It seems that almost every aspect of our lives, from social to economic require some sort of technical expertise. Filing taxes online, ordering a last minute birthday present from Amazon, even now cars require some technical institution to navigate the increasing number of features. As individuals we can grow and adapt, but business face a much larger challenge. In order to keep up in almost industry there must be technical infrastructure. The cost of that infrastructure alone is a large expense, maintaining it even more. Many small to medium businesses don’t have the same in house expertise that larger companies can afford to hire. The small IT department often ends up overwhelmed. Managed service providers have stepped in to fill that gap.
A MSP is a company that will remotely manage a customer company’s technical infrastructure. They originated with large Fortune 500 countries that could afford networks in the early days of computing. Simple Network Management Protocol was developed in the early 90s and was applied to PCs. As with most early software, the management systems for monitoring PCs and turning that data into useful output were complex, geared towards large scale and prohibitively expensive. As systems became more mature they could apply their benefits to smaller systems.
The MSP will monitor systems on a proactive basis, and usually for a flat monthly fee. The fee will be negotiated based on services provided and a the number of devices to be monitored. Basic services often start with just a monitoring system that alerts the customer of issues to be resolved by the client. At the upper end of the price spectrum the provider can offer fully managed service that cover the process from monitoring through problem resolution. Different packages can be priced at different levels, allowing the service to expand as the client business expands. This model is different that usual IT projects, such as the instillation of a server or phone system, which holds a one time investment for the customer company and a one time revenue gain for the MSP. The services to be provided are outlined in a service level agreement that is signed at the beginning of the relationship. This contractual arrangement denotes the performance and quality metrics that will be used to asses the performance of the MSP.
This monthly subscription model will often end up being cheaper for small companies. At many small to medium businesses the only time something will get fixed is once it is broken. This might appear to be the most efficient model, but the business will suffer losses while the IT department scrambles to fix the issues. An MSP will often employ remote 24 hour monitoring and management software on the client’s infrastructure in order to remotely troubleshoot and solve issues with the customer's setup. Through proactive monitoring of potential issues the client company can avoid downtime and loss of revenue. They can provide supervision of backups, patches and manage security. The MSP provides the expertise and support that a large IT department might provide but at a fraction of the price.
However, these are not the end all be all, and should be considered carefully. Depending on the type of business looking to outsource its IT, there may be regulations to consider. Not to mention that your network has been exposed to an outsider, regardless of how trustworthy that outsider might be. There may be security risks to consider and potentially sensitive data that is now exposed. It is also important to investigate whether or not the provider can modify its approach to suite your business and its needs to specifically.
A managed service provider can be very beneficial to small and medium sized businesses without the resources to manage their own IT infrastructure. These services can eliminate problems before they occur and be an efficient use of a small budget. As always, as a network administrator it is best to investigate all options and choose the one that best suites your own network and infrastructure.
Apache is a common web server that is seen across business of all sizes and often used to host websites on personal servers. This stems from the fact it has the low, low price of free. Which is especially tempted to business just starting out and broke college students. Apache is a linux based to web server solution and therefore relatively stable as well as versatile. Unfortunately, at that bargain price, Apache lacks the commercial support of Windows products of a similar nature, such as IIS. A large user support base and a growing field of companies offering paid support for open source software are a close substitute however, and that means it's nearly certain you’ll run across an Apache server at some point in your nerdy adventures.
A potential motivating factor in the decision to develop an Apache web server is the idea that Linux based products are more secure than those of Windows. This can be true, simply because Windows servers offer more vectors for attacks, but it is still wise to make sure that your Apache server receives some thoughtful attention to its security aspect. This can be done through a thorough examination of the configuration files and a few other logical steps.
The first and most basic step in securing a web server is to keep it updated to the latest version. The Apache developer developer community is continuously working on security issues and issuing updated versions. More than that, it’s important to keep the entire system updated. Security patches are your best friend as an administrator, since many attacks are at the most basic code level that you can’t do anything about.
