Malvertising: The Next Big Threat

Deadly ransomware and zero-hour exploits have been making headlines over the past few months. But while you’ve been wringing your hands over protecting your clients’ files, cyber criminals have been building out attacks on one of the fast-growing malware platforms: malvertising. According to security firm RiskIQ, malicious ads have increased by 260% in the first half of this year compared to the same time frame in 2014.

What Is Malvertising?

Malvertising is a form of malicious code that distributes malware through online advertising. The code can be hidden within an ad creative, such as a swf file, embedded on the web page itself, or bundled with software downloads. Malvertising can be displayed on any website, even those considered the most trustworthy. Gone are the days when your clients could simply avoid P2P and pornography sites and stay safe. Malvertising is everywhere, from YouTube to Reuters to Yahoo!

How Does It Infect Users?

One of two ways. Some forms of malvertising utilize classic social engineering tactics in order to persuade users into infecting themselves without knowing. A pop-up might appear telling users they are infected and need to download software to prevent it—only to actually install the malware. Or malicious ads tailored to user browsing habits will entice them to click and then deliver the payload.

The second, and more frightening, technique is the “drive-by download.” Just loading the web page that contains the malicious ad results in infection. Most users won’t even realize it’s happening. No amount of safe browsing habits will save you and your end users.

Why Is Malvertising Scary?

Malvertising represents a huge threat not only because of the size of the campaigns, but also the ease of deployment. Attacks are now happening at “Internet scale” with massive reach. Most recently, Malware-bytes discovered a colossal malvertising campaign targeting Yahoo!, which receives nearly seven billion visits each month. In addition, attacks are easy to get away with because of a decentralized ad space online, which makes them difficult to flag—and especially effective.

Small business owners should be aware of the potential fallout from a malvertising attack. Computers may be susceptible to the following:

  • Identity, financial, or data theft, as well as extortion via ransom-ware
  • Computers that can be hijacked into a botnet and manipulated into being used for criminal activities
  • Exploit kits delivering even more lethal malware that can render machines and servers useless

 

 

Heartbleed Bug: What It Is And How To Protect Yourself

heartbleedThe Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet. SSL/TLS provides communication security and privacy over the Internet for applications such as web, email, instant messaging (IM) and some virtual private networks (VPNs).

The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.

What leaks in practice?

We have tested some of our own services from attacker’s perspective. We attacked ourselves from outside, without leaving a trace. Without using any privileged information or credentials we were able steal from ourselves the secret keys used for our X.509 certificates, user names and passwords, instant messages, emails and business critical documents and communication.

How to stop the leak?

As long as the vulnerable version of OpenSSL is in use it can be abused. Fixed OpenSSL has been released and now it has to be deployed. Operating system vendors and distribution, appliance vendors, independent software vendors have to adopt the fix and notify their users. Service providers and users have to install the fix as it becomes available for the operating systems, networked appliances and software they use.

 

Q&A

What is the CVE-2014-0160?

CVE-2014-0160 is the official reference to this bug. CVE (Common Vulnerabilities and Exposures) is the Standard for Information Security Vulnerability Names maintained by MITRE. Due to co-incident discovery a duplicate CVE, CVE-2014-0346, which was assigned to us, should not be used, since others independently went public with the CVE-2014-0160 identifier.

Why it is called the Heartbleed Bug?

Bug is in the OpenSSL’s implementation of the TLS/DTLS (transport layer security protocols) heartbeat extension (RFC6520). When it is exploited it leads to the leak of memory contents from the server to the client and from the client to the server.

What makes the Heartbleed Bug unique?

Bugs in single software or library come and go and are fixed by new versions. However this bug has left large amount of private keys and other secrets exposed to the Internet. Considering the long exposure, ease of exploitation and attacks leaving no trace this exposure should be taken seriously.

Is this a design flaw in SSL/TLS protocol specification?

No. This is implementation problem, i.e. programming mistake in popular OpenSSL library that provides cryptographic services such as SSL/TLS to the applications and services.

What is being leaked?

Encryption is used to protect secrets that may harm your privacy or security if they leak. In order to coordinate recovery from this bug we have classified the compromised secrets to four categories: 1) primary key material, 2) secondary key material and 3) protected content and 4) collateral.

What is leaked primary key material and how to recover?

These are the crown jewels, the encryption keys themselves. Leaked secret keys allows the attacker to decrypt any past and future traffic to the protected services and to impersonate the service at will. Any protection given by the encryption and the signatures in the X.509 certificates can be bypassed. Recovery from this leak requires patching the vulnerability, revocation of the compromised keys and reissuing and redistributing new keys. Even doing all this will still leave any traffic intercepted by the attacker in the past still vulnerable to decryption. All this has to be done by the owners of the services.

What is leaked secondary key material and how to recover?

These are for example the user credentials (user names and passwords) used in the vulnerable services. Recovery from this leaks requires owners of the service first to restore trust to the service according to steps described above. After this users can start changing their passwords and possible encryption keys according to the instructions from the owners of the services that have been compromised. All session keys and session cookies should be invalided and considered compromised.

What is leaked protected content and how to recover?

This is the actual content handled by the vulnerable services. It may be personal or financial details, private communication such as emails or instant messages, documents or anything seen worth protecting by encryption. Only owners of the services will be able to estimate the likelihood what has been leaked and they should notify their users accordingly. Most important thing is to restore trust to the primary and secondary key material as described above. Only this enables safe use of the compromised services in the future.

What is leaked collateral and how to recover?

Leaked collateral are other details that have been exposed to the attacker in the leaked memory content. These may contain technical details such as memory addresses and security measures such as canaries used to protect against overflow attacks. These have only contemporary value and will lose their value to the attacker when OpenSSL has been upgraded to a fixed version.

Recovery sounds laborious, is there a short cut?

After seeing what we saw by “attacking” ourselves, with ease, we decided to take this very seriously. We have gone laboriously through patching our own critical services and are in progress of dealing with possible compromise of our primary and secondary key material. All this just in case we were not first ones to discover this and this could have been exploited in the wild already.

How revocation and reissuing of certificates works in practice?

If you are a service provider you have signed your certificates with a Certificate Authority (CA). You need to check your CA how compromised keys can be revoked and new certificate reissued for the new keys. Some CAs do this for free, some may take a fee.

Am I affected by the bug?

You are likely to be affected either directly or indirectly. OpenSSL is the most popular open source cryptographic library and TLS (transport layer security) implementation used to encrypt traffic on the Internet. Your popular social site, your company’s site, commerce site, hobby site, site you install software from or even sites run by your government might be using vulnerable OpenSSL. Many of online services use TLS to both to identify themselves to you and to protect your privacy and transactions. You might have networked appliances with logins secured by this buggy implementation of the TLS. Furthermore you might have client side software on your computer that could expose the data from your computer if you connect to compromised services.

How widespread is this?

Most notable software using OpenSSL are the open source web servers like Apache and nginx. The combined market share of just those two out of the active sites on the Internet was over 66% according to Netcraft’s April 2014 Web Server Survey. Furthermore OpenSSL is used to protect for example email servers (SMTP, POP and IMAP protocols), chat servers (XMPP protocol), virtual private networks (SSL VPNs), network appliances and wide variety of client side software. Fortunately many large consumer sites are saved by their conservative choice of SSL/TLS termination equipment and software. Ironically smaller and more progressive services or those who have upgraded to latest and best encryption will be affected most. Furthermore OpenSSL is very popular in client software and somewhat popular in networked appliances which have most inertia in getting updates.

What versions of the OpenSSL are affected?

Status of different versions:

  • OpenSSL 1.0.1 through 1.0.1f (inclusive) are vulnerable
  • OpenSSL 1.0.1g is NOT vulnerable
  • OpenSSL 1.0.0 branch is NOT vulnerable
  • OpenSSL 0.9.8 branch is NOT vulnerable

Bug was introduced to OpenSSL in December 2011 and has been out in the wild since OpenSSL release 1.0.1 on 14th of March 2012. OpenSSL 1.0.1g released on 7th of April 2014 fixes the bug.

