The first step is to create a contact that will serve as the recipient for the SMS message.  You will need to consult the settings for your particular carrier to find the format for this address.  For AT&T users, the format will be [10-digit phone number]@txt.att.net.  Once the contact is created, create an email rule similar to the one below:

This rule will tell Exchange to forward any message marked as “High Importance” to the contact that was created for the SMS address. While the above view is from a Windows Outlook client, the same can be accomplished through OWA, or in Entourage or Outlook 2011 for Mac.

Within a few minutes (depending on your reception and your carrier), you will receive a text version of the email message that was marked with high importance.  Because of the inherent 160 character limitation of SMS messaging, it is unlikely that you will be able to read the entire message, however the SMS message will alert you to the fact that you have a priority email and you can then read it in the native iOS email client. Keep in mind, the source of the text message may vary based upon your carrier. Here is how the text message may appear on an AT&T connected device. Note the highlighted portion of the text.

One thing to be careful of… Normal text messaging rates will apply, so if you receive a large number of priority messages, and do not have an unlimited messaging plan, this could get expensive very quickly.  You can lower the number of messages that get forwarded by tweaking the rule to filter for certain senders, but its always a good idea to be aware of your SMS plan.

Hurricanes are unique in terms of natural disasters in that we usually have some warning before they strike and can prepare accordingly.  It’s important to plan for a hurricane as an extended event and not just plan for the storm itself, as it can take weeks to undo the damage to local infrastructure.  With that in mind, I’ve put together the following recommendations for steps to take to protect your firm’s data and infrastructure:

• Communicate with the firm’s staff. Setting the right expectation of what measures are being taken to protect the firm’s IT infrastructure goes a long way.
• Ensure you have a good, recent backup available. Make sure the backup in stored in a safe, waterproof location, and ideally one that is accessible under emergency conditions.
• Make sure firm staff know all their remote access options. This will allow users to continue to work if they can’t physically make it to the office but the systems remain online.  Provide them a printed copy of the remote access information to have on hand.  Also remind staff to take home laptops and mobile broadband cards when they leave for the weekend. If they will be connecting to an e-mail continuity service, make sure they know the proper login credentials
• Review your disaster recovery options. If you have a reliable DR option, it may be a good idea to put it in place before the actual event.  Doing so after the storm in the event of an outage may prove much more difficult.
• Shut down as many systems as you can. This will obviously vary based on your firm’s business requirements and your faith in your automatic shutdown methodology.  If you’ve tested your UPS solution recently and know it will bring systems down gracefully in the event of a power outage, you probably don’t need to go this route; if you have any doubts, consider a preemptive power-off to prevent a hard shutdown of your entire network.  Your site may not lose power at all, but if it does and you don’t have a backup generator the outage will likely far outlast your UPS’s capacity.
• Ensure you have the ability to remote back in when power is restored. Review your VPN and out-of-band access if you haven’t used them in a while to make sure everything is still configured properly.
• Move exposed hardware out of harms way. Depending on where your IT infrastructure exists in your building, it may be in danger of being exposed to the elements.  Get hardware as far away from windows as possible, cover it if you think there’s a chance of it getting wet from above, and elevate it if it’s located on the first floor or basement.
• Power off any unprotected devices. This is especially important with your workstations, which often are plugged directly into wall sockets.  If you want to go the extra step, physically unplug devices from their power source.  Power surges during a hurricane are notorious for damaging electronics.
• Keep your cell phone plugged in whenever possible. Instruct your IT staff to do the same.  You’ll be grateful that you did if the power actually goes out and you need to get in touch with someone.
• Keep a printed emergency contact list with you at all times. Don’t rely on the contact list on your electronic devices.

AND MOST IMPORTANTLY:

• Obey any local emergency notifications and evacuation orders. I can’t stress the importance of this point enough.  If you’ve been told to evacuate, there’s a very good reason.  By sticking around, you’re likely putting yourself in harm’s way.  Stay away until you’ve been told it’s safe to return.

These storms are highly unpredictable and highly dangerous.  Hurricane Irene could change course and miss the Northeast entirely, or it could be the storm we talk about for years.  Either way, the best thing to do is to take measures as far in advance of the storm as possible and keep yourself safe when the storm actually hits.