A good basic second step is hiding the Apache Version and OS Identity on error reports. When Apache is installed from source or through package installers it will default to displaying the version of Apache installed as well as the operating system name when an error is displayed. So your server can be functioning properly and deny access to a secured page, but still give a potential attacker valuable information about not only the web server but the entire system the server is hosted on. With these details an attacker can hone in on which exploits your services might be vulnerable to. In the red team world, any little detail matters. This information can be denied to your advisory through tweaks to the Apache configuration file. In this file you’ll find a “SeverSignature” variable that is by default on. Turn this function off, as well as the following function of “ServerToken” to “Prod”. This will tell the server to suppress the OS and version information, and keep your error page to just that, displaying an error.
Another default function of Apache is to list all the content of Document root directory in the absence of an index file. In case you haven’t noticed, it’s important to review a system’s defaults. Often they aren’t particularly secure, and that stands for just about any system in any ecosystem. This display directory function shows off a whole list of options that the user can select in order to find the page they might be looking. Directory listing can be turned off in the configuration file for that specific directory, so where the server files are located. For this an entry must be added in httpd.conf or in the apache2.conf. Once this is done, it will make sure that a user can not access the files just by stumbling into the root directory. A large part of securing a folder is just making sure that users stay where they belong, and that’s out of the guts of your web server.
The default Apache installation runs its process under the user nobody, and for security reasons you should probably change that. It's a good idea to cordon Apache off into its only little non-privileged account. To do this a user and group can be added through the command line. Apache has to be told to use this account through modifications in the /etc/httpd/conf/httpd.conf in which you specify the username and groupname to use. This is useful because it separates Apache away from other programs that might have a vulnerability. For example, if an SQL database and Apache are running under the same user and SQL has a security flaw, it could expose Apache as well as the database. For this reason, it’s a good practice to separate out your services. When doing so, make sure to follow naming conventions that make sense so you don’t get confused later on looking for the your Apache server running under a user named frank the third. Or at least write it down somewhere safe. Trust me, you’ll appreciate it later.
These are only a few settings of among the hundreds that can be changed in Apache. As a network administrator it's important to be aware of the potential attack vectors that an Apache server might open up on your network and how they can mitigated. Do your research and your Apache server can be both free and secure.
It’s not hard to image this case going all the way up to the Supreme Court. Apple has certainly indicated its willingness to fight to the bitter end. This is a case with the potential to set just how far the FBI can go when it comes to shanghaiing companies in to breaking into their own products. Never before have companies had to consider protecting customers from themselves. After this case settles down, they just might have to. It would irreparably harm consumer privacy if the FBI was to win this case and be allowed to comple Apple into creating a custom tool to invade otherwise secure devices.
In case you’ve been living under a rock recently, a historic court case is unfolding in the US District Court of California. Magistrate Sheri Pym has ordered the tech giant Apple to assist the FBI in unlocking of an iPhone. The phone under investigation is a company phone used by Syed Rizwan Farook, who worked for the San Bernardino County Department of Public Health. He and his wife are responsible, according to authorities, for the shootings in San Bernardino in early December 2015 that killed 12 and injured another 22, so it's understandable then why tensions are running high in this case. But what does the FBI want exactly, and why has Apple quite publicly refused?
First some specifics to lay our scene. This particular iPhone 5c is running iOS9 software according to court documents. This means that is comes with a handful of safeguards to prevent against intrusion. There are two key software measures: only ten failed attempts are allowed before the phone auto wipes and an increasing time delay is imposed between each attempt. There is also a hardware delay that makes each attempt take at least 80-milliseconds. The FBI is asking that Apple provide a unique custom software signed such that it would only be able to be loaded onto this specific iPhone and then run from RAM so that it would not change the operating system or any of the user data. This requested software tool would allow the FBI to “brute force” the device, that is, try multiple passcodes without triggering the auto-delete function or having the software introduce further time delays. Against a weak passcode the iPhone could be unlocked in minutes; with a strong code is could still take more than 5.5 year according to Apple. The FBI is betting on human nature, which indicates that most people pick stupid easy passwords. This is not a “backdoor” in the traditional sense, but more of a tool to be used when needed. Most experts are guessing that building such a tool is within Apple’s capability. Throw a few very intelligent software engineers at the problem and pretty soon you’ve got what Apple has referred to as a “government OS”.
