What Is A Zero-Day Vulnerability?

Posted on by ccsretail
What Is A Zero-Day Vulnerability?

A zero-day virus (also known as zero-day malware or next-generation malware) is a previously unknown computer virus or other malware for which specific antivirus software signatures are not yet available.

 
Traditionally, antivirus software relies upon signatures to identify malware. This can be very effective, but cannot defend against malware unless samples have already been obtained, signatures generated and updates distributed to users. Because of this, signature-based approaches are not effective against zero-day viruses.
 
There are other ways antivirus software detects malware.
 
Code Analysis
In code analysis, the machine code of the file is analyzed to see if there is anything that looks suspicious. Typically, malware has characteristic behavior and code analysis attempts to detect if this is present in the code.
 
Although useful, code analysis has significant limitations. It is not always easy to determine what a section of code is intended to do; particularly if it is very complex and has been deliberately written with the intention of defeating analysis. Another limitation of code analysis is the time and resources available. In the competitive world of antivirus software, there is always a balance between the effectiveness of analysis and the time delay involved.
 
Heuristic Analysis
Heuristic analysis is a method employed by many computer antivirus programs designed to detect previously unknown computer viruses, as well as new variants of viruses already in the “wild”.
 
Heuristic analysis is an expert based analysis that determines the susceptibility of a system towards particular threat/risk using various decision rules or weighing methods. Multi Criteria analysis (MCA) is one of the means of weighing. This method differs with statistical analysis, which bases itself on the available data/statistics.
 
It is generally accepted in the antivirus industry that the signature-based protection of most vendors is identically effective. If a signature is available for an item of malware, then every product (unless dysfunctional) should detect it. However, some vendors are significantly faster than others at becoming aware of new viruses and/or updating their customers signature databases to detect them.
 
There is a wide range of effectiveness in terms of zero-day virus protection. The German computer magazine c’t found that detection rates for zero-day viruses varied from 20% to 68%. It is primarily in the area of zero-day virus performance that manufacturers now compete.
 
-Bryan

Summer Time Security

Posted on by ccsretail

Summer is here, and as most people spend vacation in hotels/motels here are some security tips to keep in mind.

The Secret Service has confirmed what you’ve probably suspected for a long time: Public computers at hotels are ridiculously insecure, and you’re taking a gamble with your personal data each time you use one.
 
Security expert Brian Krebs shared a private Secret Service bulletin directed toward the hotel industry. The American government warns hotel managers that public computers in their establishments are, by and large, vulnerable to simplistic attacks that can compromise some of their patrons’ most sensitive details.
 
Hotel computers are obscenely easy for hackers to get ahold of, considering that attackers can have more-or-less unrestricted physical access to public computers (many hotels have a “business center,” where visitors can browse the Internet, check e-mail and print documents) for the cost of a single night’s stay.
 
Hacking computers remotely takes a little know-how, but compromising physical computers is usually as simple as installing a surreptitious keylogger via a USB stick. Keyloggers are what they sound like: They keep track of everything that users type into a computer, then transmit this information back to the hacker.
 
Given that users at hotels use public computers to check email, print boarding passes, pay for travel arrangements and download private business information, it’s not too hard to imagine what an imaginative hacker could do with this information. Worse still, there isn’t much that even a savvy hotel operator can do to prevent this misuse.
 
As usual, users will have to take responsibility for their own safety when it comes to hotel computers. Using your own computer or mobile device is much more secure than using a hotel machine, so bring a device and use hotel Wi-Fi or mobile data when possible. If you need to print documents, it’s probably safer to save them on a mobile device or USB stick and transfer them to the hotel machine.
 
Not every hotel is compromised, of course; the Secret Service did not provide estimates on how prevalent hacking hotel machines was, just that it happens and that it’s very easy to do. Still, a little caution is probably wise; nothing ruins a vacation quite like having your identity stolen.

If you have any system question or concerns, contact the CCS Retail Support Department at 800.672.4806 or email us.

-Bryan

Cash, credit or smartphone?

Posted on by ccsretail
Excerpted From BizTech

Cash, credit or smartphone?” isn’t something you’re likely to hear at a retailer or restaurant.

In fact, using a smartphone to make in-store purchases isn’t just rare; many people aren’t even aware it’s an 
option. Still, it might be worth a try if you fit a certain profile.
Today, there are two main ways to pay by phone at the register:
 
A general purpose “mobile wallet” app on your phone, such as Isis Wallet (Isis is going through a rebranding, stay 
tuned for the new name) or PayPal.An app put out by the particular restaurant or retailer you’re visiting, such as Starbucks’ popular app.
Answering these questions may help you decide if using one of these options is right for you.
 
1. How comfortable are you with technology?
 
Your comfort level with technology is probably the biggest consideration in deciding whether to use in-store smartphone payments.
 
“The fact is, these devices are ubiquitous, people lose them a lot, they might give them to their children or 
others to use,” says Susan Grant, director of consumer protection for the Consumer Federation of America. “There 
are a lot of security issues here that need to be considered.”
 
Making point-of-sale purchases with your phone safely requires being willing to take a few simple steps, including 
protecting your phone with a PIN and being careful about using public Wi-Fi, Grant says.
 
But even if users are careful, it’s possible for the companies who work together to provide those payments to 
botch things and leave consumers vulnerable.
 
“There’s always a concern about the security of the entities that hold your payment information,” Grant says. 
“Handset providers and operating system providers and mobile payments providers all have a role to play in 
providing good tools for consumers to use to safeguard the information on their devices.”
 
In fact, the ID theft protection company LifeLock recently removed its mobile wallet product from app stores and
wiped the customer data it held over security concerns.If any of that makes you squeamish, you might want to hold off.
 
2. How concerned are you about privacy?
 
The only thing companies love more than their customers’ money is their information, and mobile payments can serve up plenty of it.
 
“You have a lot more players in a transaction here than when you use some sort of payment card or cash at a point 
of sale,” Grant says.
 
“You’ve got the operating system, you’ve got the mobile payment platform, even the handset manufacturer — you’ve 
got lots of other parties involved in making mobile payments possible who could conceivably get information from 
your mobile device, and it could give merchants and others more information than they’ve ever had before about 
consumers,” she says.
 
There are probably a lot of consumers who couldn’t care less about whether their favorite burrito chain knows they 
prefer guacamole to sour cream, but if you’re the kind who gets creeped out by big businesses having your number, 
take note.
 
3. How much do you hate waiting in line and/or human interaction when you buy something?
 
Mobile ordering can be a major perk of buying things with your smartphone, depending on which app you use.
For instance, PayPal’s app supports phone-based ordering at some restaurants.
 
“With that merchant, I can now pull up their menu, pay ahead and just walk in, get my stuff and walk out,” says 
Sam Maule, managing consultant with Carlisle and Gallagher Consulting Group. “The No. 1 commodity there, is time.”
Starbucks’ mobile app does the same, allowing users to avoid waiting in line and reciting their intricate latte 
orders over and over for their daily caffeine fix.
 
4. Do you care about coupons and loyalty programs?
 
You know those reward cards that you have to carry around with you to get your fifth coffee free or not have to 
pay exorbitant prices at the drug store? In some cases, mobile wallets can get you the goods without them.
The other big selling point for in-store mobile payments is that some merchants offer special deals and coupons to
those who use them. For instance, Google Wallet has deals with several different retailers to automatically log 
your purchases to their loyalty programs.
 
Google Wallet
 
Some apps take that a step further and use your phone’s GPS capabilities to offer deals, Maule says.
“I’m getting dynamic offers that make sense based upon my locale, that I know that at this local bakery I can get
this deal,” Maule says. If that’s the kind of thing that floats your boat, mobile wallets might be worth a look.
 
5. Do you like paying the same way every time?
 
Right now, the biggest issue with paying in-store with your phone is probably the fragmentation in the industry.
There’s no mobile wallet service that works at every store, and those that depend on near-field communication 
(where you wave your phone over the payment terminal to make a purchase) either don’t work on iPhone, or require
you to buy a special, rather pricey case.
 
The situation may improve, says Mary Monahan, mobile research director for Javelin Strategy and Research. She says
that ISIS, a joint venture of Verizon, ATandT and T-Mobile, could become a more universal option.”This group controls more than two-thirds of the primary consumer wireless market, giving it a strong advantage, yet so far its results have been lackluster,” Monahan says.
 
What all that means is, for the time being, there’s no mobile wallet solution that’s going to allow you to pay
everywhere, every time. People who prefer to pay by phone are probably going to have to put a little thought into 
when and where they can do so.
 
For those who value convenience over bright, shiny new technology, that could be a deal breaker.
 
For system security questions or concerns, contact the CCS Retail Systems Support Department at 800.672.4806 or email us.
 
-Bryan

Take Action To Secure Yourself

Posted on by ccsretail
Excerpted From The Wall Street Journal
 
Hopefully someday companies invent a simpler way to control privacy on a smartphone. For now, if you care about 
privacy, you’ll need to take some action. Here are five tips that can get you started
 
1. Password-protect your phone, and use encryption
If someone gets their hands on your phone, you can prevent them from reading its stored data (or at least slow 
them down considerably) by putting a strong password on the phone and encrypting its contents.
 
Apple iPhones offer this by default once you set a passcode. Android phones require you to turn on encryption in 
the settings, and the process takes about an hour to activate.
 
2. Choose encrypted calling and chatting apps
Standard calls and text messages are easily tracked or intercepted. Instead, use encrypted conversation apps such 
as Silent Text and Phone, Wickr, TextSecure, ChatSecure or Apple’s FaceTime and iMessage.
 
The challenge is that it takes two to tango: Both you and the person you are talking to need to be using the same 
encrypted service to be covered.
 
3. Update your software religiously
Hackers and spies can take advantage of newly discovered loopholes and backdoors, especially if you don’t upgrade 
your phone’s software frequently.
 
Apple pushes iOS updates directly to users. Google updates Android frequently, but users get updates slowly 
because the updates must come through the handset maker or the carrier. Google’s own Nexus phones are the most
easily updated Android models.
 
4. Turn on a VPN in unsecure locations
If your phone is getting Internet access from an unusual or unsecure location, such as hotel Wi-Fi, spies could be 
lurking. Mobile VPN services like Bitmask and Disconnect Secure Wireless can provide protection.
 
5. Get a second phone for super-sensitive work
The people who are most serious about privacy and security keep separate devices for work and play. The reason:
Phones are so inherently trackable, and so many apps are designed to share data even when you don’t realize it. 
 
The more apps on board, the more risk of data spillage.
If you’ve got top-secret documents that you need to access on a phone, especially while traveling, restrain all 
activity on that phone to just the necessities. Alas, that means no “Angry Birds.”
 
For system questions or concerns, contact the CCS Retail Systems Support Department at 800.672.4806 or email us.
 
-Bryan

New Customer Connect Feature Introduced.

Posted on by ccsretail
New Feature For Customer Connect
 
 
Do you use NCR Customer Connect?  A new feature has recently been added that will now alert your POS cashier that an email address is no longer valid and allow for updating the customers records with a valid email.
 
This option can be turned on within the Customer Connect manager.  It works by adding an “Auto Note” pop-up to the customers record so that when the customer is chosen for the transaction, the note will pop up alerting the cashier. It will not prevent the user from completing the transaction whether or not a change is made, it is just a “Customer Note” automatically created by the Customer Connect Application
 
Note that the Auto Note will need to be manually cleared/deleted from the customer record after the change has been made (or not if the customer wishes to opt-out) or it will pop up again the next time the customer number is used for a transaction.
 
For more information about the other great features of Customer Connect, or the excellent apps integrated with NCR CounterPoint, contact our Sale Department at 800.672.4806 or email us.
 
-Bryan

Cloud Computing?

Posted on by ccsretail
Are You Ready For The Cloud?
 
Cloud computing refers to the use of computing resources, those being hardware and/or software that reside on a 
remote machine and are delivered to the end user as a service over a network, with the most prevalent example 
being the internet. By definition, a user entrusts his data to a remote service, on which has limited to no 
influence.
 
Cloud computing offers numerous advantages both to end users and businesses of all sizes. The obvious huge 
advantage is that you no more have to support the infrastructure or have the knowledge necessary to develop and 
maintain the infrastructure, development environment or application.The burden has been lifted and someone else is 
taking care of all that. Business are now able to focus on their core business by outsourcing all the hassle of IT 
infrastructure.
 
Some Advantages Are:
 
Cost Efficiency
 
This is the biggest advantage of cloud computing, achieved by the elimination of the investment in stand-alone 
software or servers. By leveraging cloud’s capabilities, companies can save on licensing fees and at the same time 
eliminate overhead charges such as the cost of data storage, software updates, management etc.
The cloud is in general available at much cheaper rates than traditional approaches and can significantly lower 
the overall IT expenses. At the same time, convenient and scalable charging models have emerged (such as one-
time-payment and pay-as-you-go), making the cloud even more attractive.
 
Convenience and continuous availability
 
Public clouds offer services that are available wherever the end user might be located. This approach enables easy 
access to information and accommodates the needs of users in different time zones and geographic locations. As a 
side benefit, collaboration booms since it is now easier than ever to access, view and modify shared documents and 
files.
 
Cloud is environmentally friendly

The cloud is in general more efficient than the typical IT infrastructure and It takes fewer resources to compute,

thus saving energy. For example, when servers are not used, the infrastructure normally scales down, freeing up 
resources and consuming less power. At any moment, only the resources that are truly needed are consumed by the 
system.

Some Disadvantages
 

As made clear from the above, cloud computing is a tool that offers enormous benefits to its adopters. However, 
being a tool, it also comes with its set of problems and inefficiencies. Let’s address the most significant ones.
 
Security and privacy in the Cloud
 
Security is the biggest concern when it comes to cloud computing. By leveraging a remote cloud based 
infrastructure, a company essentially gives away private data and information, things that might be sensitive and 
confidential. It is then up to the cloud service provider to manage, protect and retain them, thus the provider’s 
reliability is very critical. A company’s existence might be put in jeopardy, so all possible alternatives should 
be explored before a decision. On the same note, even end users might feel uncomfortable surrendering their data 
to a third party.
 
Dependency and vendor lock-in
 
One of the major disadvantages of cloud computing is the implicit dependency on the provider. This is what the 
industry calls “vendor lock-in” since it is difficult, and sometimes impossible, to migrate from a provider once 
you have rolled with him. If a user wishes to switch to some other provider, then it can be really painful and 
cumbersome to transfer huge data from the old provider to the new one. This is another reason why you should 
carefully and thoroughly contemplate all options when picking a vendor.
 
Technical Difficulties and Downtime
 
Certainly the smaller business will enjoy not having to deal with the daily technical issues and will prefer
handing those to an established IT company, however you should keep in mind that all systems might face 
dysfunctions from time to time. Outage and downtime is possible even to the best cloud service providers, as the 
past has shown.
 
Additionally, you should remember that the whole setup is dependent on internet access, thus any network or 
connectivity problems will render the setup useless. As a minor detail, also keep in mind that it might take 
several minutes for the cloud to detect a server fault and launch a new instance from an image snapshot.

If you have any system questions or concerns, contact the CCS Retail Systems Support Department at 800.672.4806 or email us.

-Bryan

 

CPMobile Version 2.0 Is Here

Posted on by ccsretail

CPMobile Version 2.0 

With earlier version of CPMobile, you are able to do: 
  • Mobile Point of Sale for remote/mobile point of sale checkout
  • Inventory management with mobile physical count functionality
  • On-the-spot viewing of customer, item pricing and inventory quantities  
As well as:
  • Get out from behind the counter to engage with the customers and ring up sales wherever they are gathered; within the store or outside the four walls
  • Multi-purpose devices allow both POS and inventory functionality
  • Stay in sync with real-time Counterpoint integration for immediate sales and inventory updates from anywhere
  • Provide exceptional customer service including on-the-spot item lookup, line-busting checkout, and returns  
CPMobile v2.0 now includes more Inventory Management tools like. 
  • Adjustments:
NCR Counterpoint Mobile’s Adjustments module allows you to manually adjust on-hand quantities to account for shrinkage or unexpected overages in your inventory. Use your CPMobile device to scan or look up items, specify the quantities to add to your inventory or remove from your inventory, and then export adjustment transactions to NCR Counterpoint for posting.  
  • Receiving (without a Purchase Order

NCR Counterpoint Mobile’s Receivings module allows you to receive merchandise from your vendors. Use your CPMobile device to scan or look up items, specify the quantities you are receiving, and export receivers to your NCR Counterpoint for posting.

 
In version 2.0, NCR Counterpoint Mobile allows you to receive merchandise without a purchase order. The ability to receive against a purchase order will be available in a forthcoming version of NCR Counterpoint Mobile.  
  • Unlocking CPMobile Devices when Offline
In this version, you can unlock a CPMobile device that is not connected to your NCR Counterpoint server. This enhancement allows you  to use NCR Counterpoint Mobile’s Inventory features–including Physical Count, Adjustments, and Receivings–when you are in an area without a reliable network connection, such as a warehouse or stockroom.

Please Note that to use the latest feature, your version of NCR CounterPoint must be at 8.4.6.10

 
More functionality is being added all the time. So if you are interested in trying this out.  Contact the CCS Retail Systems sales department for a demo or call 800.672.4806 or email us.  For updating your CounterPoint contact the CCS Retail Systems Support Department at 800.672.4806 or email us.
 
-Bryan

 

Is Your Site/Store Secure?

Posted on by ccsretail

Site Security

Do you know how your firewall is configured?  Do you know how to properly configure your firewall? Do you allow remote access to your Servers?  Do you use secure and complex passwords?  If not, you may want to reconsider and reconfigure/replace your firewall/router.

CCS Retail Systems can install and configure a firewall appliance that will allow for secure VPN remote access, help you manage Internet use by employees, allow for Internet credit card processing, email and as much or as little access that you need (remember, the less exposed to the Internet you are, the better).

Configuring a firewall can be a tedious job, most firewall/routes that you can buy a a local retail store are just not flexible enough to allow the most secure environment for your POS data.  Sure, you can block the Internet, but most SOHO firewall/routers either allow everyone access or no one access.  There are more robust firewalls out there that will allow more granular flexibility.  For example, you can have the firewall block all Internet access from a browser for everyone except for 1 PC if that is what you need.  You can do the same with email, and credit card processing.  

 A VPN can be setup to allow you to connect to your store from just about anywhere securely.  This VPN tunnel can be used with NCR Counterpoints CPMobile application and still be in compliance with PCI standards.

 When you are ready to upgrade your site to a more complete firewall solution, call the CCS Retail Systems Support Department for a review of your site security needs at 800.672.4806 or email us.

-Bryan

Planning Your Hardware Upgrade

Posted on by ccsretail

Updating Hardware/OS? 

Recently, a customer called and wants to replace their PC’s.  Went out and purchased new PC’s preloaded with Windows 7.  No problem you say?  Well take another guess.  Most new PC’s are no longer supporting Windows XP.  So what, you say, why can’t you use Windows 7? Windows 7 is a great OS, but does your important software and hardware work with it? 

The problem lies with certain software that are aware of the OS, and no matter what you to try to make it work, it just won’t.  Try "Compatibility Mode", did it, still not working.  Try XP Mode?  Sure, but XP Mode will may slow things down to an unacceptable speed.  I have experienced it before, and although I have tried to explain this, the customer still wants to give a try and is very disappointed in the results. 

The moral of the story is, don’t wait until you current hardware is about to die before replacing PC’s.  Be aware and plan for other software/hardware upgrades when you do decide to replace PC’s.  Most of the older hardware/software that worked great with Windows XP just will not work no matter what.  Trying to downgrade your new PC to run Windows XP is a hit or miss.  Meaning that its possible you will not find drivers for the network card or some of the other on-board devices the Windows needs to run optimally.  Some driver CD’s that come with the mother will not even run. 

Be prepared when you decide to update your hardware.  It will save both time,money and frustration in long run. 

If you would like a review of your hardware and software call the CCS Retail Systems Support Department at 800.672.4806 or email us. 

-Bryan 

CPSQL And Labels

Posted on by ccsretail

CPSQL And Labels 

As with Counterpoint V7, CPSQL supports printing labels directly from the software, but unlike V7, the options are almost limitless.   

In V7, there were limits on what fields could be printed on the label, the font type and size were limited to what was supported by the label printers control language.  With CPSQL, just about any field within the item or inventory tables can be added to the label.  The ability to print in any font that the computer has installed is also way CPSQL can help you print professional looking labels. 

The ability to create or modify your own labels will require the use (and purchase) of software that CCS can help you acquire.  There is a little learning curve for using the software, but once you get the hang of creating or modifying labels, the possibilities are endless. 

If you would like some help modifying your current labels, or creating a new format, contact the CCS Retail Support Department at 800.672.4806 or email us.

 -Bryan