-Danny (in addition to being a Senior Technical Consultant at Kraft Kennedy, Danny is a firefighter for the Northwest Volunteer Fire Department in Houston, TX. Ed.)

PS – Check here for some great additional info on general hurricane preparedness.

Insurance plans sold through the carrier can cost up to $10 / month and usually have a $100 or more deductible when submitting a claim. This can get very expensive for clumsier folks. When I purchased my iPhone 4 from AT&T last year, their policy was that they did not sell insurance for smartphones (this has since changed). Because I couldn’t get insurance from AT&T, I decided to try out purchasing service from SquareTrade.com. Square Trade covers accidental damage on most electronics, not just cell phones. For $99, I was able to get 2 years’ worth of coverage with a $50 deductible for accidental damage for my iPhone 4. The main thing to note here is that this does not cover loss or theft, so it’s not a true apples to apples price comparison. I’ve never lost a cell phone in my life though (knock on wood), so this did not bother me.

The home button on my iPhone stopped working recently so I got to give this service a try. I filled out the claim form online, and two days later I received an empty box and a return label via UPS. I shipped my phone back and in about a week start to finish I had my phone back with a working home button. Square Trade’s policy is that they try to repair your device first. If they can’t repair it, they’ll replace it. If they can’t replace it, they cut you a check for the full value of the device.  The good news was that my phone was repaired for free. As it wasn’t damaged, I didn’t have to pay the $50 deductible. The downside was that I was without a phone for a week. This wasn’t a problem for me as I use AT&T and had access to a loaner iPhone I could put my SIM card into. For others, I could see this being a real inconvenience. What I didn’t ask was if I could use my own box to shave a couple of days off the process.

An interesting thing I discovered was that I had to ship my phone to a place called IResQ.com. Turns out this is a company that can repair your Apple device for you. They have all their pricing on their site so you can see how much it would cost to get repaired. Looks like Square Trade uses this service as opposed to doing the repairs themselves, so another option would be to not get any insurance and just play the odds. Getting my button repaired only costs $32 through the site, but replacing a broken screen costs $180 directly through the service.

Overall, my experience with Square Trade was very good and I would recommend them in the future as long as you’re ok with the downsides. I also have a Square Trade warranty on my iPad as that is very prone to breaking as well. I’m sure there are other services out there that do the same thing, but I try not to go around breaking different electronic devices to test out different warranty services.

I eventually stopped using tethering as Verizon and Sprint phones could not handle voice and data at the same time and the Internet connection would get disconnected whenever there was an incoming call. Because of this, I eventually moved on to a dedicated 3G card for my laptop. 3G cards served me well for a while. There were two problems I had with using these. First, the software was problematic at times. Its much better now, but still far from perfect. Second, I couldn’t use the 3G card for everything. I often test out different devices such as laptops, tablets, etc. and not all would work with the 3G card. This finally led me to the mobile hotspot.

A mobile hotspot is basically a mobile broadband card and a wireless router merged into a single device. Multiple devices can connect to the hotspot via standard WiFi and share its mobile broadband connection. This solved my two main concerns with using 3G cards, but also introduced a new one. I could use the mobile hotspot with anything that supported WiFi, which is pretty much everything nowadays. I also didn’t have to deal with sub-par mobile broadband connection software as the mobile hotspots are configured via web page just like a home wireless router. However, as its not powered by your laptop, you need to remember to charge it or you’re stuck. Some of these devices can be connected to a laptop for power in a pinch which is nice.

That covers the types of devices I’ve used. The other choice to make is which carrier to use. In the US, your main choices are Verizon, Sprint, AT&T and if you’re adventurous, T-Mobile USA. I’ve only tried Verizon, Sprint and AT&T. With their 3G services, I’ve had network congestion problems with all three of them. The big problem for me is traveling through Queens, NY during the afternoon rush hour. The Long Island Rail Road is one of the largest commuter rail systems in the world and it shows. In the morning when everyone is either sleeping or reading the paper, I have no issues. In the evening, you get full signal strength, but your data doesn’t go anywhere fast because everyone is on their smartphone or mobile broadband device saturating the networks. I experienced this Verizon, Sprint and AT&T. None of them were immune.

