this episode previously aired on 6scan.com/blog

NFL Draft and the Cyber Kill Chain

Tomorrow, the unofficial start of the pro football season kicks off with ESPN's broadcast of the 2014 NFL Draft. As in the past, hundreds of thousands of people will follow the drama via the Internet. Unfortunately, a vulnerability contained on the website of one NFL franchise may leave that team's fans blindsided by hackers.

This team's website includes a Cross Site Scripting (XSS) vulnerability, one that's used as part of a nearly fool-proof cyber scam.

In these scams, attackers use emails about upcoming events as bait, e.g. “Find out who 'Team X' will take #1 in the draft…” These emails contain links directly to the team’s website. Each link is formatted correctly and looks 100% legitimate. Clicking the link executes a browser injection that lets the hacker display a pop-up window on top of the legitimate destination page. Pop-ups can display offers such as discount ticket promotions, new merchandise, etc. All information entered in a pop-up ends up in attackers' hands.

While significant, the damage in such an attack -- to the team’s on-line reputation and the victim’s credit profile -- is still manageable. However, as 6Scan Co-founder Nitzan Miron points out, bigger issues are at stake.

“This is not a catastrophic vulnerability in terms of network or database access, but it is a critical link in the cyber kill chain,” Nitzan said. XSS can also be used to phish employees’ credentials, giving attackers direct access to a company’s network. Once inside a network, attackers can leverage advanced threats that are difficult to detect.

“Hacked websites have evolved into the number one attack platform. They are involved in 85% of attacks and have become a critical early link in the cyber kill chain,” Nitzan explained.

XSS scripting - which can only be found by a website or application scan - is one of the top 5 vulnerabilities 6Scan detects. Because such attacks take place at the browser level, website administrators never know they're happening. This is just one of the threats that drive us to deliver automated scanning and remediation services that any business can deploy regardless of size or security expertise.

Stay Safe.

Data (In) Security

(this episode orignally aired on 6Scan.com/blog)

In the world of website content management systems, WordPress is king.  As far back as 2012 Fortune magazine anointed WP  rulers of Web and now their number of installed platforms exceed 70 million. So a logical question is “What does it mean to be one of 70 million in terms of website security?”

Well, in cyber-security as in many industries, Shakespeare’s line “Uneasy lies the head that wears a crown” is often applicable.  So it’s important to recognize that dominant market share makes an inviting target for criminals.  Exploit writers follow the money which, for them, lies in hacking vulnerable website code.  The more vulnerable applications in distribution, the more profit they see.

Hackers use WP sites – revenue-generating and fan-based alike – to carry out criminal activity ranging from malware distribution to data theft and more.  At 6Scan, we see an inordinate number of sites unwittingly inviting attacks with virtual “Hack Me” signs.  Of the WP sites on our scanning platform (as of January 17, 2014) fewer  than 20% were using the current version (3.8) and approximately 25% run versions that are more than one year out of date (see chart for full break out.)  Hackers love out-of-date applications, which they regard as low-hanging fruit, becuase their vulnerabilities are well known and exploit packages are available for purchase. So before doing anything else, 6Scan urges WP site owners and administrators to install the latest version of WP.  Strengthening sites across the board – all types – is good for the individual as well as the WP community in general.

Free Forever!...Maybe

Great piece for start-ups considering Freemium.

http://techcrunch.com/2012/11/04/should-your-startup-go-freemium/

This article by Jules Maltz and Daniel Barney from Institutional Venture Partners is remarkable for its combination of depth and brevity. Every company considering Freemium should read it. 

Two elements that are often overlooked in freemium, Trials and Immediate Conversion, are discussed. I find the efficiency of these two factors tend to be the difference between a 2.5% overall conversion rate and 7.5% conversion rate (your mileage may vary).

One factor that would be interesting, particularly from a VC perspective, is how they value free users. I talk to a lot of startups that see freemium as part of MVP and that once they get funding they'll "figure out" the real model. 
The result is usually an extended quasi-beta period -- which ends up looking like the proverbial horse designed by a committee -- eventually you want to charge for it but there's really nothing unique that's worth paying for. 

The best decision is always to pick a model at the beginning and believe in it, because if you don't believe in what your doing, sure as hell no one else will.

Difficult, Painful and Risky

"Defining the purpose and the mission of the business is difficult, painful and risky" -- Peter Drucker

According to Kara Swisher's post in AllThings-D earlier this week Yahoo's new CEO is going to punt on the question "What is Yahoo?" Which is a wise decision because a company doesn't get to decide what it is. What a company can do is decide what it wants to be.

I have been a user of Yahoo! for eight years and, for me, Yahoo! is a serviceable email provider that also happens to break an occasional sports story. Y! can refer to itself as a "technology enabled media company," as the previous CEO did, but as a customer I would rank it as below average in both tech and media.

