It’s time for company’s to change this website notice to, “You may need to download an application to view PDF documents.”

The Portable Document Format (PDF) was originally a proprietary format, but it has been an open standard for many years now.

I sign Non-Disclosure Agreements (NDAs) with several of my clients. Adobe’s constant pressure to incorporate their automatic cloud storage and artificial intelligence analysis of documents that are read, created, or edited with their software make their products not just a security risk, but a legal risk.

I canceled my Adobe subscription and uninstalled all of their products from every computer I use for work-related tasks. (Full disclosure: my wife still has her Adobe subscription and has no interest in changing products).

Opening a PDF file in a web browser is also a security risk if you have an NDA, since many web browser providers are analyzing displayed content. If you have security obligations to your clients, I recommend disabling the viewing of PDF files in the browser, or, better yet, use a less invasive browser for work-related tasks.

I’m not making any recommendations in this post (or in the comments) for PDF viewers or browsers, because that would create the impression that this is a sales pitch. If anyone recommends something in the comments, that’s fine, just understand that I’m not making an endorsement here.

But back to the original point, in my opening sentence: unless Adobe is paying you to recommend their product on your website, you should drop the reference to Adobe in your PDF notice. It’s an open standard, and recommending a particular product when it’s not a requirement is misleading at best.

#CallMeIfYouNeedMe #FIFONetworks

Cybersecurity - Networks - Wireless – Telecom – VoIP

One of the most bewildering aspects of remote tech support is when I connect to the user's computer, there's an error message on the screen telling exactly what to do to fix the problem, and the user says, "Just close that, it always pops up."

I respond with, "Well, that's a safe error message, so I'm going to click on it and resolve it so it doesn't keep being an annoyance."

And then their problem is fixed and I invoice them.

It would make sense to me if they said, "I'm not sure if it's okay to click on that, or if it's trying to trick me."

But when they don't think it's related to the problem - I don't know how to explain that.

#HelpDesk

Are QR codes for restaurant menus safe? Why yes, as a matter of act, they are. And before you start with the “But Bob,” read the whole post.

There’s this concept in cybersecurity called a risk assessment. When the restaurant puts an official, restaurant-sponsored QR code linking to their menu on your table, the risk is very low. Click on the link and pick your favorite food and beverage.

Did someone tape a new QR code over the original QR code? The risk went up. Ask your server if the restaurant changed the QR code. If they did, the risk is back down.

QR codes are a nice benefit in the age of smartphones. They make it much easier to get a complex URL into your browser, and to identify valid concert ticket holders, and many other things.

THE LESSON
Instead of parroting negative rules (“Don’t do this!” “Don’t do that!”), use your skills and do the analysis.

(About the picture: someone on Threads complained about QR codes for restaurant menus. They don’t like them. Fine. Me neither. But then someone posted in the comments, “You should never scan random QR codes this is a huge cybersecurity issue.” And that’s just a gross oversimplification).

If you receive a call from an agency trying to verify someone’s employment, take the call. Return the call if they left a voicemail. Go the extra mile and make the effort.

STORY TIME
Yesterday a call came from an unknown number, and I was driving, so I let it roll to voicemail. It was an employment verification call. The caller gave me the person’s name and dates of employment, but didn’t say what company they worked for. The employment dates overlapped the time when I was CISO at a national retailer. I didn’t recognize the name, but there were a lot of employees working Help Desk, and the Help Desk Manager reported to me. The company has since gone bankrupt, and they might be having difficulty finding someone to verify employment. So I called back.

No joy. I was moved from the automated attendant to a holding queue, and after a few minutes I hung up.

Today, they called and left another voicemail. I called back right away, and this time I connected with a real person. I gave them the case number and they looked it up, and I asked questions.

It turned out that the woman who wanted her employment verified worked for a company in Florida with a name similar to my company name – it started with “FIFO.” I’ve never done business in Florida, and she never worked for me, but I doubt she lied on her application. The company she listed still exists, and is headquartered in Florida. It’s more likely that the company doing employment verification is having difficulty finding a good contact.

THE “ALMOST” PROBLEM
What if I had just said, “I don’t recognize that name, she never worked for me?”

Right now, finding a job is hell on Earth. Someone is interested in hiring her. I could have destroyed her reputation and prospects for employment by being quick to judge, and speaking without full knowledge of the situation.

THE CORRECT RESPONSE
If you get a call from an employment verification agency and you don’t recognize the name, ask questions. Get information before jumping to conclusions. In this case I was able to say, “I’ve never had employees in Florida, and that company name is slightly different than mine, so I can’t verify her employment, but you should keep looking and see if you can find someone from the right company.”

My unknown friend, best wishes for your job search. I hope you find a job where you can be happy soon.

#jobs

And on top of everything else going on...

Millions of Scorpions Emerging Early Sparks Warning

https://www.newsweek.com/millions-of-scorpions-emerging-early-sparks-warning-11703988

Instead of using fear as a tactic to sell cybersecurity services, I find people who are already concerned about their risk, and offer them calm confidence in exchange for money.

#CallMeIfYouNeedMe #FIFONetworks

Cybersecurity - Networks - Wireless – Telecom – VoIP