Then 4G came to NY. First was Sprint so I got their Overdrive 4G hotspot. Speeds were great, between 3 and 6 Mbit download. The network wasn’t congested because it seems like there’s only about 10 people out there with Sprint 4G devices. The big problem was coverage. It was spotty at best and would drop several times in the 4G area (which was only in Queens). It was so frustrating, I eventually just turned off 4G service on the device and forced it to use 3G only as I preferred reliability over speed.

When Verizon came to town with their 4G LTE network and came out with a mobile hotspot, I was intrigued. The coverage area looked more promising and I had some colleagues with the HTC Thunderbolt from Verizon which uses the 4G network who were boasting of 10 Mbit+ download speeds. This all sounded too good to be true so I picked up the Novatel 4G MiFi hotspot for Verizon. Boy was I surprised. Verizon delivered as promised. I saw 6-12 Mbit downloads and 2-4 Mbit uploads. Sometimes more. The LTE coverage is solid and large on Long Island. It didn’t drop at all for the first hour or so of my commute leaving the city until I left the LTE coverage area. It wasn’t just faster either, it is a lower latency connection as well. Latency is the amount of time it takes for your data to get from your source to the destination. Latency doesn’t matter much for browsing the Internet, but its critical when using remote applications like Citrix.

My only complaint with the Novatel 4G MiFi is that it doesn’t handle the transition between 3G and 4G well at all. This led me to disable the automatic switching and manually switch from 4G to 3G. Because the coverage is so good, I only need to do this once per trip so its not a big deal for me. This is a known issue and I hope it will get resolved in a future software update for the device.

For now, I would say that Verizon’s 4G LTE network is the way to go for mobile broadband. I’m sure the network will slow down over time as more and more people start using it. The current 2G and 3G networks were the same way when they first came out. They started out super fast, then eventually slowed down as more and more people started using them. So, if you’re in a Verizon 4G market, enjoy it while you can and hopefully it stays usable until the next generation of wireless networks come out.

1. Identify the threat. Until you know what you’re up against, it’s impossible to come up with an effective plan to resolve the issue.  While Symantec was catching infected files and did actually label some of them as W32.SillyFDC.BDP, it was throwing up quite a few incorrect virus IDs as well (i.e. Bloodhound.Exploit.343) that made it hard to know what we were dealing with.  We ultimately identified the threat by examining the pattern of files that was appearing in the infected locations (in this case: autorun.inf, setup50045.fon, setup50045.lnk, myporno.avi.lnk and pornmovies.lnk) and doing some creative Googling with that information.  That lead us to a Symantec KB article that described exactly what we were experiencing.
2. Mitigate the risk. The primary goal when dealing with a virus is to ensure that no data is lost and that no security breaches occur.as a result of the virus. Once we knew what we were dealing with we were able to more accurately determine if the virus posed any immediate danger.  Symantec’s classification of the virus as “very low” risk was comforting, indicating this virus was more of a nuisance than a risk for data loss or security breach.  We took a closer look at the firewall to make the virus wasn’t attempting to contact any of the remote HTTP sites identified by Symantec, which it wasn’t.  At that point we made the decision to shutdown all workstations to prevent further infection but not take any servers offline.  Had the risk been any more severe we would have most likely shut down the entire network until we had a better idea of how to remove the virus.
3. Determine the pathway for infection. We knew, based on Symantec’s article, exactly what the virus does from a technical perspective, but  it can be difficult to translate that information into what needs to be done to contain it.  After taking an infected machine and trying a few strategies to see what would remove the virus completely and what would not, we realized that most of our servers that appeared “infected” weren’t really infected at all.  They were still a threat because they were hosting the virus files that allowed other machines to get infected, but cleaning these servers was as simple as deleting a few files.  The truly infected machines were the ones that had the virus installed as a service, and those were the ones we needed to address to ultimately eliminate the virus.
4. Develop a containment strategy. Preventing the virus from spreading further than it already has makes the ultimate goal of eliminating it that much easier.  We wanted to make sure no new machines would get infected.  Since we knew one way this virus spreads is by taking advantage of a Windows Autorun vulnerability, we chose to temporarily disable Autorun in the entire domain via Group Policy.  Additionally, upon closer inspection of the files the virus was distributing, we realized these files were getting created as the system account of the infected machine.  That gave us two crucial pieces of information: a) which machines were infected, and b) that the system account needed write access to the shares it was infecting.  The shares the virus was taking up residence in were set to grant Everyone read/write access.  It was a tedious and time consuming process, but by reviewing each share and granting Domain Users rather that Everyone write access we eliminated the virus’s ability to spread throughout the network.  (This was a pivotal step in getting the outbreak contained, and if you’re reading this article because you have this virus this is something you need to do.)
5. Eliminate the virus. If you’ve successfully prevented the virus from spreading further, its days on your network are numbered.  Our challenge with this particular virus was that we now needed to identify which machines were actually infected so we could manually clean them.  Because the virus renames itself with each new computer it installs on it’s difficult for Symantec (or any other antivirus program for that matter) to properly identify and remove it.  We needed to get a little crafty to make finding the infected machines easy.  I put together a quick script to scan the registry for a key that we knew would be affected if the virus was installed: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\”netsvcs”.  If in that key it found an entry that indicated the virus was present, the script logged the machine name to a custom SQL database we created.  We deployed the script as a startup script for all workstations, and by booting up the machines we were able to determine exactly which ones were infected.  After that it was simply a matter of following the removal steps noted in the Symantec article.  In our case, while on first glace it appeared the entire network was infected, only about 9 machines were actually distributing the virus throughout the network.
6. Be proactive to prevent reinfections. If the virus was able to get on your network in the first place, there’s a good chance it can do it a second time.  Once we felt we had the virus eliminated we took the time to review our antivirus policies and ensure our servers and workstations were up to date on patches.  We are still periodically checking our custom SQL database to ensure no new infected machine are appearing on the network.  We also chose to keep Windows Autorun functionality disabled for the time being, and even went as far as to temporarily prevent the use of USB storage devices since the virus can easily become resident on those as well.  The latter restriction has since been lifted.

