. So, how can you protect yourself?
One method is to create a digital Petri dish – in this case a virtual machine that runs one operating system inside another – and run unknown programs in it to see how they behave. If a virus infects the virtual machine, it won't be able to infect the Linux host even if it escapes.
First of all you will need to download and install Sun Microsystem's VirtualBox software so you can run a virtual OS in order to safely test the virus file. However, setting up a virtual machine that will keep the rest of your network safe requires a small amount of configuration.
After you first install Windows into VirtualBox, take a snapshot. This allows you to turn back time at will without having to reinstall Windows. To take a snapshot, power down the virtual machine, select it in VirtualBox and select the Snapshot tab.
Press the button that looks like a camera. In the resultant dialogue box, enter a name and a description and click 'OK'. If you ever need to revert to this snapshot, right-click on it and select 'Revert to current snapshot'.
Before you run an unknown downloaded program, you must make sure that it can't spread any infectious malware to the rest of your network. With the virtual machine stopped, select its Details tab. Scroll down to the Network section and click it.
A dialogue box will open up that displays the details of the emulated network adaptor card. Untick the 'Enable network adaptor' checkbox to disable network activity. Now when you click to install a program, it can't escape the virtual machine.
If you do run into software that infects the virtual system, you can simply roll back to your previous snapshot and start again.
Test your antivirus
After installing or upgrading antivirus software, you need to be sure that it's working properly. However, it would be very foolish indeed to deliberately infect your machine. Luckily, though, there is a safe way to test that your software is identifying viruses correctly: infecting your system with a purpose-built fake virus.
The EICAR virus is a completely benign piece of test code that, if they're installed and working properly, all antivirus products should recognise and report as if it were a real infection, and offer to remove. EICAR stands for the European Institute for Computer Antivirus Research.
The virus that the Institute created is nothing more than a text file, but the viral signature that it carries should be in the databases of all antivirus products. The text that the file contains is as follows:
X5O!P%@AP[4\PZX54(P^)7CC) 7}$EICAR-STANDARD-ANTIVIRUSTEST- FILE!$H+H*
You can paste this code directly into Notepad or you can copy and paste it from the official site. Either way, after you've entered the text, save the file as 'EICAR.COM'. The name ensures that the resident shield of your antivirus software will scan the file as an executable when you try to access it (you can open it again in Notepad for this).
NOWHERE TO HIDE: If this file isn't detected by your antivirus it is time to get a new antivirus
A good antivirus system will be able to tell you the name of the virus. A really good one should be able to spot the file even when it's hidden in zipped archives. If your antivirus software doesn't detect EICAR, you have a problem.
First, reboot and try again. If there's still nothing, reinstall the antivirus package. If it still doesn't detect it, switch antivirus vendors immediately.
Related Stories
 |  |
(Via TechRadar: All latest feeds.)
In Depth: How to secure your TCP/IP ports: "
The TCP/IP protocol, which underlies everything that we do on the internet, was designed when robustness rather than security was the priority.
But while it means that traffic always arrives at the right destination, assumptions and bugs in the way TCP/IP has been implemented and in the application software to which it delivers data mean that we all have to be prepared for attack when going online.
Hackers are constantly trying to discover new ways to connect to machines so that they can install backdoors for later re-entry, trojans to collect financial details and the inevitable botnet clients. Whatever their goal, the starting point is the same: the port.
This guide will help you to understand how they work, how they can be used maliciously and how to close unwanted ports to keep you safer.
In the beginning
What we now think of as the internet began in the late 1960s with the US Defense Advanced Research Agency's ARPANET. Central to its design was the idea of 'packets' of data that could be sent at will between networked computers.
These packets were sent by being passed (or 'switched') from machine to machine along a network of connections, gradually getting nearer their destination. Computers known as Interface Message Processors (IMPs) decided how to switch the packets at each network junction. Today, we call these devices routers.
Unlike telephone systems, which at the time used a single physical line to host a single conversation at a time, packet switching networks sent multiple packets of information destined for different destinations down the same line, one after the other, making them vastly more efficient.
If one part of the network was unreachable, the IMPs could decide to route a packet around the damage so that it could still reach its proper destination.
As the benefits of networking computers became apparent in the early 1970s, the number of different networking protocols in use started to become a serious bottleneck.
The big breakthrough for the internet as we now know it came in 1973, when researchers Vint Cerf and Robert E Kahn realised that by having each host computer use a common protocol, any machine could send and receive packets of data to and from any other, regardless of the physical network used.
Suddenly, any network using Cerf and Kahn's TCP/IP (which stands for Transmission Control Protocol/Internet working Protocol) system could talk to any other network easily and reliably. All each manufacturer needed to do was program the protocol into its operating system.
How TCP/IP works
Depending on the data being carried, packets are sent not only to a destination computer, but also to a specific software 'port'. Each port handles different application traffic.
Port 80, for example, handles normal HTTP web traffic, while port 443 handles HTTPS encrypted web traffic. Sending email is always done over port 25, while receiving it is completed over port 110.
CLOSE THEM OFF: Closing the ports you don't need is a good place to start on the road to a secure PC
The TCP/IP system running on the internet today uses a series of handshakes to ensure that data always gets through to the correct machine, and that when it doesn't, the loss can be easily rectified. When your computer sends a packet, the following happens.
First, your computer sends the destination computer a packet containing its address, the address of the machine that it's connecting to and the number of the port to which it wants to connect. This is called a SYN packet, which is short for synchronisation. The packet also contains a random number that's known as the sequence number.
If the software on the receiving port accepts the connection, it sends back a packet called a SYN-ACK packet, short for synchronisation acknowledgement. This packet also contains a random sequence number. Your PC then sends an ACK (which is short for acknowledgement) packet back to the server. This technique is called the 'handshake'.
Once a connection is established, data transmission can begin. The packets sent by your computer are tagged with the sequence number it used when it began contacting the destination machine. Your computer includes and increments this number in each packet sent.
The combination of the source and destination IP address, the port number and the incrementing sequence ensures that all packets are uniquely identifiable.
For each packet you send, the destination computer returns a receipt packet to say that it got there safely. If a receipt doesn't arrive after a timeout, that's the cue to resend.
Unfortunately, TCP/IP was conceived to send and receive data reliably, not to secure it. That's the job of the applications listening and sending on specific ports.
If they don't make an effort to negotiate some form of data encryption, anyone can intercept the 'clear text' data as it flows past, which can include usernames and passwords. This is the basis for a 'man-in-the-middle' attack.
In this form of attack, data is routed through an attacker's computer, which retransmits it as if nothing had happened.
Meanwhile, the attacker copies every packet for later analysis. It's also possible to sniff this clear text traffic as it goes past on the network using a utility such as WireShark.
LISTEN IN: Be careful when using WireShark. If you accidentally listen in to someone else's PC, it could land you in a lot of bother with the law
In web jargon, HTTP is a plain text protocol. When you log into a site, the username and password you use are sent in plain text. This is why you should always ensure that the site is using an encrypted HTTPS connection before entering your credentials.
This goes for your ISP, too. It may be convenient to read your email on the web when you're on the move, but unless your ISP redirects to an HTTPS connection before asking for your username and password, your details could be vulnerable.
It's better to have your ISP forward your mail to a more secure online account, such as Gmail, which logs you in using an HTTPS web page.
Classic hacks
From the earliest days of the internet, hackers quickly realised that bugs in different TCP/IP implementations meant that they could knock a computer offline by sending carefully crafted packets. They could, in other words, deny people its services.
There are two basic types of denial of service (DoS) attacks. Bandwidth consumption attacks are far more popular these days thanks to the rise of the botnet. In this type of attack, infected 'zombie' computers are directed to flood a target with data.
This usually takes the form of massive numbers of SYN packets. The target believes that someone is trying to connect, so it blindly makes a note of each request and sends a SYN-ACK packet back. Because it has to use a small amount of memory to remember all the connection requests, the target quickly gets overwhelmed and is knocked off the internet until the botnet ceases its attack.
The second type of DoS attack is designed to crash the TCP/IP software itself. Attackers send a data packet that's either far too big or is broken into overlapping fragments. These packets confuse the target and lock it up.
One frightening element to this second form of attack is that with a single, carefully crafted packet you could take out a whole server until it is rebooted, possibly causing massive data loss for the affected website.
However, this type of attack is losing popularity with hackers because operating system producers have spent a lot of time and effort hardening their TCP/IP code to make it more reliable and less vulnerable.
Hackers exploit bugs in networking software for far more than simply disrupting services, however. It's possible in some instances to inject code into the running system. This can open a backdoor, allowing a trojan to be uploaded and installed to your machine, ready to steal your credentials, make your PC part of a botnet or even force your system to serve illegal images. Such attacks are automated and can infect thousands of computers a day.
The bug that let malicious code install the Conficker botnet's client software in just this way caused a global panic in late 2008.
While it's necessary for some ports to be open to internet traffic, it's also necessary to ensure that only the bare minimum are exposed and that the software connected to them is as up to date as possible.
This is why it's essential to turn on automatic updates, both for Windows and Linux, but also for your antivirus software.
If a computer starts acting up and its patches aren't up to date, security professionals will treat it as infected. As the saying goes, 'the unprotected become infected'.
Beyond staying up to date, the key to keeping your PC secure is to ensure that your firewall is closed to all traffic other than to the ports you know should be open. Because some malicious software can silently open ports, it pays to check them yourself and close any that you don't need open.
In Windows XP, the firewall settings can be found by opening the Control Panel and double clicking Windows Firewall. If you're in an insecure place such as a public Wi-Fi hotspot, make sure that the checkbox to prevent exceptions on the first tab of the resulting window is ticked.
The second tab lists all the programs allowed through your firewall. Uncheck all those you don't actively use and press 'OK'. Also ensure that the checkbox making sure that Windows pops up a message to say that it's blocked a program is ticked. By default, Windows also creates a log of firewall activity, storing it in 'C:\WINDOWS\pfirewall.log'.
The procedure is similar in Vista. On the Control Panel, select 'Allow a program through Windows Firewall' under the Security section. This brings up the same window as in XP. Inspect all the open ports and close those you don't need.
If your broadband router contains a firewall, it's a good idea to update your firmware regularly and to block traffic on all ports other than email in and out (ports 25 and 110), DNS (port 53), HTTP (port 80) and HTTPS (port 443).
On no account should you allow Microsoft's NetBIOS services through (ports 137 to 139), as these are vulnerable to attack. Finally, see the 'Test your exposure' section below for details of an online service that will show you which of your PC's ports can be seen from the internet.
Test your exposure
When trying to assess the state of your online security, it pays to be able to see how others see your network. There are various online services that can help you. One is by T1shopper, at www.t1shopper. com/tools/port-scanner.
On this page, you'll see your IP address displayed. You can enter a single port to see if it's reachable, as well as a range of port numbers to scan.
You can also tick any of the more commonly used ports from the two-column list. Each port that's closed (meaning that it has no software attached and listening to it and is therefore not vulnerable to attack) will return a line telling you that it isn't responding.
GET TESTED: Using free online tools such as Nmap and T1Shopper will show you which ports are open on your network
If your firewall is working and configured correctly, all of these tests should fail. For a more comprehensive test – one that will find out whether there's a botnet or other piece of malware listening on a specific port on your computer – enter a start and end port number and the service will scan these individually looking for open ones.
Don't abuse this service by entering '1' and '65,535' (the highest port number). Instead, play nicely, and enter only blocks of a maximum of 500.
Scanning will take some time, so be patient. At the end you should have a comprehensive view of how exposed your system is.
| |
(Via TechRadar: All latest feeds.)
10 mistakes that rookie IT consultants make: "
IT consulting is a tough, competitive field, and there are ample opportunities to mishandle the job. Erik Eckel offers some cautionary advice for IT consultants who are just starting out.
IT consulting is a difficult, complex industry. I’ve seen numerous competitors enter the market, only to fail. Everyone from large electronic chains (does anyone remember CompUSA’s business consulting effort or Circuit City’s Firedog initiative?) to local independents have come and gone. Despite frighteningly large marketing budgets (including symposium sponsorships, television commercials, and print advertising), complex marketing strategies, splashy fleet vehicles, and eerie team-building propaganda, competitors often fail within just months.
And there’s a reason. IT consulting is a dynamic, ever-changing industry that requires practitioners to maintain multiple skills. Rapid technological shifts frequently change the way you work, the tools you use, and the operational procedures you require. To meet that challenge and stay in the game, you must learn early on how to avoid some of the more preventable pitfalls. Here are 10 mistakes that consultants often make when they’re starting out.
Note: This article is also available as a PDF download.
None of us is perfect. Unforeseen issues always arise. There are no ‘simple’ projects. Consultants must take those issues into account when preparing project cost estimates.
The very first time I ever estimated a simple Windows Small Business Server rollout for a client with seven employees in two locations, I budgeted eight hours to ‘deploy the server.’ In developing my estimate, I included time to unbox and install the server, set up DNS, configure the VPN, join the second location to the VPN, register the domain name, configure MX records, create data shares, set permissions, and configure and test email accounts. Let’s just say it took longer.
New consultants must be particularly careful to review project plans before settling on a final estimate that is forwarded to the client. Such estimates should be first run by veteran IT staff for feedback whenever possible.
Why did my first server deploy take longer? In conversations with the client, when discussing the project, I was focused on the tasks associated with deploying the server. The client already had a peer-to-peer network in place. I saw my role as simply dropping the server on the network, joining workstations to the domain, configuring a VPN to give a remote but key employee data access, and introducing email.
But the client thought a ‘server deployment’ included installing a couple network printers with network scanning functionality, upgrading Microsoft Office software on eight workstations, implementing site-wide antivirus, and other tasks. Such disconnects are the IT consultant’s fault.
Clients are not technology experts. It is the consultant’s responsibility to ensure that the client’s business needs and objectives are understood and that the technology deployed matches them. Whenever estimating a project now, I provide clients with a project plan that lists specific bullet points. I don’t just state ‘deploy server,’ ‘configure DNS,’ etc., as most clients don’t know what that even means. Instead, before starting a project, I go through a project plan with the client that reviews tasks I will perform and the specific functionality those tasks will provide (’Users will store their files on the server’s X drive,’ All users will send/receive email using Microsoft Outlook 2007 on their desktop workstations,’ ‘A new network printer will enable scanning documents and storing them over the network to a Z drive hosted on the new server,’ etc.).
Just as it’s easy to underestimate the time and labor required to properly complete a project, hardware costs frequently become a source of trouble. Here’s one common scenario: An IT consultant specifies a particular gigabit switch or router when assembling a project budget using a temporary price because a vendor is offering promotional pricing (and the temporary price cut may NOT be evident when researching pricing). Or a server configuration may be priced using unique components. Ten days may pass before the client approves the purchase. Then, when the consultant proceeds to order the items, the server configuration and promotional pricing (or both!) are no longer available.
I see it all the time, even with one leading Texas-based computer vendor’s promise of 30-day price locks. And I’ve yet to see one of these changes work in the consultant’s favor. Whenever preparing project estimates, always note that hardware costs are subject to change. Be sure, too, to always include shipping costs in estimates. Clients should find no surprises when receiving a final invoice, but if the consultant neglects to include shipping costs in preliminary conversations, such fees will prove problematic.
An IT consultant cannot master all the technologies clients require. It’s not going to happen. Some busy consultants will service three or four clients a day. There’s no way that consultant is going to develop comprehensive expertise with all the myriad applications clients wield, such as Dentrix (dental), Timberline (accounting), QuickBooks (financial management), Intergy (physician practice), Act (database), Prolog (project management), Aloha (restaurant), and SEMCI Partner (insurance), as well as routing platforms (Cisco, SonicWALL, WatchGuard, etc.), Windows desktop and server operating systems, antivirus solutions, Exchange email, and others.
Determine which platforms you’ll master. Then make sure you know who to call for assistance when troubleshooting problems with the remainder. Whether you’re contacting the software manufacturer or another consultant to assist when servicing a platform with which you don’t have expertise, you’re performing a service for the client. Ultimately, clients typically don’t care that you know every nuance of every program — they just want a dependable partner they can call when they encounter technology issues.
Consultants, especially those starting a new business, are particularly eager to jump on new projects. It’s seemingly best to always be billing. Given the choice between taking downtime to develop and mail invoices or go onsite to complete another service call, rookie consultants almost always favor knocking out additional service calls. But there’s no cash flow when invoices aren’t going out.
New consultants must schedule time, daily whenever possible, to write and distribute invoices. A CPA client gave me great advice. He recommended I always send invoices within a day of completing work. He told me studies reveal customer satisfaction is highest when invoices are received quickly.
It makes sense. Every day a consultant delays sending an invoice, clients forget a little more the pressing need that demanded the repair or service. When bills arrive three weeks or a month later, cash flow not only suffers, but customers are more likely to believe charges are excessive. This is because the business and operations interruptions and resulting trauma and downtime the consultant corrected have been forgotten.
When planning a typical workday, consultants should schedule one or two hours of time for every hour billed. Essentially, that means two to four service calls are the most that can be reasonably accommodated on any given day. A fair rule of thumb is that each member of an IT consultancy traveling onsite to resolve client issues should bill 20 to 25 hours per week. Any more than that, and you begin stretching resources too thin.
When scheduling client calls (I aim for four billable hours per day, which I have consistently met for years), you must include time for administrative and operational work. Numerous tasks require a consultant’s attention, including managing payroll, accounting, QuickBooks data entry, internal IT, advertising, and marketing tasks.
Rookie consultants, whether working for a firm they own or as an employee within a consultancy, typically strive to maximize billable hours. The desire for billable hours sometimes comes at the expense of obtaining new clients and chasing larger projects. These consultants should do more than just report to work and service existing clients. They must take time to attend BNI, chamber, Rotary, and other networking meetings. They should distribute business cards at every opportunity.
Some consultants don’t believe they have time for additional marketing responsibilities. That’s a common mistake. The fact is, many business networking events end before 8:00 AM, so there’s no excuse for new consultants not rise early and attend networking events before their regular work day begins. Recently, a longtime friend and insurance agent reminded me that, by scheduling 7:00 AM and 7:30 AM meetings every day, he’s opened an additional 250 meetings a year on his calendar. That’s impressive.
Many consultants, especially those new to consulting, don’t realize the costs of travel time. Traffic is expensive. Very.
Consider the facts. If an IT consultant charges $115 an hour for onsite commercial work, and traveling to client sites consumes just six hours a week (it’s likely much more), the opportunity cost of traffic and travel time to the consultant exceeds $30,000 annually.
Those costs must be captured. Typically, IT consultancies capture them in the form of onsite service fees, inflated first-half-hour rates, or other surcharges. Just this past week, a plumber completed work at my residence. The bill included a $35 ‘truck fee.’ That’s nothing but fair. In addition to paying for fuel and wear-and-tear on a fleet vehicle, the plumbing shop needs to cover the time spent traveling to my home.
New IT consultants must remember to charge 30% to 40% more than their regular onsite rate for the first half-hour or simply add a flat-rate callout fee.