How common are the vulnerable OpenSSL versions?

The vulnerable versions have been out there for over two years now and they have been rapidly adopted by modern operating systems. A major contributing factor has been that TLS versions 1.1 and 1.2 came available with the first vulnerable OpenSSL version (1.0.1) and security community has been pushing the TLS 1.2 due to earlier attacks against TLS (such as the BEAST).

How about operating systems?

Some operating system distributions that have shipped with potentially vulnerable OpenSSL version:

  • Debian Wheezy (stable), OpenSSL 1.0.1e-2+deb7u4
  • Ubuntu 12.04.4 LTS, OpenSSL 1.0.1-4ubuntu5.11
  • CentOS 6.5, OpenSSL 1.0.1e-15
  • Fedora 18, OpenSSL 1.0.1e-4
  • OpenBSD 5.3 (OpenSSL 1.0.1c 10 May 2012) and 5.4 (OpenSSL 1.0.1c 10 May 2012)
  • FreeBSD 10.0 – OpenSSL 1.0.1e 11 Feb 2013
  • NetBSD 5.0.2 (OpenSSL 1.0.1e)
  • OpenSUSE 12.2 (OpenSSL 1.0.1c)

Operating system distribution with versions that are not vulnerable:

  • Debian Squeeze (oldstable), OpenSSL 0.9.8o-4squeeze14
  • SUSE Linux Enterprise Server
  • FreeBSD 8.4 – OpenSSL 0.9.8y 5 Feb 2013
  • FreeBSD 9.2 – OpenSSL 0.9.8y 5 Feb 2013
  • FreeBSD Ports – OpenSSL 1.0.1g (At 7 Apr 21:46:40 2014 UTC)

How can OpenSSL be fixed?

Even though the actual code fix may appear trivial, OpenSSL team is the expert in fixing it properly so latest fixed version 1.0.1g or newer should be used. If this is not possible software developers can recompile OpenSSL with the handshake removed from the code by compile time option -DOPENSSL_NO_HEARTBEATS.

Should heartbeat be removed to aid in detection of vulnerable services?

Recovery from this bug could benefit if the new version of the OpenSSL would both fix the bug and disable heartbeat temporarily until some future version. It appears that majority if not almost all TLS implementations that respond to the heartbeat request today are vulnerable versions of OpenSSL. If only vulnerable versions of OpenSSL would continue to respond to the heartbeat for next few months then large scale coordinated response to reach owners of vulnerable services would become more feasible.

Can I detect if someone has exploited this against me?

Exploitation of this bug leaves no traces of anything abnormal happening to the logs.

Can IDS/IPS detect or block this attack?

Although the content of the heartbeat request is encrypted it has its own record type in the protocol. This should allow intrusion detection and prevention systems (IDS/IPS) to be trained to detect use of the heartbeat request. Due to encryption differentiating between legitimate use and attack can not be based on the content of the request, but the attack may be detected by comparing the size of the request against the size of the reply. This seems to imply that IDS/IPS can be programmed to detect the attack but not to block it unless heartbeat requests are blocked altogether.

Has this been abused in the wild?

We don’t know. Security community should deploy TLS/DTLS honeypots that entrap attackers and to alert about exploitation attempts.

Can attacker access only 64k of the memory?

There is no total of 64 kilobytes limitation to the attack, that limit applies only to a single heartbeat. Attacker can either keep reconnecting or during an active TLS connection keep requesting arbitrary number of 64 kilobyte chunks of memory content until enough secrets are revealed.

Is this a MITM bug like Apple’s goto fail bug was?

No this doesn’t require a man in the middle attack (MITM). Attacker can directly contact the vulnerable service or attack any user connecting to a malicious service. However in addition to direct threat the theft of the key material allows man in the middle attackers to impersonate compromised services.

Does TLS client certificate authentication mitigate this?

No, heartbeat request can be sent and is replied to during the handshake phase of the protocol. This occurs prior to client certificate authentication.

Does OpenSSL’s FIPS mode mitigate this?

No, OpenSSL Federal Information Processing Standard (FIPS) mode has no effect on the vulnerable heartbeat functionality.

Does Perfect Forward Secrecy (PFS) mitigate this?

Use of Perfect Forward Secrecy (PFS), which is unfortunately rare but powerful, should protect past communications from retrospective decryption. Please see https://twitter.com/ivanristic/status/453280081897467905 how leaked tickets may affect this.

Can heartbeat extension be disabled during the TLS handshake?

No, vulnerable heartbeat extension code is activated regardless of the results of the handshake phase negotiations. Only way to protect yourself is to upgrade to fixed version of OpenSSL or to recompile OpenSSL with the handshake removed from the code.

Who found the Heartbleed Bug?

This bug was independently discovered by a team of security engineers (Riku, Antti and Matti) at Codenomicon and Neel Mehta of Google Security, who first reported it to the OpenSSL team. Codenomicon team found heartbleed bug while improving the SafeGuard feature in Codenomicon’s Defensics security testing tools and reported this bug to the NCSC-FI for vulnerability coordination and reporting to OpenSSL team.

What is the Defensics SafeGuard?

The SafeGuard feature of the Codenomicon’s Defensics security testtools automatically tests the target system for weaknesses that compromise the integrity, privacy or safety. The SafeGuard is systematic solution to expose failed cryptographic certificate checks, privacy leaks or authentication bypass weaknesses that have exposed the Internet users to man in the middle attacks and eavesdropping. In addition to the Heartbleed bug the new Defensics TLS Safeguard feature can detect for instance the exploitable security flaw in widely used GnuTLS open source software implementing SSL/TLS functionality and the “goto fail;” bug in Apple’s TLS/SSL implementation that was patched in February 2014.

Who coordinates response to this vulnerability?

NCSC-FI took up the task of reaching out to the authors of OpenSSL, software, operating system and appliance vendors, which were potentially affected. However, this vulnerability was found and details released independently by others before this work was completed. Vendors should be notifying their users and service providers. Internet service providers should be notifying their end users where and when potential action is required.

Is there a bright side to all this?

For those service providers who are affected this is a good opportunity to upgrade security strength of the secret keys used. A lot of software gets updates which otherwise would have not been urgent. Although this is painful for the security community, we can rest assured that infrastructure of the cyber criminals and their secrets have been exposed as well.

Where to find more information?

This Q&A was published as a follow-up to the OpenSSL advisory, since this vulnerability became public on 7th of April 2014. The OpenSSL project has made a statement at https://www.openssl.org/news/secadv_20140407.txt. NCSC-FI published an advisory at https://www.cert.fi/en/reports/2014/vulnerability788210.html. Individual vendors of operating system distributions, affected owners of Internet services, software packages and appliance vendors may issue their own advisories.

Learn more at http://heartbleed.com/

Facebook Scam infects Millions

The latest attempt by hackers to infect your computer, exploits the curiosity many people have regarding their Facebook friends. The malware scam, which is thought to have infected over 2 million Facebook Users so far, works as follows: When a user logs onto Facebook, they are presented with an ad post featuring a photograph of one of their friends along with “See (Friends Name)’s Naked Video” or “(Friends Name)’s Private Video”.

When the link is clicked on, users are sent to a fake but realistic version of YouTube which attempts to install a virus on their computer. If anti-virus software catches the Trojan, they are sent to a fake page claiming that an Adobe Flash Player update needs to run before allowing access to the video. This is the point where many Facebook users get trapped. Even if the original attempt was caught by the anti-virus software, as soon as the user clicks on the fake Adobe Flash Player update link, they become infected with the virus.

The malware, which has been named “Trojan.FakeFlash.A”, enters as a browser extension which accesses the infected users own Facebook photos and creates an advertisement which is then sent to their own friends and the cycle continues.

Fake software updates, fake browser plugins and fake Adobe Flash Player updates have been a common method used by hackers for a long time. The rise of social media and the curiosity surrounding Facebook friends has given hackers a new way to install malware on unsuspecting computer users.

How Do I Keep My Account Secure?

If you’re a Facebook user for personal or business purpose, there are some things you can do to make sure your account is kept secure.

Think Before Clicking

Never click suspicious links, even if they claim to come from a person or company you know. This includes all links sent through Facebook and those sent through email. If one of your Facebook friends clicks on a spam link, it’s likely that you will receive that same link and it will seem as if one of your Facebook friends had sent it you. Be sure not to download any files, especially .exe files.

Choose a Strong Password

Make sure you pick a unique and strong password for your Facebook account. Don’t use a single word that can be found in the dictionary like “apple” as your password. Use a mix of letters and numbers and try to change your password as often as possible.

Never Give Your Login Details

Some malware scams work by offering you something free, for example free gambling credits or iPhone’s, in exchange for your Facebook login details. If you’re ever asked to re-enter your password, make sure the website address begins with www.facebook.com/

Have Up-To-Date Software

Make sure you are always running the latest version of your web browser software and have up-to-date anti-virus software. Updated software will know about the latest hacking methods and will usually warn you if you are about to enter a phishing website.

Be Sure You Are Really Using Facebook.com

Many hackers will set up a fake, realistic looking Facebook page. Make sure your browser is always pointed to facebook.com before entering your login details. If in doubt, you can always type facebook.com again yourself to make sure you’re on the correct website.

Still Using Windows XP? What You Need to Know

According to Microsoft Support, Windows XP will no longer be provided with support or updates after April 8, 2014. All technology has a…. Continue reading “Still Using Windows XP? What You Need to Know”

The Importance Of Communication In The Workplace

With so much communication technology at our fingertips, it is difficult to believe that there are any communication problems in any business today. In the course of a busy workday, the importance of good communication can be something that can be easily forgotten. If you are noticing that it is difficult to get your employees to work together cohesively, that morale iw very low, or worse, that your business is losing money, you might need to take a second look at your company’s communication.

Use the Telephone

While phoning someone is still a good practice, it isn’t always the best mode of communication for every situation. Using the telephone is good for setting up meetings or discussing items for which there is a quick resolution. It is generally not a good venue to tell an employee that they made a mistake on their last assignment. Save that discussion for a one-on-one meeting.

Write an Email

Email is a fast and convenient way of communicating with colleagues and employees provided you follow a few guidelines. Use email for only disseminating factual information. If you are writing anything that could be misinterpreted, it is best to address that face-to-face. For example, if you are trying to remind an employee that something that they are doing is inappropriate in the workplace, an email might come across like an impersonal and angry lecture. This could end up causing a backlash from the employee rather than alleviating the situation.

Have a Meeting

Meetings can help bring employees and colleagues together and make them feel part of the company. It also helps to keep everyone apprised of what is happening in the company. It is probably the best way to communicate all important company business and ensure that everyone hears it. It is important to encourage open communication in the meetings, so that employees feel that they are heard and that what they say matters.

Try One-on-One Communication

With so many different modes of communication today, one-on-one communication often gets forgotten. It is so much easier to shoot someone an email or leave them a voicemail, but there are times when good old-fashioned face-to-face communication is still the best way to speak with a colleague or an employee. Many people do not feel comfortable bringing up their concerns or problems at a meeting. Things written on an Email and said on the telephone can often be misinterpreted when you are not able to see the person and read their body language. This is why a face-to-face meeting can be a much better option in this situation.

Listen

Listening is probably the most glossed over, yet most important piece of the of communication puzzle. Without the listening portion, any other piece cannot fully succeed. Employees and colleagues need to know that their input is being heard. Feeling unheard can often be the cause of low morale and high employee turnover. While listening does not necessarily mean incorporating each suggestion into your company or changing every policy based on what one employee says, it does mean giving the ideas full consideration.

In today’s highly technological society where everyone can do and access everything from their computer or cellphone, the importance of good communication cannot be stressed strongly enough. Using the appropriate mode of communication for different situations will make everything flow easier, and help make your employees feel that they are important and valued member of your company.

Serious World Problems: Don’t worry, Google is on it

There are many problems these days; Climate change, poverty, Illiteracy, debt crises, these are just a few. Google has decided to give solving these problems a try and created the “Solve for X” initiative. This project draws together some of Google’s best minds and asks them to imaginatively tackle some of the most perplexing global issues. The hope is that the “Solve for X” brain trust will come out with revolutionary solutions using current technologies in a way previously unthought-of.

Tackling the biggest global issues

Of course, it’s not that simple. The “Solve for X” brain trust will be taking on issues that have long befuddled world leaders. Nevertheless, the people behind this project are nothing if not enthusiastic. They are saying the work happening here is comparable to the groundbreaking thinking that was necessary to send humans to the moon. On the “Solve for X” website, Google talks about it this way: “This combination of things—a huge problem to solve, a radical solution for solving it and the breakthrough technology to make it happen—is the essence of a moonshot.”

Tackling water scarcity

The Mashable.com recently ran an intriguing feature story on the “Solve for X” project. Mashable cited the account of a participant in a “Solve for X” retreat who said that the minds gathered with him were concentrating on the huge issue of global water scarcity. What kind of solutions are “Solve for X” members creating to cope with this issue? One involved forward osmosis with recycled ammonium salts. If you have no idea what that means, don’t fret—the people at “Solve for X” do.

The need for technology brain trusts

Whether or not “Solve for X” produces real solutions for the world’s problems, the idea definitely has value. Technology is commonly developed with a single function in mind, usually for entertainment. That said, it’s likely there are many ways we’re able to use current technologies that we haven’t considered. Ideally, “Solve for X” will help us tap into that potential.

Nanotechnology: Not the Stuff of Science Fiction

You hear the word “nanotechnology,” and what do you think of? Sci-fi, maybe robots, something along those lines? The truth is, nanotechnology is making life less difficult for all of us. At its core, nanotechnology is the science of working with matter on an atomic and molecular scale. The hope is that scientists can use nanotechnology to create new materials and products that boast a variety of applications.

The practical side of nanotechnology

As an example, Science Daily ran a feature story about scientists creating a method to use nanotechnology to lessen the amount of friction in car engines and machines. If this technology becomes commonplace, it can help extend the lives of machines and engines and help them operate more efficiently. According to the Science Daily story, a team of scientists developed tiny polymer particles that were distributed in automobile engine base oils. When tested under conditions that simulated those found in car engines, these tiny particles were found to have a phenomenal ability to reduce friction.

More efficient motors

Even when distributed at low concentrations they decreased friction considerably, much more so then the friction additives currently being used in many industries today. How much more do they reduce friction? By about 55 percent more! Nanotechnology is a growing industry so expect more breakthroughs like this. In fact it is growing so quickly that the United States recently released a national strategy to be certain that environmental, health, and safety research requirements are addressed in the field.

The emerging world of nanotechnology

Next time you consider nanotechnology think of your car’s engine. Someday nanotechnology might be responsible for saving you lots of money due to your engine using less gas.

Serious World Problems: Don’t worry, Google is on it

There are many problems these days; Climate change, poverty, Illiteracy, debt crises, these are just a few. Google has decided to give solving these problems a try and created the “Solve for X” initiative. This project draws together some of Google’s best minds and asks them to imaginatively tackle some of the most perplexing global issues. The hope is that the “Solve for X” brain trust will come out with revolutionary solutions using current technologies in a way previously unthought-of.

Tackling the biggest global issues

Of course, it’s not that simple. The “Solve for X” brain trust will be taking on issues that have long befuddled world leaders. Nevertheless, the people behind this project are nothing if not enthusiastic. They are saying the work happening here is comparable to the groundbreaking thinking that was necessary to send humans to the moon. On the “Solve for X” website, Google talks about it this way: “This combination of things—a huge problem to solve, a radical solution for solving it and the breakthrough technology to make it happen—is the essence of a moonshot.”