The successful containment of what could have been a widespread network infection testifies to the effectiveness of multilayered threat protection policies and offers two important reminders about network administration:

First and foremost, it is important to regularly update Windows and install an antivirus program on every computer on a network.  Although they are easy to overlook, even utility machines that are brought to a firm by a service provider to perform a specific function must conform to standard threat protection practices.

Second, we are reminded that enabling account lockout rules in group policy is an extremely simple and effective way to combat viruses.  Locking out an account after five to ten incorrect password attempts even for a period of just ten minutes can render a brute-force attack ineffective and alert network administrators to the presence of a virus within minutes of first contact.

To enable account lockout rules on your domain, follow these simple steps:

• Open your Group Policy Management console and edit the group policy object where your network’s password policy is defined.  Typically this is done at the domain level.
• Edit the account lockout policy, which should be located under Computer Configuration\Policies\Windows Settings\Security Settings\Account Policies

• Set the maximum number of password attempts before lockout and the time period for which you would like to lock the account.  The following are fairly standard values:

The requirements to participate in the Microsoft Partner Program have recently evolved to help differentiate technical and business capabilities among participants; Kraft Kennedy has risen to the challenge by quickly exceeding the goals set forth by the program.

Each competency requires specific individuals with deep technical skills, Microsoft verified customer references, and challenging certification exams to be completed.  This commitment demonstrates our breadth, deep specialization, and proven expertise across a range of Microsoft technologies.

About Kraft Kennedy

Kraft Kennedy provides business and technology-related consulting services to the legal community. By combining outstanding technical skills with an intimate knowledge of our clients’ business and information needs we tailor solutions that enhance attorney productivity, effectiveness, and client value.

We focus on the business needs of the client and ensure that technology is used to enhance, not inhibit their business. KK’s talented staff of strategic consultants, project managers, and network consultants have years of experience with hundreds of projects for firms from small to large. Our services portfolio includes advanced infrastructure projects, business continuity and data center consolidation, desktop deployment, network design and implementation, storage design and replication, and messaging systems migration among others. Our Microsoft specialties include: Desktop, Server Platform, Unified Communications, Portals and Collaboration, Search, Systems Management, Virtualization, and Small Business Specialist Community.

