Security

Not every company has excess resources to invest in bleeding edge technology for the latest security trends. Companies make hard decisions on whether to spend money on equipment or staff to increase revenues. Supporting their network infrastructure is often a decision made in hindsight.  

Well, for all you network engineers out there working for companies operating on thin margins, here's some info for you. The guys over at sans.org ISC have posted an interesting write-up on Data Loss Prevention (DLP) on a shoestring budget. 

Prepare yourselves! Yesterday was the dreaded Microsoft patch Tuesday and that can only mean one thing, millions of PCs configured to automatically update themselves at 3:00am are potentially breaking themselves before end users get to their desks!

In all honesty though, there have been many support hours spent on troubleshooting problems that have been caused by patches being applied. Sometimes that server vulnerability was actually a feature being utilized by the primary application being hosted on the now "fixed" server. If users can't access the application, they'll let you know.

Stumbled upon an interesting article over on Tufin's blog that talks about cleaning up old firewall rulebases. If you manage a firewall for a larger organization, you are most likely accustomed to receiving frequent requests to modify it. In very large organizations, this typically involves an approval process, which might help keep approved requests in line with corporate policy, but doesn't mean the actual implementation of the rules are clean and not duplicated. 

Cisco released a security advisory late last week announcing a vulnerability in their management software, Cisco Works Common Services. Common Services is the core Cisco Works application that takes care of the common database and other data that is shared between all of the Cisco Works applications.  If you are running a relatively recent installation of any Cisco Works installation, including Cisco Security Manager (CSM), Telepresence Manager, or QoS Policy Manager (QPM),  you most likely have a vulnerable version running. 

Here's a synopsis of the vulnerability, take a quick look at your version to see if you are at risk: 

Versions affected: The announcement says Common Services version 3.05 and newer are vulnerable. Earlier releases and the 4.0 release are not vulnerable. 

I'm currently running a full system scan with my various anti-bad-stuff scanners to make sure my computers haven't been turned into mindless botnet zombies after reading Computerworld's most recent report. The word is that botnet gangs have turned their greedy gaze toward online investment accounts to help them fund their efforts. If you want some suggestions on how to defend yourself, read on.

How does this work?

Posing as LinkedIn emails, unsuspecting users who click on the links are sent to malicious sites that pose as the real sites. While viewing the bogus site, unpatched Windows machines can be pwnd. It sounds like a stretch, but there really are people that click on those links who have not run windows update in a while and also don't have any antivirus applications installed. 

If you read How to hack IP voice and video in real-time, you might have realized that with the right tools, network engineers can gain access to a lot of things. You might even find yourself in a situation that allows you to overhear some important calls that include trade secrets or other secret information. Most large organizations realize this and require employees to swear to company oaths or sign waivers. I've personally been subject to background checks and even credit checks to make sure I'm not getting paid by foreign countries to do their bidding. (FYI to all you crooked politicians and evil countries out there, you can't buy me out).

By default, site-to-site VPNs timeout after 30 minutes of idle time. This is a pain for me when I first try to access a site and have the first few packets of my Remote Desktop session or ping or whatever drop. (Yes - those 3 seconds of my life are EXTREMELY valuable). Here's the secret, straight from Cisco:

PIX/ASA 7.x and later

Enter the vpn-idle-timeout command in
group-policy configuration mode or in username configuration mode in
order to
configure the user timeout period:

hostname(config)#group-policy DfltGrpPolicy attributes
hostname(config-group-policy)#vpn-idle-timeout none

Configure a maximum amount of time for VPN connections with the
vpn-session-timeout command in group-policy
configuration mode or in username configuration mode:

With the iPad making it's debut, I've had a couple clients wanting an IPSec Remote Access VPN so they can access the corporate network remotely from their iPad. Here's the starting template I use: