Another year has come and gone.
I went back to Shmoocon, and then I went to FETC for the first time. Both interesting in their own way, both informative. Depending on your specific working environment, both are worth a look.
The experience of going from the world of deep security to the world of Educational Technology did drive home the need to better communicate. Specifically, the security world is doing a terrible job of explaining why security basics are important to schools. I heard any number of vendors on the show floor talk about their security tools, and even some workshop sessions talk about what to defend against. None of them talked about what it means to defend a network, what should be taught to teachers AND students, what should be prioritized.... What needs to be done BEFORE you buy the blinky-box or the pen-test service. No one said "learn your network, learn your inventory, close the obvious holes, learn what's normal and look for anomalies."
I am not going to rant (much) on this subject. Instead, I will try (again) to put basic starter activities down on paper (blog) and see if it helps anyone.
Plus a quick review of my favorite Shmoocon and FETC talks.
Stay tuned....
Monday, January 30, 2017
Wednesday, March 30, 2016
1 account to rule them all and in the darkness bind them (SHIPS)
OK, so the quote is not exactly correct.
When dealing with a large network, you will often run into a problem with local admin access to a desktop. Which is to say, normal routine is to disable such accounts (a good idea) and use some sort of network based desktop admin account. That works, so long as the machine is authenticating to the network. What happens when that fails?
In many organizations they set a password for a local admin account that can be computed per-device off of the asset tag. Which is great, but what happens when a team member leaves the IT dept? Do you change the way its computed and then change all those local passwords? What happens if you miss one? How about when you have one person leave per month for three months?
Well, there is an answer. Its not perfect but its pretty damn good. Its SHIPS.
SHIPS stands for Shared Host Integrated Password System which tells you someone really wanted the acronym to spell ships. SHIPS is a system that automatically changes local admin passwords on Mac, Windows and Linux. It keeps track of current and past passwords, changes them regularly, keeps track of who checked them out and allows for full accountability.
Its the free Thycotic for the local admin accounts.
Its a great tool and an excellent addition to the IT Security toolbox.
(the install manual is here)
When dealing with a large network, you will often run into a problem with local admin access to a desktop. Which is to say, normal routine is to disable such accounts (a good idea) and use some sort of network based desktop admin account. That works, so long as the machine is authenticating to the network. What happens when that fails?
In many organizations they set a password for a local admin account that can be computed per-device off of the asset tag. Which is great, but what happens when a team member leaves the IT dept? Do you change the way its computed and then change all those local passwords? What happens if you miss one? How about when you have one person leave per month for three months?
Well, there is an answer. Its not perfect but its pretty damn good. Its SHIPS.
SHIPS stands for Shared Host Integrated Password System which tells you someone really wanted the acronym to spell ships. SHIPS is a system that automatically changes local admin passwords on Mac, Windows and Linux. It keeps track of current and past passwords, changes them regularly, keeps track of who checked them out and allows for full accountability.
Its the free Thycotic for the local admin accounts.
Its a great tool and an excellent addition to the IT Security toolbox.
(the install manual is here)
DNS?
Are you watching your DNS logs?
It is rare for anyone in your environment to look for a domain with more than 20 characters in its name. Actually, most have 8 characters according to this slightly out of date bit of research.
All of which means that if you see a spike in requests for LOONG name lookups, something is wrong.
The only way to tell is to look over your DNS logs, or even better have your log system (Elastic anyone?) alert you when it sees such lookups.
Dave Piscitello goes into it further here, but the basics are to monitor who is making what kinds of calls to your DNS and how often.
It is rare for anyone in your environment to look for a domain with more than 20 characters in its name. Actually, most have 8 characters according to this slightly out of date bit of research.
All of which means that if you see a spike in requests for LOONG name lookups, something is wrong.
The only way to tell is to look over your DNS logs, or even better have your log system (Elastic anyone?) alert you when it sees such lookups.
Dave Piscitello goes into it further here, but the basics are to monitor who is making what kinds of calls to your DNS and how often.
Wednesday, January 20, 2016
More on certifications and the job market
Earlier I commented on a particularly empty article from CSO Online regarding certifications.
This time I am commenting on a different slightly more useful article from the same publication.
