W10Privacy is a smarter Windows 10 telemetry blocker

If you’ve tried more than your share of Windows 10 telemetry blockers recently, then we know just how you feel, but wait -- W10Privacy is more interesting than most. No, really.

There’s a lengthy list of tweaks you can apply, for instance -- approaching 100 -- all neatly organized across several tabs: Privacy, Telemetry, Network, Services and more.

While the competition often leaves you uncertain what a particular option will do, W10Privacy has some very clear descriptions : "Do not let apps use my camera", "Do not let apps access my name, picture and other account into", and so on.

If that’s not enough, hovering the mouse over that action displays a tooltip with more information.

W10Privacy gives you quite fine control over some areas. There’s not just a vague "block telemetry" option: instead you can choose to "block IP addresses of known Microsoft telemetry servers" through either a firewall rule or your HOSTS file, in both full-strength and lightweight versions.

Each action is color-coded, too, as either green (safe to set), amber (check carefully) or red (don’t do this unless you’re really sure), reducing the chance that you’ll cause some major problems.

There are some useful bonus features, too, including the ability to uninstall most of the standard Windows apps.

The program does have various issues. There’s no way to disable/ enable a group of settings at once; there’s no "Cancel" option if you hit "Set changed settings" by mistake; the interface and general implementation need a lot of work.

Still, there’s nothing here that can’t be fixed, and W10Privacy’s explanations of what each tweak does are well worth having. It’s also small, portable and entirely free, so if you’re interested, just grab a copy and give it a try.

Click here to view complete Q&A of MB2-706 exam

Certkingdom 20% Discount Promotion Coupon Code: 45K2D47FW4

Best Microsoft MCTS Certification, Microsoft MB2-706 Training at certkingdom.com

Hitch your IT career to a rising star with DevOps certification

Hitch your IT career to a rising star with DevOps certification

Savvy IT industry watchers have probably been noticing something called “DevOps” come gliding into view for a while now, striking regular pings on the scope of anyone scanning for either hot trends or spiking salaries. Even proponents of DevOps, however, sometimes struggle to define it in layman’s terms, a challenge that anyone who has ever tried to explain development methods like Agile or Scrum to someone outside of IT will understand. Beneath the jargon, however, there’s an important development model that is quickly gaining in popularity. If you’re involved in IT, then this is something that’s probably worth taking the time to understand.

What is DevOps?
DevOps is a compound of “development” and “operations.” It’s a software development method that stresses communication, collaboration, integration, automation, and measurement of cooperation between software developers and other information technology professionals. DevOps is often shown graphically as three overlapping circles consisting of Development, Quality Assurance, and Information Technology Operations, with DevOps being the area of overlap that ties all three circles together.

DevOps is so much more, however, than the intersection of three circles. It’s often the intersection of five or ten circles — it just depends on the company that the DevOps is supporting. DevOps spans the entire delivery pipeline. This includes improved deployment frequency, which can lead to faster time to market, lower failure rate of new releases, shortened lead time between fixes, and faster mean time to recovery in the event of a new release crashing or otherwise disabling the current system. Simple processes become increasingly programmable and dynamic when using a DevOps approach, which aims to maximize the predictability, efficiency, security, and maintainability of operational processes. Automation often supports this objective.

DevOps integration targets product delivery, quality testing, feature development, and maintenance releases in order to improve reliability and security and provide faster development and deployment cycles. Many of the ideas (and people) involved in DevOps come from the enterprise systems management and agile software development movements.

DevOps aids in software application release management for an organization by standardizing development environments. Events can be more easily tracked as well as resolving documented process control and granular reporting issues. Companies with release/deployment automation problems usually have existing automation but want to more flexibly manage and drive this automation without needing to enter everything manually at the command-line.

Ideally, this automation can be invoked by non-operations employees in specific non-production environments. The DevOps approach grants developers more control of the environment, giving infrastructure more application-centric understanding.

The adoption of DevOps is being driven by factors such as:
● Use of agile and other development processes and methodologies
● Demand for an increased rate of production releases from application and business unit stakeholders
● Wide availability of virtualized and cloud infrastructure from internal and external providers
● Increased usage of data center automation and configuration management tools
● Increased focus on test automation and continuous integration methods

According to David Geer, 42 percent of IT pros surveyed had adopted or planned to adopt DevOps development approaches (Information Week, 2014 DevOps Survey). That number ballooned to 66 percent of U.S. companies using DevOps approaches by the time of a Rackspace survey only 10 months later. With DevOps clearly taking over the coder’s realm, most programmers will eventually have to yield to and master this mindset.

What does DevOps mean for a programmer’s profession?
There's a lot of interest in DevOps in the IT world right now.DevOps introduces developers to operational requirements and the tools and methods necessary to ensure that the code they create is immediately functional, of high quality, and fit for the production environment. With solid training in these tools and methods, developers should find their talents highly sellable in a career world that is increasingly favorable to DevOps practitioners.

Adam Gordon, CTO of New Horizon Computer Learning Centers of south Florida, sats that important developer skills for DevOps environments include automating configuration management (infrastructure lifecycle management) using vendor-neutral tools such as Puppet, Chef, Ansible, SaltStack, and Docker. These tools integrate with a host of popular platforms and software including Amazon EC2, Amazon Web Services, CFEngine, Cisco, Eucalyptus, Google Cloud Platform, IBM Bluemix, Jelastic, Jenkins, Linux (various distributions), Microsoft Azure, OpenStack, OpenSVC, Rackspace, Rightscale, Salt, SoftLayer, Vagrant, VMware, and a rapidly expanding number of examples.

Some of the most popular vendor-specific DevOps platforms include those from Microsoft and VMware, says Gordon. Microsoft’s DevOps-related products include System Center with its System Center Configuration Manager (SCCM) and System Center Operations Manager (SCOM). These Microsoft developer tools enable functions such as automated configuration management, monitoring, and custom management pack development. VMware tools such as vCloud Air (vCloud Hybrid Service) bridge the VMware development platform to tools such as Puppet and Chef, according to Gordon, while the vRealize cloud management platform automates infrastructure and application delivery, monitoring, analytics, and management.

Finally, Red Hat Linux developers will find that learning to deploy this distribution can be useful for work in Red Hat-related DevOps environments.

Does everyone love DevOps?
No, not everyone. Take Jeff Knupp, for instance. In an April 2014 blog, Knupp claims that DevOps is “killing the developer.” Allow me to quote directly from Mr. Knupp’s post:

“There are two recent trends I really hate: DevOps and the notion of the ‘full-stack’ developer. The DevOps movement is so popular that I may as well say I hate the x86 architecture or monolithic kernels. But it’s true: I can’t stand it. The underlying cause of my pain? This fact: not every company is a start-up, though it appears that every company must act as though they were.

“DevOps is meant to denote a close collaboration and cross-pollination between what were previously purely development roles, purely operations roles, and purely QA roles. Because software needs to be released at an ever-increasing rate, the old ‘waterfall’ develop-test-release cycle is seen as broken. Developers must also take responsibility for the quality of the testing and release environments.

“The increasing scope of responsibility of the ‘developer’ (whether or not that term is even appropriate anymore is debatable) has given rise to a chimera-like job candidate: the ‘full-stack’ developer. Such a developer is capable of doing the job of developer, QA team member, operations analyst, sysadmin, and DBA. Before you accuse me of hyperbole, go back and read that list again. Is there any role in the list whose duties you wouldn’t expect a ‘full-stack’ developer to be well versed in?

“Where did these concepts come from? Start-ups, of course (and the Agile methodology). Start-ups are a peculiar beast and need to function in a very lean way to survive their first few years. I don’t deny this. Unfortunately, we’ve taken the multiple technical roles that engineers at start-ups were forced to play due to lack of resources into a set of minimum qualifications for the role of ‘developer.’ ”

“Imagine you’re at a start-up with a development team of seven. You’re one year into development of a web application that Xs all the Ys, and things are going well, though it’s always a frantic scramble to keep everything going. If there’s a particularly nasty issue that seems to require deep database knowledge, you don’t have the liberty of saying, ‘That’s not my specialty,’ and handing it off to a DBA team to investigate. Due to constrained resources, you’re forced to take on the role of DBA and fix the issue yourself.

“Now expand that scenario across all the roles listed earlier. At any one time, a developer at a start-up may be acting as a developer, QA tester, deployment/operations analyst, sysadmin, or DBA. That’s just the nature of the business, and some people thrive in that type of environment. Somewhere along the way, however, we tricked ourselves into thinking that because, at any one time, a start-up developer had to take on different roles, he or she should actually be all those things at once.

“If such people even exist, ‘full-stack’ developers still wouldn’t be used as they should. Rather than temporarily taking on a single role for a short period of time, then transitioning into the next role, they are meant to be performing all the roles, all the time. Most good developers can almost pull this off.”

Certifications in DevOps
The DevOps certification realm is taking root quickly. One organization that is out in front of the pack, however, is Amazon Web Services. If you want to make a strong move into DevOps, then consider any of the following credentials.