Lets be clear. What is at stake here is not the data on the iPhone. This is an argument about a company being forced to custom-build software to circumvent its own product’s security features and the legal precedent that such an order represents. It is different than previous cases in which Apple has been compelled by a court to unlock and access similar. In phones using software earlier than iOS8 Apple can essentially bypass the user’s passcode; later versions of the operating system are secured so that not even Apple can access the important encrypted data on a phone. That is why this case is different. The FBI is attempting to compel Apple to cooperate in doing an incredibly complex bit of digital forensics maneuvering and in doing so is opening the door to a very slippery slope. The American public might be sympathetic to such a tool being used in the case of a terrorist attack, but what comes after? Now that the tool exists, what is to stop the FBI for requesting it be used on other phones in its possession? And what about other government’s requesting Apple’s cooperation? We as a people might rely on our judicial system to make wise judgements on when this tool can and can’t be used, but I would bet many wouldn’t trust China’s government to be equally moral. These are the potential future scenarios that must be considered. Not just this one, singular terrorism case, but all of the cases that come after it.
This is assuming that the code does not get out. This is less of a concern as there are already proposed physical and cryptographic safeguards to prevent such a catastrophe from happening. Regardless, how can Apple make it impossible for the code to be used for malicious purposes without going to incredible lengths? Such lengths that would in fact be considered an “undue burden” on Apple but without which the world would become a much more dangerous place for shiny white iPhones.
Part of being a network administrator is handling file permissions. It’s key to understand file and folder permissions in both Linux and Windows in order to prevent users from accessing things they shouldn’t.
We’ll start with Linux. Each file has three basic user groups that can each have their own permissions. The owner permissions apply only to the owner of the file. The second is the group permissions, which apply to the specific group that has been assigned to the file. The last group group is all users. This set of permissions is the widest and applies to all users on the system. Each of these user groups can has three different permissions types that can be set. Those three are read, write, and execute, which all do exactly what one might think they would. When reading the sets of permissions, the first three characters refer to the owner, the second set of three to the group, and the third set of three are the permissions for all users. The command used for this is chmod +/- permissiontype filename.
Windows, on the other has a large percentage more file permissions than those options granted by Linux. A single file can be given the options of Full Control, Modify, Read & Execute, Read, and Write.
I personally prefer the range of options and flexibility on Windows. I’m also more comfortable in general within the Microsoft ecosystem. Multiple groups can be assigned to a single file with a variety of different permissions. This is really useful in a large organization. It can also be easily done through the graphical interface, which is super friendly to a new user. When deciding between the two, it essentially comes down to the needs of your organization and whats available. Windows is my personal preference, but Linux might be more suitable in some environments.
Week Three - Phishing Attacks. Alternatively; Humans Are the Weakest Link
It’s a pretty common line of thought in the information security sector that biggest security gap in any organization is located between the chair and the screen. As a network administrator and therefore guardian of the network, you can execute near perfect security measures but one duped end user can bring the whole castle tumbling down by letting an advisory in through the front door. Phishing attacks are one such attack avenue, and they target the proverbial weakest link; the end user. As a network administrator it is your job to educate the denizens of your domain on this threat to enterprise security and how crucial of a role they play in keeping the network safe.