There’s a natural temptation, especially among new technology consultants, to believe the rates they charge are expensive. But running a business costs money, lots of it, and technology solutions are complex. Consultants must remember that their expertise, and the delivery of onsite service especially, possess great value. Hourly onsite support rates vary from $85 to $125 or more per hour. But that doesn’t mean a new consultant must charge just $85 per hour.
To the contrary. Local market conditions are usually the largest factor. The costs of delivering services is higher in Boston, where taxes, fees, parking, and other expenses are naturally higher than in Louisville, KY, where the costs of living are less. Thus, an IT consultant in Boston should expect to earn a higher hourly rate than a consultant in Louisville.
Technology consultants operate within a pressure-packed environment. This is likely the single greatest factor I underestimated when opening my own consulting shop almost four years ago.
Most clients don’t call for help before critical systems fail. Instead, they wait. Then they try to fix it themselves. Next, they enlist the assistance of the local computer geek on staff. Often, the consultant is called only after these efforts — and those of the business owners’ friends, colleagues, and neighbors — have failed to resolve the problem. As a result, IT consultants spend much of their time running from raging and complicated fires to blisteringly complex crises. It is fatiguing work. Many days, my technicians and I are physically and mentally exhausted by 2:00 PM.
Inevitably, clients request that consultants work weekends. I almost always say no. It’s not that I so feverishly guard my personal time. Instead, as I mature and spend more time within the industry, I’ve come to understand the importance of approaching complicated issues with a fresh mind and properly fed body (of which I’m not making light; too often my staff and I must skip lunch because of new-client crises). How many times have you struggled with a complicated Windows issue at 1:00 AM, only to quickly solve it the next morning after getting some sleep and a decent breakfast?
The same principle is true within a consulting firm. Rookie consultants must take time to help their bodies, physically and mentally, recover from the rigors of their profession. That means minimizing weekend work, for better or for worse.
My office staff and I are passionate about technology. We truly enjoy diagnosing and repairing technology problems for clients. But the work is stressful, administrative tasks can prove maddening, and some days are more rewarding than others. What tips or tricks have you discovered that help technology consultants run smoother operations? Post your comments below.
Get the key facts on a wide range of technologies, techniques, strategies, and skills with the help of the concise need-to-know lists featured in TechRepublic’s 10 Things newsletter, delivered every Friday. Automatically sign up today.
(Via 10 Things.)
Opinion: Facebook Fan Check virus rumours are driving users to more danger: "
This week has seen a tornado of warnings spread via social networking sites and online forums warning Facebook users to be wary of an application called Fan Check.
'It's a virus!' many of the messages have claimed. And helpful online friends have forwarded the message and retweeted it to their buddies without a moment's thought of checking the facts.
As a result, in less than 12 hours the number of active users of the Facebook application plummeted from 12.5 million a month to less than 6 million.
But the truth about the 'Facebook Fan Check Virus' is a little more complicated than that.
We've seen no evidence that the Fan Check application, which claims to gather information about who has been checking out your profile page on Facebook, is malicious.
It may be buggy, it may be inappropriate, but we've seen no signs that it is viral as many internet rumours have claimed.
But what is certain is that hackers are exploiting fear about the Facebook Fan Check application to infect innocent users' computers.
Malicious hackers have created websites pretending to be about the Facebook Fan Check Virus, but which really host fake anti-virus software which display bogus warnings about the security of your computer in an attempt to get you to install fraudulent software and cough-up your credit card details.
As these malicious websites are currently appearing high in Google's search results, many users worried about the Fan Check application are actually being driven to a much greater danger.
So, check your facts before spreading warnings about a 'dangerous application' on Facebook, and always exercise caution when searching the web for information on a new threat.
It may make sense to visit a legitimate security website rather than a webpage set up on the hoof by opportunistic hackers.
-------------------------------------------------------------------------------------------------------
Graham Cluley is senior technology consultant at Sophos, and has been working in the computer security field since the early 1990s. When he's not updating his other blog on the Sophos website you can find him on Twitter at @gcluley.
Related Stories
| |
(Via TechRadar: All latest feeds.)