AWS Certified DevOps Engineer – Professional

Description
The AWS Certified DevOps Engineer – Professional exam validates technical expertise in provisioning, operating, and managing distributed application systems on the AWS platform. Exam concepts you should understand for this exam include the ability to:

● Implement and manage continuous delivery systems and methodologies on AWS
● Understand, implement, and automate security controls, governance processes, and compliance validation
● Define and deploy monitoring, metrics, and logging systems on AWS
● Implement systems that are highly available, scalable, and self-healing on the AWS platform
● Design, manage, and maintain tools to automate operational processes

Prerequisites
Required Prerequisite: status as AWS Certified Developer – Associate or AWS Certified SysOps Administrator – Associate

Eligibility
● Two or more years’ experience in provisioning, operating, and managing AWS environments
● Experience in developing code in at least one high-level programming language
● Experience in automation and testing via scripting/programming
● Understanding of agile and other development processes and methodologies

Exam
Multiple choice and multiple answer questions
170 minutes to complete the exam
Exam available in English
Exam registration fee is $300

DevOps is a hot trend in software development right now.AWS Certified SysOps Administrator – Associate
Description

The AWS Certified SysOps Administrator – Associate exam validates technical expertise in deployment, management, and operations on the AWS platform. Exam concepts you should understand for this exam include:

● Deploying, managing, and operating scalable, highly available, and fault tolerant systems on AWS
● Migrating an existing on-premises application to AWS
● Implementing and controlling the flow of data to and from AWS
● Selecting the appropriate AWS service based on compute, data, or security requirements
● Identifying appropriate use of AWS operational best practices
● Estimating AWS usage costs and identifying operational cost control mechanisms

Prerequisites

No prerequisites; recommend taking System Operations on AWS
Eligibility

● One or more years of hands-on experience in operating AWS-based applications
● Experience in provisioning, operating, and maintaining systems running on AWS
● Ability to identify and gather requirements to define a solution to be built and operated on AWS
● Capabilities to provide AWS operations and deployment guidance and best practices throughout the lifecycle of a project

Exam
Multiple choice and multiple answer questions
80 minutes to complete the exam
Available in English, Japanese, Simplified Chinese, and Brazilian Portuguese
Practice Exam Registration fee is $20
Exam Registration fee is $150

AWS Certified Developer – Associate
Description

The AWS Certified Developer – Associate exam validates technical expertise in developing and maintaining applications on the AWS platform. Exam concepts you should understand for this exam include:

● Picking the right AWS services for the application
● Leveraging AWS SDKs to interact with AWS services from your application
● Writing code that optimizes performance of AWS services used by your application
● Code-level application security (IAM roles, credentials, encryption, etc.)

Prerequisites
No prerequisites; recommend taking Developing on AWS
Eligibility
● One or more years of hands-on experience in designing and maintaining an AWS-based application
● In-depth knowledge of at least one high-level programming language
● Understanding of core AWS services, uses, and basic architecture best practices
● Proficiency in designing, developing, and deploying cloud-based solutions using AWS
● Experience with developing and maintaining applications written for Amazon Simple Storage Service, Amazon DynamoDB, Amazon Simple Queue Service, Amazon Simple Notification Service, Amazon Simple Workflow Service, AWS Elastic Beanstalk, and AWS Cloud Formation.

Exam
Multiple choice and multiple answer questions
80 minutes to complete the exam
Available in English, Simplified Chinese, and Japanese
Practice Exam Registration fee is $20
Exam Registration fee is $150

AWS Certified Solutions Architect – Professional
Description
The AWS Certified Solutions Architect – Professional exam validates advanced technical skills and experience in designing distributed applications and systems on the AWS platform. Example concepts you should understand for this exam include:

● Designing and deploying dynamically scalable, highly available, fault tolerant, and reliable applications on AWS
● Selecting appropriate AWS services to design and deploy an application based on given requirements
● Migrating complex, multi-tier applications on AWS
● Designing and deploying enterprise-wide scalable operations on AWS
● Implementing cost control strategies

Prerequisites
Status as AWS Certified Solutions Architect – Associate
Eligibility
● Achieved AWS Certified Solutions Architect – Associate
● Two or more years’ hands-on experience in designing and deploying cloud architecture on AWS
● Abilities to evaluate cloud application requirements and make architectural recommendations for implementation, deployment, and provisioning applications on AWS
● Capabilities to provide best practices guidance on the architectural design across multiple applications, projects, or the enterprise

Exam
Multiple choice and multiple answer questions
170 minutes to complete the exam
Exam available in English and Japanese
Practice Exam Registration fee is $40
Exam Registration fee is $300

AWS Certified Solutions Architect – Associate
Description

Intended for individuals with experience in designing distributed applications and systems on the AWS platform. Exam concepts you should understand for this exam include:
● Designing and deploying scalable, highly available, and fault tolerant systems on AWS
● Lift and shift of an existing on-premises application to AWS
● Ingress and egress of data to and from AWS
● Selecting the appropriate AWS service based on data, compute, database, or security requirements
● Identifying appropriate use of AWS architectural best practices
● Estimating AWS costs and identifying cost control mechanisms

Prerequisites
None, but it is recommended that candidates take the Architecting on AWS and AWS Certification Exam Readiness Workshop
Eligibility
● One or more years of hands-on experience in designing available, cost efficient, fault tolerant, and scalable distributed systems on AWS
● In-depth knowledge of at least one high-level programming language
● Ability to identify and define requirements for an AWS-based application
● Experience with deploying hybrid systems with on-premises and AWS components
● Capability to provide best practices for building secure and reliable applications on the AWS platform

Exam
Multiple choice and multiple answer questions
80 minutes to complete the exam
Available in English, Japanese, Simplified Chinese, Korean, French, German, Spanish, and Brazilian Portuguese
Practice Exam Registration fee is $20
Exam Registration fee is $150

There's a lot of interest in DevOps in the IT world right now.AWS Certified DevOps Engineer – Professional
Description

The AWS Certified DevOps Engineer – Professional exam validates technical expertise in provisioning, operating, and managing distributed application systems on the AWS platform. Exam concepts you should understand for this exam include the ability to:
● Implement and manage continuous delivery systems and methodologies on AWS
● Understand, implement, and automate security controls, governance processes, and compliance validation
● Define and deploy monitoring, metrics, and logging systems on AWS
● Implement systems that are highly available, scalable, and self-healing on the AWS platform
● Design, manage, and maintain tools to automate operational processes

Prerequisites
AWS Certified Developer – Associate
AWS Certified SysOps Administrator – Associate
Eligibility
● Two or more years’ experience in provisioning, operating, and managing AWS environments
● Experience in developing code in at least one high-level programming language
● Experience in automation and testing via scripting/programming
● Understanding of agile and other development processes and methodologies

Exam
Multiple choice and multiple answer questions
170 minutes to complete the exam
Exam available in English
Exam registration fee is $300

Click here to view complete Q&A of 70-697 exam

Best Microsoft MCTS Certification, Microsoft 70-697 Training at certkingdom.com

Cybersecurity 101: Protect your home or personal network

Intrusion detection systems. Network firewalls. Behavioral analysis. Encryption. The toolkit of the modern information security professional is full of complex, advanced technical controls designed to protect enterprise networks against increasingly sophisticated attacks. How should home users protect themselves — without investing thousands of dollars in specialized security equipment — against cybercriminals who want to steal sensitive personal information?

Fortunately, there are simple and inexpensive steps that every home user can take to build a robust, layered defense that will protect them against most of the malicious threats that jeopardize the security of their systems and personal information. Let’s take a look at five simple ways that you can keep your network secure without breaking the bank. Think of these recommendations as being a Cybersecurity 101 course for the average home computer user.

Use a Firewall
Businesses spend thousands of dollars on sophisticated firewalls designed to keep malicious threats out of their protected networks. Firewalls sit at the border between a private network and the Internet, enforcing rules that regulate the traffic allowed to cross that border. Enterprise-grade firewalls are expensive and require extensive configuration to precisely define the types of traffic that should be allowed to enter the network unsolicited. For example, a business firewall would typically allow connections from the Internet to the company’s web server.

Fortunately, home users don’t need a sophisticated firewall because they don’t have sophisticated networking needs. Unless you’re running public web servers in your home, your firewall policy should be very simple: Don’t allow any unsolicited connections to your network. You probably already have a firewall built-in to the Internet router provided by your service provider. Even better, it’s probably already configured to enforce this simple “deny everything” firewall policy.

Take the time to understand what type of router is sitting at the border of your home network. Find the instruction manual for that model router and use it to verify that the firewall function is enabled and blocking all unsolicited connection requests. This will go a long way toward keeping the bad guys out of your network.

Install and Update Antivirus Software
Antivirus software is still one of the tried-and-true ways to protect your network against malicious threats. Signature-based software runs on your systems, scanning them constantly for any signs of malicious software. When antivirus software detects a threat, it acts to immediately neutralize it by removing the software entirely or, if that’s not possible, quarantining it in a safe location until you can take further action to clean your system.