Some basics first. A phishing attack is any attempt to use social engineering to elicit a user to give away information an attacker can use, such as usernames, passwords, or credit card information. Attackers are thus “fishing” around for any user that will take the bait. This post will focus on email phishing attacks, as it is one of the most common schemes end users will run into in an enterprise environment. Company emails are often easily available online and heavily utilized by employees, thus making themselves low hanging fruit for attackers. The attacks themselves can be any degree of complex, but we’ll run over a few basics things that users can keep an eye out for.
A phishing email can be for an account that you do or do not have, and will generally appear out of the blue. It’s definitely a bad sign if an organization with whom you have had no prior contact whatsoever is contacting you, as they have zero reason to be requesting your information. It can usually be assumed that communication of this type is either spam, phishing or evidence of identity theft. Another red flag is that a phishing email will request your username, password or other personal details via a contact they initiated. No legitimate organization will ever do this. There will always be another way to solve the supposed problem presented in the email rather than following their exact instructions. Legitimate organizations, especially those which you have an account with, will typically customize their greeting to address you by name or username, and are less likely to use a generic but formal “To whom it may concern” or other greeting. Depending on the laziness of the attacker the email will be littered with spelling, grammar or factual errors that no self respecting organization would make. If it doesn’t look legitimate, it probably isn’t.
So what do you tell end users? Most are less idiotic than we in the magical world of networking might believe. Phishing emails are a form of social engineering and thus are meant to dupe otherwise intelligent end users. The key is education. A review of simple guidelines could go a long way. The first rule should be do not do The Thing. Whatever it is the email is asking, do not do it. Instead, double check. Often a quick google will show if any particular email is a scam or a quick phone call could clear up confusion. If the email originates from a legitimate organization there will be a way to do whatever is requested separate from that email. It is also important to emphasis the fact that whatever it is, it is not urgent. It can wait a few minutes to ask a help desk professional or google the scam.
But maybe you need more than that. After all, who is going to read that millionth email from the network administrator detailing things they are sure they already know? Now you need real training and if you can convince the powers that be to shell out the budget, this can be the most effective way to train end users. Wombat Security offers training that includes simulated phishing attacks and teachable moments for end users who fail pray to the simulated attack. This is only one option for educating users, and it’s up to the network team to decide solution will fit their personal empire the best.
The average person has about, oh say, a million passwords. Just about every other site requires some sort of login credentials to protect your account. These can be from the mundane (your poptropica account) to Very Very Important passwords such as your online banking information. How does this relate to system administration you ask?
Well, these endless combinations of letters, numbers, hieroglyphics, special characters and emoticons aren’t just for personal use. Especially as a system administrator, passwords become part of daily life. Administrator passwords and the privileges that go along with them are the keys to the kingdom, and most if not all computers will have local administrative passwords. And keeping them all organized and updated is a nightmare. Traditional solutions might have involved a common password for all local administrator accounts on the domain or keeping elaborate spreadsheet systems. A common password is probably making your inner security professional cringe and keeping it all written down in one centralized location doesn’t scale well to larger domains.
One solution is a password manager. Microsoft, being the helpful folk that they are, provide the descriptively titled “Local Administrator Password Solution” that can be implemented through the active directory. This application involves two additions to the Active Directory schema and installing an additional Group Policy Client Side Extension on each of the managed computers. Microsoft describe its function as “a solution to the issue of using a common local account with an identical password on every computer in a domain”. It does so by setting a random password for the local administrator account on every computer in the domain. Domain administrators can determine which users, such as help desk technicians, can few the password lists. This is arguably less of a security risk than having the same local admin password across all accounts.
There are definitely some cons to this system. Notably, passwords are stored in clear text and may be exposed if the deployment isn’t carefully planned and properly executed. If the domain controller on the system is compromised, this also leaves all of the local administrator passwords open for the taking. As with any system, the details matter in the implementation. If carefully done, this could be a solution to the chaos of keeping track of local administrator passwords.
More information from microsoft can be found here: https://support.microsoft.com/en-us/kb/3062591