1. Always make sure users are not administrators of their workstations.  Many Malware programs rely on the user’s permissions to fully infect a machine.  The only exceptions being threats that take advantage of security vulnerabilities.  If you are a network administrator, it is also recommended to only be a standard user as well.  It’s also very important to NOT be a Domain Administrator.
2. Keep your software up to date.  Stay current on Windows Updates.  If you are still on Windows XP, make sure you are on Service Pack 3.  If you are still running Internet Explorer 6 or 7, consider upgrading to 8.  Staying up to date will help prevent the spread of threats that take advantage of the security vulnerabilities mentioned in tip 1.  It’s also important to keep your antivirus software on the latest definitions as well as on the latest version.  Most virus definition updates are automatic.  However, many people don’t keep the anti-virus client itself up to date.  Newer versions of anti-virus products can detect different types of threats better than older versions.
3. Never login as a network administrator when troubleshooting a workstation.  This is a common mistake when users are not local administrators.  The user doesn’t have rights to install a particular tool so the admin logs in as an administrator.  If that account is also an admin of the entire network, the virus can run under those credentials and spread to network servers and file shares.  If that happens, you’ve compounded your problem exponentially.  You should use the runas command with local administrator credentials to do anything you need elevated rights.
4. Keep network directory permissions as restrictive as possible.  Many viruses will spread to network shares if the users have write rights to them.  If you have common shares that all users map to, viruses can spread quickly between computers via network shares.  This is also a reason to not login to a workstation as a network administrator when troubleshooting an issue.  If a virus wasn’t able to write to a network share while a user was logged in, the virus probably can write to that same share when an admin is logged in.
5. Know when to give up.  In my experience, I’ve found that if you can’t remove the threat in 30 minutes, you’re probably not going to.  I constantly see people spending hours or days running scan after scan with all different utilities trying to remove malware from an infected workstation.  And once they think they got it all, they find that it just comes back a day later.  Which leads me to my next point.
6. Only use Anti-Malware utilities as a last resort.  They can be very time consuming and often not completely clean a machine.  Most organizations have an automated imaging process for setting up workstations.  If you can completely re-install the Operating System and applications in an hour, why spend 4 hours trying to clean the machine?  However, if you must run these utilities to clean a workstation, you should boot the computer in safe mode and run the utility for best results.
7. If a user is not a local administrator and the systems are properly patched, most threats can be removed simply by re-creating the user’s profile.  If settings are roamed to a network location, it is important to delete that copy as well.  Yes, this is an inconvenience to the user.  It’s the price they pay for doing all of that Internet “research” which got them infected in the first place.
8. Educate users on safe computing.  People don’t get viruses by going to wsj.com or cnn.com.  They get viruses and malware by clicking on random web sites in Google searches or opening up any attachment or link that gets emailed to them.
9. While infrastructure level protection such as web filtering appliances can help, they should not be relied on exclusively.  Viruses and malware can be brought in by other means such as USB keys.  If you have laptop users, many of these solutions are bypassed as soon as the laptop is removed from the office.
10. Avoid letting users use alternate browsers.  Internet Explorer 8 is very fast and very safe if configured properly.  It is also highly manageable and updateable via group policy and Windows Update.  Using other browsers creates management and support issues.  Many web sites, especially internal web applications, only work properly with Internet Explorer.

In the event that the standard threat prevention methods fail and the servers on a network become infected with a virus, compromised security, network downtime, and the labor required to eradicate the malware are just some of the potentially massive associated costs.  Over the last few months we in the Support Practice Group have found OpenDNS Enterprise to be another very effective weapon against online threats.

OpenDNS is a cloud-based web content filtering service that provides security against phishing, malware, and unsafe or unprofessional browsing practices for a low monthly or yearly fee.  In comparison to traditionally protected networks, the Support Practice Group clients equipped with OpenDNS have benefitted from far fewer and far less dangerous malware encounters since adopting the service.  The product requires no installation and works by pointing the DNS server on a protected network to the OpenDNS server on the cloud.

When a user attempts to navigate to a potentially harmful website the service redirects him to a URL that can be customized to meet the firm’s individual needs and could include information about the company internet policy or potential threats associated with the target site.  Administrators can easily review blocked sites and choose to whitelist or blacklist websites on a case-by-case basis.  As an additional measure of protection, the service also prevents malware and viruses living on the protected network from sending sensitive information out to the web or downloading other malicious files.

If you are interested in learning more about OpenDNS Enterprise can find more information here.