You can’t just simply install antivirus software and walk away, however. The manufacturers of antivirus software release new updates on a daily basis to combat recently discovered strains of malicious software. If you haven’t updated your software in a few years, it’s next to useless as a defense against modern threats. Take a few minutes to verify that all of the systems on your network have current antivirus software and that they’re configured to receive daily signature updates from the vendor.

Keep Computers Patched
Whether you’re running Windows or Macintosh systems, you need to apply security updates on a regular basis to keep your systems secure. Microsoft and Apple release patches whenever they become aware of a security vulnerability in their operating systems. If you don’t apply those patches, attackers will likely discover your vulnerability and exploit it to gain access to your network and data.

Fortunately, it’s easy to keep your computers patched. Both Mac OS X and Windows provide automatic updating mechanisms that check every day for new security patches and automatically apply them to your systems. You just need to ensure that this functionality is turned on and your computer will take care of all of the work.

Encrypt Wireless Networks
Your wireless network is the easiest path for an attacker to gain access to the systems in your home. You should use strong WPA2 encryption to protect your network and configure it with a strong password known only to authorized network users. If you have no encryption, or use the outdated WEP encryption standard, it’s equivalent to leaving your front door unlocked and open, waiting for intruders to wander by and steal your belongings.

Configuring wireless encryption is usually very easy. Check the manual for your wireless access point. You’ll probably just need to select WPA2 encryption from a drop-down menu and then enter a strong passphrase used to access the network. Once it’s up and running, reconfigure all of your devices to use the new encrypted network and the contents of your communications will be safe from prying eyes.

Encrypt Sensitive Files
You don't have to be a genius to protect your home network.One oft-forgotten risk is the physical theft of computing devices. If an intruder steals a computer out of your home or a thief grabs your bag on the subway, you may lose physical possession of the computer. It’s one thing to lose a couple thousand dollars because of the device theft, but it’s far worse to lose your tax returns, credit card statements and other sensitive information that might be stored on the device.

You can protect yourself against the loss of sensitive information by encrypting the contents of your computer. Even if the computer falls into the wrong hands, the thief won’t be able to access your encrypted personal information without knowing your password. Both Windows and Mac systems offer free built-in encryption technology that you can easily enable. FileVault on Macs and BitLocker on Windows provide an easy way to protect the contents of your hard drive from prying eyes. Just make sure that you know your own password so that you don’t lock yourself out from access to your personal files!

Conclusion
Securing a home network is far simpler than securing the complex corporate networks that offer public services, but it still requires effort. Take the time to assess your network by verifying that your firewall is active, installing antivirus software, applying security patches, using WPA2 on your wireless network and encrypting your sensitive files. The few hours you might spend securing your network today may prove themselves worth the effort when they successfully protect you from hackers down the road!

Click here to view complete Q&A of 70-697 exam

Best Microsoft MCTS Certification, Microsoft 70-697 Training at certkingdom.com

Exam 77-418 Word 2013

Exam 77-418 Word 2013

Published: February 28, 2013
Languages: English
Audiences: Information workers
Technology: Microsoft Office 2013 suites
Credit toward certification: MOS

Skills measured
This exam measures your ability to accomplish the technical tasks listed below. The percentages indicate the relative weight of each major topic area on the exam. The higher the percentage, the more questions you are likely to see on that content area on the exam. View video tutorials about the variety of question types on Microsoft exams.

Please note that the questions may test on, but will not be limited to, the topics described in the bulleted text.

Do you have feedback about the relevance of the skills measured on this exam? Please send Microsoft your comments. All feedback will be reviewed and incorporated as appropriate while still maintaining the validity and reliability of the certification process. Note that Microsoft will not respond directly to your feedback. We appreciate your input in ensuring the quality of the Microsoft
Certification program.

If you have concerns about specific questions on this exam, please submit an exam challenge.


Create and manage documents
Create a document
Creating new blank documents, creating new documents using templates, importing files, opening non-native files directly in Word, opening a PDF in Word for editing
Navigate through a document
Searching for text within document, inserting hyperlinks, creating bookmarks, using Go To
Format a document
Modifying page setup, changing document themes, changing document style sets, inserting simple headers and footers, inserting watermarks, inserting page numbers
Customize options and views for documents
Changing document views, using zoom, customizing the quick access toolbar, customizing the ribbon, splitting the window, adding values to document properties, using show/hide, recording simple macros, assigning shortcut keys, managing macro security
Configure documents to print or save
Configuring documents to print, saving documents in alternate file formats, printing document sections, saving files to remote locations, protecting documents with passwords, setting print scaling, maintaining backward compatibility

Preparation resources
Basic tasks in Word 2013
Create your first Word 2013 document (training)
Move around in a document using the navigation pane

Format text, paragraphs, and sections
Insert text and paragraphs
Appending text to documents, finding and replacing text, copying and pasting text, inserting text via AutoCorrect, removing blank paragraphs, inserting built-in fields, inserting special characters
Format text and paragraphs
Changing font attributes, using find and replace to format text, using format painter, setting paragraph spacing, setting line spacing, clearing existing formatting, setting indentation, highlighting text selections, adding styles to text, changing text to WordArt, modifying existing style attributes
Order and group text and paragraphs
Preventing paragraph orphans, inserting breaks to create sections, creating multiple columns within sections, adding titles to sections, forcing page breaks

Preparation resources
Insert fields
Copy formatting using the format painter
Add a page break

Create tables and lists
Create a table
Converting text to tables, converting tables to text, defining table dimensions, setting AutoFit options, using quick tables, establishing titles
Modify a table
Applying styles to tables, modifying fonts within tables, sorting table data, configuring cell margins, using formulas, modifying table dimensions, merging cells
Create and modify a list
Adding numbering or bullets, creating custom bullets, modifying list indentation, modifying line spacing, increasing and decreasing list levels, modifying numbering

Preparation resources
Insert a table
Convert text to a table or a table to text
Change bullet style

Apply references
Create endnotes, footnotes, and citations
Inserting endnotes, managing footnote locations, configuring endnote formats, modifying footnote numbering, inserting citation placeholders, inserting citations, inserting bibliography, changing citation styles
Create captions
Inserting endnotes, managing footnote locations, configuring endnote formats, modifying footnote numbering, inserting citation placeholders, inserting citations, inserting bibliography, changing citation styles

Preparation resources
Add footnotes and endnotes
Create a bibliography

Insert and format objects
Insert and format building blocks
Inserting quick parts, inserting textboxes, utilizing building locks organizer, customizing building blocks
Insert and format shapes and SmartArt
Inserting simple shapes, inserting SmartArt, modifying SmartArt properties (color, size, shape), wrapping text around shapes, positioning shapes
Insert and format images
Inserting images, applying artistic effects, applying picture effects, modifying image properties (color, size, shape), adding uick styles to images, wrapping text around images, positioning images

Preparation resources
Quick parts
Change the color of a shape, shape border, or entire SmartArt graphic
Move pictures or clip art

Click here to view complete Q&A of 77-418 exam

Best Microsoft MCTS Certification, Microsoft 77-418 Training at certkingdom.com

70-695 Deploying Windows Desktops and Enterprise Applications

70-695 Deploying Windows Desktops and Enterprise Applications
Published: January 23, 2015
Languages: English
Audiences: IT professionals
Technology: Windows 8.1, Windows Server 2012 R2
Credit toward certification: MCP, MCSE

Skills measured
This exam measures your ability to accomplish the technical tasks listed below. The percentages indicate the relative weight of each major topic area on the exam. The higher the percentage, the more questions you are likely to see on that content area on the exam. View video tutorials about the variety of question types on Microsoft exams.

Please note that the questions may test on, but will not be limited to, the topics described in the bulleted text.

Do you have feedback about the relevance of the skills measured on this exam? Please send Microsoft your comments. All feedback will be reviewed and incorporated as appropriate while still maintaining the validity and reliability of the certification process. Note that Microsoft will not respond directly to your feedback. We appreciate your input in ensuring the quality of the Microsoft Certification program.

If you have concerns about specific questions on this exam, please submit an exam challenge.