Yahoo! is also a stock. I've held on to it for more than 4 years just to remind myself that I should not waste my time and money on E*Trade trying to predict the actions of others (honestly, I didn't see any way Y! board would turn down any offer above $30/share). I should always hire a professional to waste my time and money.

For any company trying to decide "What It Is," consider this: It is not a clever turn of phrase or a pithy tag line. Your company is an aggregation of your previous activity. Understanding this activity takes an investment in analysis and resources. This is the way to know what your company is.  Once you have figured this out, only then can you undertake the "difficult, painful and risky" challenge of determining what you want your company to be.

C

Stack Ranking Alternatives

Now that Microsoft's Stack Ranking has been uncovered as the problem behind the Zune, Windows Mobile and rising ocean levels it is time we looked at alternative management strategies. Three new options are outlined below:

The Napoleon: Pick one employee and build his/her confidence with a series of high profile, slam dunk projects. Watch as employee rises through the ranks then, drunk on success, disregards office-alliances and wages personal battles with everyone in company. Eventually exile the employee to that funky space past the bathroom where you keep the fax machine and foosball table with the broken goalie.

The Gettysburg: Based on the lead up to the Battle of Gettysburg this strategy encourages mediocre middle managers to shadow their peers, mimicking their projects in an agonizing resource depleting quest that leads to heavy financial losses. Other key elements involve depriving their teams of basic amenities, such as coffee and post-it notes, destroying morale, and putting heavy emphasis on random industry hearsay or consultants with nebulous alliances.

The Serpentine: After their initial project has failed and the "pivot" has not done any better encourage your employee to Serpentine. This involves careening from project to project in an arbitary, haphazzard pattern creating confusion and paranoia across all teams. Based on the work of Peter Falk in the 1979 classic The In-Laws.


Remember, it's not enough to merely implement a strategy. For it to be as damaging as possible it must be lived everyday.

C

InfoGraphic: Freemium Conversion Rate

"What is industry standard conversion rate from free to paid?"

On July 12th I will be speaking at the Freemium Meetup in San Francisco ( http://bit.ly/QVHOC3 ) and I may, or may not, answer this question. The question I will most likely answer is "We have built out an elaborate multi-sheet business model to get funding for our soon to be released freemium app. In Sheet 1 cell A1 should we put 50%, 5% or 0.5% as our conversion rate to the paid version?" And my answer will be...it depends. Some of the dependencies are outlined in the above infographic, which is a fabricated representation of multiple realities I have experienced over the past 12 years of working with companies that use freemium as a business strategy/tactic.

The take away here is, if people see value in your product -- if it addresses a need that has been unfulfilled or users were unaware they had -- then they will tend to convert to a more valuable version of your product at a higher rate (and lower cost). But if you have gone out and cut too good to be true acquisition deals or run wacky promotions to show hockey stick user growth to potential investors, don't bank on a measurable conversion rate. 

Evernote CEO Phil Libin has shared extremely interesting data about the value of their users http://bit.ly/LszKpv.  Tracking these user segments or cohorts (a cohort is essentially a user segment acquired or tracked over a specific time span) is critical for any freemium business. At Zone Labs we would assign unique registration codes that would track where the free product was downloaded (Web site vs. CNET vs. Earthlink, etc). We could then segment users by this code to assess the value of acquisition source. The trick is being able to track multiple segments in order to determine the ones with the biggest impact. If you have any questions or have experienced something interesting/unexpected during your segmentation testing that you'd like to share, please let me know. 


In a future post I will touch on driving revenue from free users beyond the conversion to paid model -- including pop-ads, data services, tool bars, lemonade stands and car washes.

C

Common (Mis)Understanding

The Dallas TV program is making a comeback this summer. And it could be a good time for me to apologize to the residents of London, to whom I committed a grave injustice back in the 80's.

We were visiting my mother's family one August and the question everyone asked us Yanks was "Who Shot JR?" I had no idea why everyone was so interested in what I considered a uniquely American event, however, my reply to one and all was,
"JR was not shot. He had a stroke."

My response elicited wide eyed gasps, followed by suspicious glares. The confidence in my voice and the attribution to the blazing Texas heat convinced them I was telling the truth. And I was. At least my version of it. The problem was I didn't follow prime time soap operas. I was a kid -- I followed professional baseball. To me "JR" was JR Richard, the most dominant pitchers in the game until he suffered a stroke that spring. My JR recovered from his stroke, attempted an unsuccessful comeback, fell upon hard times and is now a Minister. Fictional JR, it turns out, was never even shot in the first place.


So to all those folks whose skeptical looks transformed into conspiratorial grins and who then spent evenings at the Pub passing along their inside information -- I apologize for the misunderstanding. 


Now does anyone want to know how Seinfeld ended?