Tackling water scarcity

The Mashable.com recently ran an intriguing feature story on the “Solve for X” project. Mashable cited the account of a participant in a “Solve for X” retreat who said that the minds gathered with him were concentrating on the huge issue of global water scarcity. What kind of solutions are “Solve for X” members creating to cope with this issue? One involved forward osmosis with recycled ammonium salts. If you have no idea what that means, don’t fret—the people at “Solve for X” do.

The need for technology brain trusts

Whether or not “Solve for X” produces real solutions for the world’s problems, the idea definitely has value. Technology is commonly developed with a single function in mind, usually for entertainment. That said, it’s likely there are many ways we’re able to use current technologies that we haven’t considered. Ideally, “Solve for X” will help us tap into that potential.

Don’t Squelch Creativity in Your Workplace

Do you run a workplace in which staff members feel free to express new ideas? Do your workers come to you with new plans or suggestions about ways to run company meetings more productively? Have your employees ever introduced ideas for a new marketing plan or recommended topics for the company’s blog?

If not, then you might be managing a workplace in which employee creativity is being squelched. Today a lack of creativity in your company can condemn your firm to second-tier status. It may even lead your company out of business.

Creative employees frequently come up with key ideas for better promoting your products, enhancing the functionality of the company website, improving production efficiencies, and shaving dollars off your monthly expenses. However, employees won’t exercise their creativity if you do not first encourage them to do so.

One of the simplest ways to foster creativity is to listen closely to employees when they bring their ideas to you. You can also get ideas from them, by sending out an email asking them if they have any strategies for improvement, whether big or small. When a worker does have an idea, listen to it! You don’t automatically have to use their idea, but it’s important to show them respect.

Dismissing an idea before you have heard it or not giving it your full consideration will dissuade your employees and defeat your purpose. Instead of having a bunch of innovative thinkers working for you, you may end up with a group of people just going through the motions for their paychecks.

To truly encourage creativity, reward those employees who do come up with strong ideas. This could mean having to pay a small bonus to those employees whose ideas you use. It could mean praising employees in company newsletters or memos. It could even mean an in-person “thank you.”

Many people want a job that allows them to be creative. It stimulates their minds and prevents boring redundancy. Many employees also have ideas on how to improve their place of business; they just haven’t voiced them to you. So encourage them to let you know what they think. It doesn’t mean that the way you have been doing things is bad; it just means that they may have ideas that you many not have thought of. Regardless, you and your business will reap the benefits of their creativity and your employees will be happier for it.

What is this Pinterest Thing, and What Does it Mean to Me

Tired of social media? Ignoring it all together? Well, join the bandwagon, because it’s not going away! In fact a new site recently popped up that is gaining popularity: Pinterest. Pinterest is a bit different than sites like Facebook and Twitter, since it focuses purely on the interests of the users. This encourages creativity by allowing you to share your interests with others rather than just posting updates about your day-to-day life.

But that doesn’t explain what it is. The meaning is in the name. Pinterest is a combination of the words “pin” and “interest”. Inside your account you have “pinboards,” similar to bulletin boards. You could make these public or not, and then “pin” images of things you are interested in onto these and make notes about these images.

Creating Pinterest Categories

Creating categories will let you organize your account and permit people to decide what in your account they want to focus on. You could choose to share all of your pinboards with other users or only a couple. You can not only make notes regarding the images you pin to your pinboard, but you can also add links to sites where you found the pictures.

The Social Part of Pinterest

While Pinterest has a different approach to social media, its main purpose continues to be social interaction. You can choose to follow as many people as you want as well as only follow the pinboards you’re interested in. Say someone has a collection of local restaurants; you’re able to follow that, while choosing not to follow her collection of “all things cute.”

Joining Pinterest

This is the most difficult part about Pinterest. You have to be invited to participate. You can visit pinterest.com and request an invite but there is no telling just how long it will take to receive your invitation. One surefire way is to ask a friend that has a Pinterest account to invite you.