Implement the Operating System Deployment (OSD) infrastructure (21%)
Assess the computing environment
Configure and implement the Microsoft Assessment and Planning (MAP) Toolkit, assess Configuration Manager reports, integrate MAP with Microsoft System Center 2012 Configuration Manager, determine network load capacity
Plan and implement user state migration
Design considerations, including determining which user data and settings to preserve, hard-link versus remote storage, mitigation plan for non-migrated applications, and wipe-and-load migration versus side-by-side migration; estimate migration store size; secure migrated data; create a User State Migration Tool (USMT) package
Configure the deployment infrastructure
Configure Windows Deployment Services (WDS), install and configure Microsoft Deployment Toolkit (MDT), identify network services that support deployments, select Configuration Manager distribution points, support BitLocker
Configure and manage activation
Configure KMS, MAK, and Active Directory–based activation; identify the appropriate activation tool

Implement a Lite Touch deployment (18%)
Install and configure WDS
Configure unicast/multicast, add images to WDS, configure scheduling, restrict who can receive images
Configure MDT
Configure deployment shares, manage the driver pool, configure task sequences, configure customsettings.ini
Create and manage answer files
Identify the appropriate location for answer files, identify the required number of answer files, identify the appropriate setup phase for answer files, configure answer file settings, create autounattend.xml answer files

Implement a Zero Touch deployment (20%)
Configure Configuration Manager for OSD
Configure deployment packages and applications, configure task sequences, manage the driver pool, manage boot and deployment images
Configure distribution points
Configure unicast/multicast, configure PXE, configure deployments to distribution points and distribution point groups
Configure MDT and Configuration Manager integration
Use MDT-specific task sequences; create MDT boot images; create custom task sequences, using MDT components

Create and maintain desktop images (21%)
Plan images
Design considerations, including thin, thick, and hybrid images, WDS image types, image format (VHD or WIM), number of images based on operating system or hardware platform, drivers, and operating features
Capture images
Prepare the operating system for capture, create capture images using WDS, capture an image to an existing or new WIM file, capture an operating system image using Configuration Manager
Maintain images
Update images using DISM; apply updates, drivers, settings, and files to online and offline images; apply service packs to images; manage embedded applications

Prepare and deploy the application environment (20%)
Plan for and implement application compatibility and remediation
Planning considerations, including RDS, VDI, Client Hyper-V, and 32 bit versus 64 bit; plan for application version co-existence; use the Application Compatibility Toolkit (ACT); deploy compatibility fixes
Deploy Office 2013 by using MSI
Customize deployment, manage Office 2013 activation, manage Office 2013 settings, integrate Lite Touch deployment, re-arm Office 2013, provide slipstream updates
Deploy Office 2013 by using click-to-run (C2R)
Configure licensing, customize deployment, configure updates, monitor usage by using the Telemetry Dashboard

Click here to view complete Q&A of 70-695 exam

Best Microsoft MCTS Certification, Microsoft 70-695 Training at certkingdom.com

From start to finish, inside a PayPal Phishing scam

One of the world's most targeted brands...

PayPal is one of the most commonly targeted brands for Phishing, nearly equal to banks when it comes to potential financial gain for criminals.

Today, we're revisiting the concept of how to spot a Phishing email by focusing on a recent Phishing campaign that's targeting PayPal customers. We'll start by pointing out visual cues that will help you avoid becoming a victim, but we'll also go thorough the scam completely so you can see what it looks like.

It starts with an email
This is what the Phishing email looks like once opened.

Phishing remains one of the fastest and easiest methods of personal compromise. With this type of attack, criminals play a numbers game. The more messages they send, the more likely someone is going to fall for the scam.

Even if the victim count is low, the cost of a Phishing campaign is next to nothing on the criminal's end – a single victim often covers all costs.

Sadly, dozens of people are likely to be scammed in a given campaign, so Phishing has become a turnkey business for most criminals. Each campaign is different, often targeting personal information, financial information, or in this case - both.

Moving on, let's examine some of the visual cues that will debunk this alleged warning.

Email addresses
Notice that the support address isn't a PayPal address. That's important.

But after that, the "via" marking in the "From:" field is Google's way of telling you that the email you're reading was sent from an account other than the one listed. If this were an actual email from PayPal, Google wouldn't offer this visual cue.

"Gmail displays this information because many of the services that send emails on behalf of others don’t verify that the name that the sender gives matches that email address. We want to protect you against misleading messages from people pretending to be someone you know," Google explains.

In this case, the criminal compromised a website and used the webhost's server to send the message. If this message arrives outside of Gmail, the fact that the sender doesn't use a PayPal address is the first clue that something isn't right.

Other than that, the email's subject is all wrong too. It's attempting to stress a point and relay a false sense of urgency, but the fact that it doesn't name "account" in question increases the odds that curiosity will get the better of you and you'll open the message.

Message Body: Where the Phishing scam will either live or die
To the untrained eye, the message is letting you know that your PayPal account is limited, and that there is a time limit for resolution. Again, this is injecting a false sense of urgency – and if you rely on PayPal, the fact you might lose access to your account is a serious issue.

The message explains itself as a security measure, and warns that your PayPal account might be in danger of compromise, resulting in theft. Ironic really, because theft is the name of the game here. Once more, the criminals are pressing fear as the main motivator. The fix is simple; just confirm your information by following the link.

To the trained eye, the message is a false as can be. First, PayPal will always use the registered account name when addressing messages, so they'll never address a security email simply as "PayPal Customer."

Second, the message itself is just an image. The criminal created a link to their domain, and used an image instead of the text link that most everyone is used to on the Web.

Using the image helps the message bypass many basic spam filters. The fact that the message was relayed through a compromised account that had never sent spam before also helped it avoid detection.

Turn back now...
If for some reason a person were to click the link, the URL displayed would be the final torpedo needed to sink this Phishing scam. There is no HTTPS and the domain clearly IS NOT a domain controlled by PayPal.

Please note, that the URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

The following images are what the Phishing scam will look like in action. Each slide will explain what's happening on screen.

Usernames and passwords
Entering your username and password into the field from the previous slide triggers a number of checks by the Phishing script that created this domain. However, at this stage your PayPal username and password have been stolen.

But the scammer isn't done.

This screen should be familiar to anyone who uses PayPal. If so, there's a reason for that. The color in the images, the way the website is designed, and the URL bar that's full of letters and numbers are all there to fool you into thinking you're on PayPal's website.

But remember, you're not, and the missing HTTPS is proof that PayPal isn't involved here.

Again, the URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

Confirmation required
Once the loading screen goes away, the second part of the scam starts. Remember, at this stage your PayPal username and password have been compromised. However, in the criminal's opinion, why stop there?

If you fell for the first part, the crook running this scam feels that you'll fall for the second part too, which focuses on personal and financial information.

This might get old, but it's important. The URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

Tell us a little about yourself
After the loading screen, you'll be asked to confirm information. If you agree, you'll see this screen. Here the criminal is able to build a profile on your information. The data collected here can be sold, or used to further additional scams – including identity theft.

Given that the scam needed information, CSO provided a false name, the address for Hoboken City Hall in New Jersey, and a phone number to book a room at the Holiday Inn.

But the criminal isn't done.
This might get old, but it's important. The URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

Credit cards
Now that the criminal has your personal information, this form will look for some financial data – namely your credit card details.

This page, as well as all the others, has been designed to look exactly like PayPal. For those that are trained to look for a padlock, but forget where it is, the message at the bottom of the page is there for reassurance. But nothing on this page is secure.

Again, the URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

Banking data
The last bit of information the criminal will ask about is banking data. This form serves two functions; first it collects the login data and account number for your bank. The second is that it enables the crook to see if you're recycling passwords.

Assuming the PayPal password is the same as the bank; it's a good indicator that you're using the same password everywhere. If not, the crook can use this information to run a number of additional scams and leverage the collected details to compromise other accounts under your control.

The URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

End of the line
This is the end of the scam. The entire thing was designed to make you feel as if you were dealing with PayPal the entire time. However, at this stage your banking information, personal information, credit card details, and PayPal account have all been compromised. There's no going back.

The keep things moving, this page will remain for a few seconds before you're forwarded to the final stop.

The URL shown in this image was live at the time this article was written, do not visit it. The webhost has taken the domain offline, but this URL could be pointed to a new location in the future.

It's as if nothing happened
The final stop in the scam is the actual PayPal website. If you look at the address bar the URL has an HTTPS and the area where the padlock exists has both the company name and is green.

Again, the previous slides you've seen were all part of the scam. So the fact that the legitimate PayPal website is on the screen now means nothing; the forms were all submitted and somewhere a criminal is abusing your information in a number of creative ways.

When it comes to Phishing, avoiding them 100 percent of the time can be tricky. However, it isn't an impossible task. When in doubt, don't click anything in the email and visit the website in question (e.g. PayPal) directly.

Remember, email is the last method banks or financial firms will use to contact you in a majority of cases. Online, pay attention to the address bar and look for HTTPS when you're about to enter personal or financial information into a form.

Best Paypal Certification, Paypal Training at certkingdom.com

Exam 70-695 Deploying Windows Desktops and Enterprise Applications

Exam 70-695 Deploying Windows Desktops and Enterprise Applications

Skills measured
This exam measures your ability to accomplish the technical tasks listed below. The percentages indicate the relative weight of each major topic area on the exam. The higher the percentage, the more questions you are likely to see on that content area on the exam. View video tutorials about the variety of question types on Microsoft exams.

Please note that the questions may test on, but will not be limited to, the topics described in the bulleted text.

Do you have feedback about the relevance of the skills measured on this exam? Please send Microsoft your comments. All feedback will be reviewed and incorporated as appropriate while still maintaining the validity and reliability of the certification process. Note that Microsoft will not respond directly to your feedback. We appreciate your input in ensuring the quality of the Microsoft Certification program.

If you have concerns about specific questions on this exam, please submit an exam challenge.

Implement the Operating System Deployment (OSD) infrastructure (21%)
Assess the computing environment
Configure and implement the Microsoft Assessment and Planning (MAP) Toolkit, assess Configuration Manager reports, integrate MAP with Microsoft System Center 2012 Configuration Manager, determine network load capacity
Plan and implement user state migration
Design considerations, including determining which user data and settings to preserve, hard-link versus remote storage, mitigation plan for non-migrated applications, and wipe-and-load migration versus side-by-side migration; estimate migration store size; secure migrated data; create a User State Migration Tool (USMT) package
Configure the deployment infrastructure
Configure Windows Deployment Services (WDS), install and configure Microsoft Deployment Toolkit (MDT), identify network services that support deployments, select Configuration Manager distribution points, support BitLocker
Configure and manage activation
Configure KMS, MAK, and Active Directory–based activation; identify the appropriate activation tool

Implement a Lite Touch deployment (18%)
Install and configure WDS
Configure unicast/multicast, add images to WDS, configure scheduling, restrict who can receive images
Configure MDT
Configure deployment shares, manage the driver pool, configure task sequences, configure customsettings.ini
Create and manage answer files
Identify the appropriate location for answer files, identify the required number of answer files, identify the appropriate setup phase for answer files, configure answer file settings, create autounattend.xml answer files

Implement a Zero Touch deployment (20%)
Configure Configuration Manager for OSD
Configure deployment packages and applications, configure task sequences, manage the driver pool, manage boot and deployment images
Configure distribution points
Configure unicast/multicast, configure PXE, configure deployments to distribution points and distribution point groups
Configure MDT and Configuration Manager integration
Use MDT-specific task sequences; create MDT boot images; create custom task sequences, using MDT components

Create and maintain desktop images (21%)
Plan images
Design considerations, including thin, thick, and hybrid images, WDS image types, image format (VHD or WIM), number of images based on operating system or hardware platform, drivers, and operating features
Capture images
Prepare the operating system for capture, create capture images using WDS, capture an image to an existing or new WIM file, capture an operating system image using Configuration Manager
Maintain images
Update images using DISM; apply updates, drivers, settings, and files to online and offline images; apply service packs to images; manage embedded applications

Prepare and deploy the application environment (20%)
Plan for and implement application compatibility and remediation
Planning considerations, including RDS, VDI, Client Hyper-V, and 32 bit versus 64 bit; plan for application version co-existence; use the Application Compatibility Toolkit (ACT); deploy compatibility fixes
Deploy Office 2013 by using MSI
Customize deployment, manage Office 2013 activation, manage Office 2013 settings, integrate Lite Touch deployment, re-arm Office 2013, provide slipstream updates
Deploy Office 2013 by using click-to-run (C2R)
Configure licensing, customize deployment, configure updates, monitor usage by using the Telemetry Dashboard

Click here to view complete Q&A of 70-695 exam

Best Microsoft MCTS Certification, Microsoft 70-695 Training at certkingdom.com

10 key moments in the history of Apple and Microsoft

Apple and Microsoft recently renewed their alliance with the goal of tackling the enterprise market, but the latest partnership is just the most recent turning point in the two companies' intertwined histories. Here are the defining moments that led up to the new pact.

Apple and Microsoft's history of highs and lows
Apple and Microsoft share a common history and bond in the evolution of personal computing. Relations between the two technology pioneers were generally cordial when they were founded in the 1970s, but that sense of mutual respect quickly turned to discord. The founders of both companies were at loggerheads often in the past. Today their new leaders appear determined to bury the hatchet and partner for greater opportunities in the enterprise.

Youthful innocence of the early '80s
Microsoft was a critical Apple ally during the first Macintosh's development. At an Apple event in 1983, Microsoft CEO Bill Gates told attendees Microsoft expected to earn half of its revenues selling Macintosh software the following year. He called the Macintosh, "something that's really new and really captures people's attention."

Jobs ousted from Apple, forms NeXT
In 1985, Apple CEO Steve Jobs was ousted from the company he cofounded nine years earlier. He immediately sold all but one share in Apple to fund the launch of NeXT, where he would spend the next 12 years building computer workstations for higher education and business.

Jobs says Microsoft has 'no taste'
"The only problem with Microsoft is they just have no taste," Jobs said in the 1996 "Triumph of the Nerds" TV documentary. "They have absolutely no taste. And I don't mean that in a small way, I mean that in a big way, in the sense that they don't think of original ideas, and they don't bring much culture into their products."

Jobs returns to Apple, partners with Microsoft
When Apple acquired NeXT in 1997 and brought Steve Jobs back into the fold, the company was in disarray amid growing uncertainty about the future of Microsoft Office for Mac. During his keynote address at the Macworld Expo that year, Jobs extolled the virtues of partnering with industry leaders and spoke of the need to improve Apple's partner relations.

Gates addresses the Apple faithful in 1997
"Microsoft is going to be part of the game with us as we restore this company back to health," Jobs said at Macworld, before asking Gates to address the crowd via satellite.

"We think Apple makes a huge contribution to the computer industry," Gates said. "We think it's going to be a lot of fun helping out."

Gates and Jobs take the stage together in 2007
A seminal moment occurred between the leaders of both companies when Gates and Jobs jointly took the stage for an interview at the D5 conference. Both men praised each other in their own ways. Jobs commended Gates for building the first software company in the world, but Gates was more flattering. "What Steve's done is quite phenomenal," he said.

'Memories longer than the road ahead'
When Jobs was asked to describe the greatest misunderstanding of his relationship with Gates, he said: "I think of most things in life as either a Bob Dylan or a Beatles song, but there's that one line in that one Beatles song — 'You and I have memories longer than the road that stretches out ahead' — and that's clearly very true here."

Apple invites Microsoft exec on stage for iPad demo
A new era of partnership buoyed by opportunities in the enterprise began to blossom in the early-2010s. At Apple's September 2015 new product event in San Francisco, the company invited Kirk Koenigsbauer, vice president of Microsoft Office, on stage to demonstrate Office 365 apps working in split-screen mode on an iPad Pro.

Microsoft CEO uses iPhone at Dreamforce
At Salesforce's 2015 Dreamforce conference, Microsoft CEO Satya Nadella demoed the company's iOS apps on an iPhone. When Nadella did the once unthinkable, using an iPhone on stage, he acknowledged it as such but also made clear that it wasn't his phone. "It is a pretty unique iPhone," he said. "I like to call it the iPhone Pro because it has all the Microsoft software and applications on it … It's pretty amazing."

Apple CEO Tim Cook doesn't hold a grudge
During a keynote at cloud-storage company Box's BoxWorks conference in September 2015, when asked about the company's renewed relationship with Microsoft, Apple CEO Tim Cook said he doesn't believe in holding grudges. "If you think back in time, Apple and IBM were foes. Apple and Microsoft were foes," Cook said. "Apple and Microsoft still compete today, but frankly Apple and Microsoft can partner on more things than we could compete on, and that's what the customer wants."

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

5 ways, shore, security, BYOD strategy

Ask most computer pros to talk about IT security, and you’ll likely hear about all sorts of external threats, like malware, hackers, spyware, DOS attacks and the like. But what if the bigger – and more costly – threat comes from within?

The now infamous Ashley Madison website has had a pretty successful run at helping its clientele be disloyal. So perhaps some would view it as poetic justice if the website became one of the most scandalous breaches in history at the hands of one of its own.

At least that is the conclusion of IT security analyst John McAfee, who noted recently “yes, it is true. Ashley Madison was not hacked – the data was stolen by a woman operating on her own who worked for Avid Life Media.”

If true, the fact that the Ashley Madison breach was due to an internal, and not external, threat shouldn’t come as too big a surprise. Many IT security studies this year have pointed to the growing threat of insider data theft and corporate breaches.

In some cases, insider threats can be more financially damaging and more difficult to defend against. After all, external threats involve someone trying to break in. The insider threat already has the keys to the front door and knows where the family jewels are stored.

Still, external and internal threats often share one key motive – the desire to profit from data. With external threats, hackers are traditionally looking to steal data that they can sell in the black market. With internal threats, the incident may involve an employee – or former employee – looking to cash in on something they developed or strategic information that competitors want.

That was the case this January in Boston, when the Proctor & Gamble Company filed suit against four former Gillette Company employees, accusing them of wrongfully using and disclosing confidential information and trade secrets to a direct competitor.

In July, an employee of Merit Health Northwest Mississippi was accused of removing patient information from the facility over a two year period without authorization. The employee reportedly stole patient names, addresses, dates of birth, Social Security numbers, health plan information and clinical information, all for the purpose of identity theft.

Perhaps the most difficult to defend against is the disgruntled employee, notes Jane LeClair, chief operating officer at the National Cybersecurity Institute, which tracks data breach incidents. One might be tempted to think the NCI spends the lion’s share of its time on external data breaches, but insider threats have become a top concern.

“Insider threats are something that most organizations don’t have a terribly high focus on today,” LeClair believes. “I think there is a lot to be done in that area. We, as Americans, are really a very trusting people. So it’s hard for a lot of organizations – especially smaller organizations – [to view employees as a primary threat].”

Obviously most aren’t. But enough are, or could be, that employers need to be looking over both shoulders – one facing outside and the other in, LeClair indicates.

“In many cases, when we talk insider threat, the person may no longer be with the company – so if you add that piece to the definition you can see why it becomes pretty big; much bigger than people probably think about,” LeClair notes. “People who leave may be angry or frustrated, or are laid off. You can understand why the company wants to get them out quickly because they can have that need for revenge in some cases.”

Or they may still be with the company but are disengaged.
“They feel unappreciated or unfulfilled. They are hard workers but they don’t feel that the organization is appreciating them or recognizing them, or perhaps not paying them what they feel they’re worth. That’s another level of dissatisfaction that is very frequently thought about. I would say that’s probably one of the bigger reasons.”

Then there is a relatively new insider threat which may prove to be among the most dangerous – the politically motivated perpetrator.

“I’ve always looked at from the human perspective,” explains Candy Alexander, an IT security consultant and former chief information security officer. “It’s important to note if you are a security person or an IT person to pay attention to what is going on in our society with current events. It will be reflected into the electronic world. In our society and culture today there is a lot of intolerance for lots of things. We’re seeing that through sorts of events.”

A different moral compass
Could social conscious be a motivating factor in the Ashley Madison case? It’s still too early to tell, but some IT security experts tell CIO that it is certainly possible.

Since word of the Ashley Madison breach broke in July, many IT security experts and forensics professionals began debating the source of the attack, which revealed the email addresses of millions of account holders and site visitors. Many immediately suspected an insider threat, since the culprit(s) seemed to know too much about the firm’s technology.

Clearly some individual, or individuals, had an all access pass to the company’s systems.

Accidental exposure
Many top IT security experts believe that the most common form of insider data threat is that of accidental exposure – an employee unintentionally and unwittingly creating a vulnerable situation or allowing data to be accessed. That certainly accounts for many threat incidents.

“All companies are going to have the possibility of this occurring because accidents do commonly occur, and I do believe that accidental exposure is much more common than intentional harm,” explains Meg Anderson, chief information security officer at Principal Financial Group.

“So lack of awareness is one cause of accidents – such as lost laptops, misdirected email, even paper reports that are still walking out of companies,” Anderson says. “Those are relatively small incidents. But we also have data on all kinds of new devices now, so we’ve added possibilities of iPhones being hacked, tablets, etc.” They all run the risk of financial loss, fines, lost customers, plus the potential loss of reputation.

Insider threats also vary depending on what the organization does and the type of data it collects, Anderson says.

“There are a lot of scenarios and I think a lot of it depends on the organization. You cannot discount financial gain. There are going to be insiders that want to make money on your data and on your intellectual property. It could involve insider trading – having authorized access and passing that along to somebody else. “

“The third thing I can think of is that a lot of times employees think that they own what they work on while they’re at work. One thing that is often compromised is source code – programmers thinking they own their source code. They may also be temporary contract employees that work for us. They take that code from company to company, because you do reuse code, and it makes sense to them that it is their property.”

Still, Anderson agrees that it the disgruntled employee that probably poses the greatest theat.

“When we talk about intentional damage it could be far more impactful because it’s less likely to be noticed and it also could go on for some time – a ‘slow flow’ sort of approach,” Anderson says.

To spot a thief
So how do you spot the potential data thief in your midst?

It starts with observing behavior, notes Ganesan (Ravi) Ravishanker, CIO at Wellesley College, in Massachusetts.

“We do the usual best practices,” Ravishanker says. “Most of us rely on the annual audit. We create the best practice controls and do the best we can. We also rely on the business units to partner with us to be able to develop controls, to develop reports; we do have very comprehensive reports that we generate on which users have access to what data. That gets adjusted because people’s roles change. We need to make sure that we keep people’s access as limited as possible.”

But technology is only part of the solution. It is equally important is to watch for changes in user behavior, Ravishanker says.

“One of the big things is really looking at changes in employee behavior,” LeClair agrees. “Maybe their work performance is dropping off or they’re arriving later. Conceivably it could even be better work performance in that they’re grabbing data. Or behavior toward other employees might be something that you notice.”

Finally, in addition to all the best security practices that an organization should focus on, the bottom line is how well the organization treats its workers.

“The thing I feel best about is that we have a Best Place to Work, and it’s on the Best Place to Work list for a reason,” Anderson concludes. “I do think that if you have fully engaged employees that feel appreciated and that their work is being recognized, they are less likely to feel that they want to commit crime on the job.”

Click here to view complete Q&A of 70-642 exam

Best Microsoft MCTS Certification, Microsoft 70-642 Training at certkingdom.com

Three key challenges in vulnerability risk management

This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter’s approach.

Vulnerability risk management has re-introduced itself as a top challenge – and priority – for even the most savvy IT organizations. Despite the best detection technologies, organizations continue to get compromised on a daily basis. Vulnerability scanning provides visibility into potential land mines across the network, but often just results in data tracked in spreadsheets and independent remediation teams scrambling in different directions.

The recent Verizon Data Breach report showed that 99.9% of vulnerabilities exploited in attacks were compromised more than a year after being published. This clearly demonstrates the need to change from a “find” to “fix” mentality. Here are three key challenges to getting there:

* Vulnerability prioritization. Today, many organizations prioritize based on CVSS score and perform some level of asset importance classification within the process. However, this is still generating too much data for remediation teams to take targeted and informed action. In a larger organization, this process can result in tens of thousands – or even millions – of critical vulnerabilities detected. So the bigger question is – which vulnerabilities are actually critical?

Additional context is necessary get a true picture of actual risk across the IT environment. Organizations might consider additional factors in threat prioritization, such as the exploitability or value of an asset, the correlation between the vulnerability and the availability of public exploits, attacks and malware actively targeting the detected vulnerability, or the popularity of a vulnerability in social media conversations.

* Remediation process. The second and perhaps most profound challenge is in the remediation process itself. On average, organizations take 103 days to remediate a security vulnerability. In a landscape of zero-day exploits and the speed and agility at which malware developers operate, the window of opportunity is wide open for attackers.

The remediation challenge is most often rooted in the process itself. While there is no technology that can easily and economically solve the problem, there are ways to enable better management through automation that can improve the process and influence user behavior. In some cases, there are simple adjustments that can result in a huge impact. For example, a CISO at a large enterprise company recently stated that something as easy as being able to establish deadlines and automated reminder notifications when a deadline was approaching could vastly improve the communication process between Security and DevOps/SysAdmin teams.

In other words, synchronizing communication between internal teams through workflow automation can help accelerate the remediation process. From simple ticket and task management to notifications and patch deployment, the ability to track the remediation process within a single unified view can eliminate the need to navigate and update multiple systems and potentially result in significant time savings.

* Program governance. The adage, “You can’t manage it if you can’t measure it” is true when it comes to evaluating the success of a vulnerability risk management program. In general, information security programs are hard to measure compared to other operational functions such as sales and engineering. One can create hard metrics, but it is often difficult to translate those metrics into measurable business value.

There is no definitive answer for declaring success. For most organizations, this will likely vary depending on the regulatory nature of their industry and overall risk management strategy. However, IT and security teams demonstrate greater value when they can show the level of risk removed from critical systems.

Establishing the right metrics is the key to any successful governance program, but it also must have the flexibility to evolve with the changing threat landscape. In the case of vulnerability risk management, governance may start with establishing baseline metrics such as number of days to patch critical systems or average ticket aging. As the program evolves, new, and more specific, metrics can be introduced such as number of days from discovery to resolution (i.e., time when a patch is available to actual application).

Practitioners can start improving the process by making some simple changes. For example, most vulnerability assessment tools offer standard prioritization of risks based on CVSS score and asset classification. However, this approach is still generating too much data for remediation teams. Some organizations have started to perform advanced correlation with threat intelligence feeds and exploit databases. Yet, this process can be a full-time job in itself, and is too taxing on resources.

Technologies exist today to help ease this process through automation by enriching the results of vulnerability scan data with rich context beyond the CVSS score. Through correlation with external threat, exploit, malware, and social media feeds and the IT environment, a list of prioritized vulnerabilities is delivered based on the systems most likely to be targeted in a data breach. Automating this part of the process with existing technologies can help cut the time spent on prioritization from days to hours.

Today, vulnerability management has become as much about people and process as it is about technology, and this is where many programs are failing. The problem is not detection. Prioritization, remediation, and program governance have become the new precedence. It is no longer a question of if you will be hacked, but rather when, and most importantly, how. The inevitable breach has become a commonly accepted reality. Vulnerability risk management calls for a new approach that moves beyond a simple exercise in patch management to one focused on risk reduction and tolerable incident response.

Best Microsoft MCP Certification, Microsoft MCSE Training at certkingdom.com

Why (and how) VMware created a new type of virtualization just for containers

VMware says containers and virtual machines are better together

As the hype about containers has mounted over the past year, it has raised questions about what this technology – which is for packaging applications - means for traditional management and virtualization vendors. Some have wondered: Will containers kill the virtual machine?

VMware answered that question with a resounding no at its annual conference in San Francisco last week. But, company officials say containers can benefit from having a new type of management platform. And it’s built a whole new type of virtualization just for containers.
Virtualization for containers

A decade and a half ago, VMware helped revolutionized the technology industry with the introduction of enterprise-grade hypervisors that ushered in an era of server virtualization.

Last week the company revealed a redesigned version of its classic virtualization software named Project Photon. It’s a lightweight derivative of the company’s popular ESX hypervisor that has been engineered specifically to run application containers.

“At its core, it’s still got the virtualization base,” explains Kit Colbert, VMware’s vice president and CTO of Cloud Native Applications. Colbert calls Photon a “micro-visor” with “just enough” functionality to have the positive attributes of virtualization, while also being packaged in a lightweight format ideal for containers.

Project Photon includes two key pieces. One is named Photon Machine – a hypervisor software born out of ESX that is installed directly onto physical servers. It creates miniature virtual machines that containers are placed in. It includes a guest operating system, which the user can choose. By default Photon Machine comes with VMware’s customized Linux distribution named Photon OS, which the company has also designed to be container friendly.

The second major piece is named Photon Controller, which is a multi-tenant control plane that can handle many dozens, if not hundreds or thousands of instances of Photon Machine. Photon Controller will provision the clusters of Photon Machines and ensure they have access to network and storage resources as needed.

The combination of Photon Machine and Photon Controller creates a blueprint for a scale-out environment that has no single point of failure and exposes a single logical API endpoint that developers can write to. In theory, IT operators can deploy Project Photon and developers can write applications that run on it.

Project Photon will integrate with various open source projects, such as Docker for the container run-time support, as well as Google Kubernetes and Pivotil’s Cloud Foundry for higher-level application management. (Photon manages infrastructure provisioning while Kubernetes and CF manage application deployments.)

VMware's virtual approach to containers (3:30)

VMware has not yet set pricing for either platform, but both will be available this year as a private beta.
The journey to containers

Not all customers are ready to go all-in on containers though. So, VMware is also integrating container support into its traditional management tools.

VSphere Integrated Containers is a second product VMware announced that Colbert says is a good starting point for organizations that want to get their feet wet with containers. For full-scale container build outs, Colbert recommends transitioning to Project Photon.

VSphere Integrated Containers is a plugin for vSphere, the company’s venerable ESX management software. “It makes containers first-class citizens in vSphere,” Colbert explains. With the plugin, customers are able to deploy containers inside of a virtual machine, allowing the container in the VM to be managed just like any other VM by vSphere.

By comparison, currently if a user wanted to deploy containers in vSphere, they would likely deploy multiple containers inside a single virtual machine. Colbert says that has potentially harmful security implications though: If one of the containers in the VM is compromised, then the other containers in the VM could be impacted. By packaging one container inside each VM, it allows containers to be protected by the security isolation and baked in management features of vSphere.

Kurt Marko, an analyst at Marko Insights, says VMware’s approach to containers could be appealing to VMware admins who are being pressured to embrace containers. It could come with a downside, though.

“Wrapping Photon containers in a micro-VM makes it look like any other instance to the management stack and operators,” Marko wrote in an email. “Of course, the potential downside is lost efficiency since even micro-VMs will have more overhead than containers sharing the same kernel and libraries.” VMware says the VM-overhead is minute, but Marko says it will take independent analysis to determine if there is a tax for using containers inside VMs.
Hold your horses

As VMware attempts to position itself as a container company, there are headwinds. First, it is still very early on in the container market.

“The hype far outweighs the utilization” at this point, says IDC analyst Al Gillen, program vice president for servers and systems software. He estimates that fewer than 1/10 of 1% of enterprise applications are currently running in containers. It could be more than a decade before the technology reaches mainstream adoption with more than 40% of the market.

VMware also hasn’t traditionally been known as a company that leads the charge when it comes to cutting edge open source projects, which is a perception the company is fighting. Sheng Liang, co-founder and CEO of Rancher Labs – a startup that was showcasing its container operating system and management platform at VMworld - said the container movement has thus far been driven largely by developers and open source platforms like Mesos, Docker and Kubernetes – he hasn’t run into a single container user who is running containers in VMware environments, he said.

Forrester analyst Dave Bartoltti says that shouldn’t be surprising though. VMware has strong relations with IT operations managers, not developers who have been most enthusiastically using containers. Announcements the company has made at VMworld are about enabling those IT ops workers to embrace containers in their VMware environments. Other management vendors, like Red Hat, Microsoft and IBM are equally enthusiastically embracing containers. VMware’s argument though, is that containers and VMs are better together.

---

Best VmwareVCA-DCV Certification, VCAC510 Exams at certkingdom.com

Top 10 technology schools

Interested in going to one of the best colleges or universities to study technology? Here are the top 10 schools known for their computer science and engineering programs.

Top technology schools
Every year, Money releases its rankings of every college and university in the U.S., and not surprisingly, a number of those top schools are leaders in the tech space. Here are the top 10 technology schools, according to Money's most recent survey of the best colleges in America.

Stanford University
First on the list for not only technology colleges, but all colleges, Stanford University has an impressive 96 percent graduation rate. The average price for a degree is $178,731 and students earn, on average, $64,400 per year upon graduation. Stanford's global engineering program allows its 4,850 students to travel around the globe while studying engineering. There are nine departments in the engineering program: aeronautics and astronautics, bioengineering, chemical engineering, civil and environmental engineering, computer science, electrical engineering, management science and engineering, materials science and engineering, and mechanical engineering.

Massachusetts Institute of Technology
The Massachusetts Institute of Technology, located in Cambridge, Mass., is the second best technology school in the country, with a 93 percent graduation rate. The average net price of a degree comes in at a $166,855, but students can expect an average starting salary of $72,500 per year after graduating. As one of the top engineering schools, it's ranked number 1 for chemical, aerospace/aeronautical, computer and electrical engineering. The top employers for the 57 percent of graduates that enter the workforce immediately include companies like Google, Amazon, Goldman Sachs and ExxonMobil. Another 32 percent of students, however, go on to pursue a higher degree.

California Institute of Technology
Located in Pasadena, Calif., the California Institute of Technology has a graduation rate of 93 percent. The average cost of a degree is $186,122, and students earn an average starting salary of $72,300. CalTech, as it's often called, has departments in aerospace, applied physics and materials studies, computing and mathematical sciences, electrical engineering, environmental science and engineering, mechanical and civil engineering, and medical engineering. The prestigious college is also home to 31 recipients of the Nobel Peace Prize.

Harvey Mudd College
Harvey Mudd College in Claremont, Calif. has a strong technology program, putting it at number 4 on the list of top technology schools. The cost of tuition is also one of the highest on this list, at $196,551 for a degree. Graduates of Harvey Mudd earn an average of $76,400 early on in their careers and the graduation rate is 91 percent. The engineering program at Harvey Mudd College focuses on helping students apply their skills to real world situations. Students can also get professional experience and help solve design problems outside of the classroom through an engineering clinic.

Harvard University
Harvard University, located in Cambridge, Mass., technically ties with Harvey Mudd for top technology schools, and top overall colleges. The graduation rate is 97 percent and the average price of a degree is $187, 763 while graduates earn an average annual salary of $60,000 when starting their careers. At Harvard's Jon A. Paulson School of Engineering and Applied Sciences, which goes back as far as 1847, undergraduate students can study applied mathematics, biomedical engineering, computer science, electrical engineering, engineering sciences and mechanical engineering.

University of California at Berkeley
The University of California at Berkeley has a graduation rate of 91 percent, and students can get a degree for around $133,549. After graduation, the average salary for students starting out their careers is $58,300 per year. The electrical engineering and computer science division of the University of California at Berkeley has around 2,000 undergraduate students and is the largest department within the university.

University of Pennsylvania
The University of Pennsylvania, located in Philadelphia, Penn., has a graduation rate of 96 percent and the average cost of a degree is $194,148. Students graduating from UPenn and beginning out their careers earn an average annual starting salary of $59,200. The UPenn engineering department focuses on computer and information science. Students can study computer science, computer engineering, digital media design, networked and social systems engineering, computational biology as well as computer and cognitive science.

Rice University
Located in Houston, Rice University has a graduation rate of 91 percent and the average cost of a degree is $157,824. Upon graduation, the average starting salary for students comes in at $61,200 per year. Rice University has a Department of Computer Science where students can work in faculty research programs and describes the perfect computer science student as a "mathematician seeking adventurer," a quote from system architect Bob Barton. In the electrical and computer engineering department, students can prepare for a career in oil and gas, wearables, entertainment, renewable energy, gaming, healthcare, space industry, security and aviation.

Brigham Young University-Provo
Brigham Young University-Provo, located in Provo, Utah, has a graduation rate of 78 percent, but students won't have as many loans as other colleges on this list. The average price of a degree is a moderate $80,988 and the average starting salary for graduates is around $51,600 per year. Brigham Young University-Provo offers degrees in electrical engineering, computer engineering and computer science. With a wide array of programs to choose from in each degree, Brigham Young University-Provo boasts a rigorous course load with an emphasis on gaining practical skills for the workforce.

Texas A&M University
College Station, Texas is home to Texas A&M University where 79 percent of students graduate and the average cost of a degree is $84,732. Students can expect to earn an average starting salary of $54,000 per year after graduation. The Texas A&M computer science and engineering program boasts an "open, accepting, and compassionate community that encourages the exploration of ideas." Students should expect to leave the program prepared to help solve real-world challenges in the technology industry through applied research.

---

Best Cisco CCNP Training, Cisco 400-101 Training at certkingdom.com

9 tips for dealing with toxic coworkers

Negative people in the workplace can take a toll on both your sanity and health. But before you point fingers ensure you've done you're part to build a healthy relationship. Here experts discuss techniques for dealing with difficult behaviors.

No two people are exactly alike, but people do they do share traits - and those traits aren't always positive. Some prefer drama or negative attention. They are everywhere, including the workplace. They might be on your team or sit in a nearby cubicle. It could be your boss, a vendor, direct report or a coworker. They're combative, critical or nonproductive.

Unless you are very lucky, some probably work with you. You aren't likely to change them, so the best you can do is come up with a plan to mitigate the misery. We spoke with IT leaders as well as a mental healthcare professional to find out the best strategy to help reduce the drama and negativity in your work day.

Don't label people, label behaviors
There is a danger in labeling people as toxic, according to Pamela D. Garcy, Ph.D., a clinical psychologist, career coach and author of the book, "How to make time when you don't have any: A new approach to reclaiming your schedule." Instead she recommends labeling the negative or toxic behavior. That's not to say that it isn't an employee's responsibility to behave well, but first you should return power to yourself, she says.

Understanding the behavior will help you identify the root of the problem and will likely help you build a strategy for having a more productive relationship with the person, whether it's your boss, a co-worker or a direct report. "Labeling and rating people limits you. You cannot see the potential in front of you because you're blinded by the label. Label the behavior instead of the person, if possible -- even if only as a mental exercise," says Garcy.
Are you part of the problem or solution?

It's easy to say it's all the other person's fault, but there are two sides to every coin. Are you contributing to the toxic behavior? Do you let this person's toxic behavior upset or frustrate you? Are you being pulled into the downward emotional spiral? More importantly what can you do to prevent this from happening?

"Be introspective. How are you contributing to the undesired behaviors and what is within your control to improve the situation," says Dustin Wells, chairman & CEO of Headspring, a provider of enterprise software strategies and development. The bottom-line is don't let your action or inaction add make a bad situation worse.

Change your perspective
Some things are out of your control. Chances are you aren't going to change this person, so your best bet is to focus on what you can control. That requires a change in perspective. Without the right perspective, warns Pamela Rucker, chair of the Technology Advisory Council for St. Jude Research Hospital and chair for the CIO Executive Council's Women in Leadership board, every issue may feel like a personal affront.

"Changing your perspective helps you cancel out the negative story you've told yourself about why the person doesn't like you, or why the person is working against you. If you can change your belief system at the root, then everything else that comes out of that will change, "she says.

Taking some time for yourself and changing your own perspective can help you adopt a more level-headed approach. Don't allow yourself to dwell on this person's behavior and get sucked into an emotional tailspin. Instead try to think of a solution. "You have at least two choices -- focusing on the problems or focusing on creating solutions.

Staying away from people-rating and focusing on problem-solving will help you. If you change your perspective to focus upon solutions, you're more likely to gain solutions. People-rating tends to stop you in your tracks... "says Garcy.

Style clash or toxic behavior?
Another important factor, according to Rucker, is to ensure you've made an important distinction. Are these people difficult to work with or toxic?

Difficult employees are those you say are opinionated or hard to get along with. They are sometimes protective of their turf, overzealous or stuck in their way of thinking. "It can seem like you're never able to get on the same page with a difficult person, and at times, it feels like every conversation you have with them is hard, says Rucker. However, she notes, that many times when you get to the heart of the matter, it may simply be a result of style clash and you're way of doing things may be contributing.

"I've found out that in many cases, the source of my difficulty in working with individuals can be a matter of relationship or style. This took a while for me to figure out over the course of my career, because I took people's behavior personally, and thought when people behaved badly they were deliberately being jerks and trying to give me a hard time. What I realized, though, was that I had a lot more to do with the difficulty of the interaction than I initially thought," says Rucker. She says she needed to step back and develop stronger relationships with certain people and take the time to understand their style and way of doing things. When she did, the result was a more productive working relationship.

Toxic employees, on the other hand, are dealing with more than just the ordinary issues of relationship and style. These are the employees who can spread negativity in your organization like a cancer. "Whether it's anger, fear, distrust, shame, hurt, abandonment, you name it, the toxic person has something inside of them that hurts those they come in contact with, and damages the fabric of a team, "says Rucker.

Build a better relationship
Rucker also notes that she needed to work on helping these individuals get to know her in return. Learning this lesson has allowed her to flip many difficult relationships into successful outcomes. "The more I developed relationships with people, understood their style and learned how to communicate with them in ways that resonated with them, the easier it became to work with others, " says Rucker. "I had to realize that to other people, I was the one that was difficult to deal with. I was the one that was deliberately misleading, I was the one that had a takeover mentality, and I was the one always looking for a fight."
Set boundaries on your time

You may assume a coworker can control your emotions and suck you in, but people often-times have more control over the situation than they may think, according to Garcy, "Often there is at least a small moment when you have a decision to make. There's that microsecond of freedom when you make a choice; that's moment when you can say to yourself, 'I don't want to encourage or engage in this drama.' At that moment, decide that you're going to do whatever you can to politely create a boundary. Make it your practice to gently and politely tell this person what you will and won't do. It will probably take a lot of repetition. Focus upon your own behavior. Realize that it is going to take time before this person takes your boundaries seriously and learns that they are there."

Since you can't change the other person's behavior directly, the safest bet is to tell them what you are going or not going to do. For example, you might try saying something along the lines of, "I'm going back to work now," or, "I'm not going to spend my work time on non-work items."

If this person is someone who you know is going to take up a lot of your time, Rucker recommends trying this approach: "I set the tone when I start talking by stating, 'I only have a few moments, but I want to catch up with you on how things are going. What's the latest update with your issue?'" This will let the other individual know that you are concerned, but also prepares them for you to move onto another subject without taking up an inordinate amount of your time.

Identify the real issue for you
Is the coworker's behavior impacting your work? If the answer is yes, try to communicate with the coworker at a time and in a place that allows your coworker some dignity. Then explain the situation.

"The formula I usually give to a coachee in this circumstance is [to] relax yourself so that you can practice assertive communication with your co-worker, seek a win-win solution, talk to yourself optimistically throughout the challenging moments, and increase your own daily self-care," says Garcy.

If you feel like you've exhausted those avenues than maybe it's time to talk to your manager or supervisor and get some assistance from them.

Grow your emotional intelligence
Whether you're an IT leader or an entry-level help desk analyst, emotional intelligence will help you understands people's motivations and their behaviors, allowing you to empathize with them and perhaps change your perspective.

"Emotional intelligence helps you deal with difficult or toxic people from a rational standpoint, allowing you to focus on the facts of the relationship by recognizing and managing your emotions as compared to those of the difficult person. It is important that one understands the situation properly and doesn't overreact or take things personal," says John DiCamillo, CTO and head of infrastructure & services for Arup, an independent firm of designers, planners, engineers, consultants and technical specialists.

This doesn't happen by itself. There are many avenues for professional development in the area of emotional intelligence like a career coach or leadership seminars. Do your part and continue to educate and grow. "Emotional intelligence is a multiplier effect for both the individual and the business. It can't replace technical excellence, but it can multiply the business advantage for the company. And, it can multiply the effectiveness for the individual," says Larry Bonfante, founder of CIO Bench Coach and CIO of USTA.

Take care of yourself
One of Garcy's recurring theme is self-care. It might seem obvious, but it's often overlooked. "Get plenty of sleep, eat healthy foods, exercise, spend time with positive people, and reconnect with yourself," says Garcy. Doing so can only increase your odds of a better outcome and will help you lead a healthier, more manageable lifestyle. Find ways to reduce stress levels in your own life, like yoga, meditation, exercise or a self-help book. For others it may be golf or fishing. Whatever you do to relax, make sure you are investing enough time in your own wellness.

Final Thoughts
"It's important to recognize that not every challenge will have an immediate solution, so be patient," says Garcy. Successful people will work toward a long-term solution, rather than a short-term release of stress.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com