Its by the same author and begins to discuss which certifications are useful, although in the lightest of terms. She suggests different certs for Security Ops, Security Analysts and CERT analysts. She does not explain why, or what the difference is, I guess that was beyond scope.
So lets help her fill in the missing information.
Except there is no clear answer as to what the differences are. Depending on source (or employer) they are all the same, or vastly different. Security Wizard has some nice definitions that are similar but no where near exact to the ones on Monster. The upshot being that based on acronyms alone, I don't know what the differences are or why you should focus on cert A instead of B.
I was at Shmoocon this past weekend and had a chance to speak again to the awesome recruiter from tenable who gave an impromptu talk at BSides Las Vegas. A quick chat and a fast review of the way things work, and I came away with the same understanding.
Certifications are not bad, but they won't get you the job on their own. You need to show your knowledge, your interest and your ability to learn. Build a home lab, secure your home network, hack yourself, and find out if you like this work.
Then show that enthusiasm to prospective employers. When they ask for your experience, feel free to wax poetic about firmware hacking on your consumer grade router, or how you set up OIP on your home network just to see what is going on. For a starting position, having that under your belt will be more impressive than putting yourself into debt for your CISSP.
Nothing I am saying is new. IT boils down to: Certification is great, but don't beggar yourself getting them, and dont expect their presence to be more important than your abilities and activities.
Whenever I write a post, I come across related interesting resources that don't make it into the post. I think I will start putting them at the bottom.
Odds and ends resources:
Red Team
"how to become a hacker"
Hacking Tutorial
EvilZone - Where to start with hacking
Hack This Site
Blue Team
Blue Team HandBook
Cyber Guardian:Blue Team
(updated to correct typos)
This time I am commenting on a different slightly more useful article from the same publication.
Beyond the basics: The certifications you need based on the path you choose
Its by the same author and begins to discuss which certifications are useful, although in the lightest of terms. She suggests different certs for Security Ops, Security Analysts and CERT analysts. She does not explain why, or what the difference is, I guess that was beyond scope.
So lets help her fill in the missing information.
Except there is no clear answer as to what the differences are. Depending on source (or employer) they are all the same, or vastly different. Security Wizard has some nice definitions that are similar but no where near exact to the ones on Monster. The upshot being that based on acronyms alone, I don't know what the differences are or why you should focus on cert A instead of B.
I was at Shmoocon this past weekend and had a chance to speak again to the awesome recruiter from tenable who gave an impromptu talk at BSides Las Vegas. A quick chat and a fast review of the way things work, and I came away with the same understanding.
Certifications are not bad, but they won't get you the job on their own. You need to show your knowledge, your interest and your ability to learn. Build a home lab, secure your home network, hack yourself, and find out if you like this work.
Then show that enthusiasm to prospective employers. When they ask for your experience, feel free to wax poetic about firmware hacking on your consumer grade router, or how you set up OIP on your home network just to see what is going on. For a starting position, having that under your belt will be more impressive than putting yourself into debt for your CISSP.
Nothing I am saying is new. IT boils down to: Certification is great, but don't beggar yourself getting them, and dont expect their presence to be more important than your abilities and activities.
Whenever I write a post, I come across related interesting resources that don't make it into the post. I think I will start putting them at the bottom.
Odds and ends resources:
Red Team
"how to become a hacker"
Hacking Tutorial
EvilZone - Where to start with hacking
Hack This Site
Blue Team
Blue Team HandBook
Cyber Guardian:Blue Team
(updated to correct typos)
Wednesday, January 13, 2016
IT Awareness on the cheap
"I run an IT department and I have no real budget for anything the CEO cannot see."
Whatever else that sentence may say about the state of business, it is often true.
Here is a quick list of resources that are free or super cheap that can help you (the IT department) get the situational awareness you need in order to keep things secure. Just remember that Time=Money so while the initial Money cost is low, the Time cost makes up for it.
1) Inventory and Maintenance - Spiceworks. Actually I am less and less happy with Spiceworks because it "requires" admin level access to desktops and servers (and switches) to give really useful data. As such it kind of scares me. However, it is free and useful. Just be very careful with it.... maybe don't leave it on all the time? I have not yet found a comfortable level of use but I'm working on it.
2) SNMP Monitoring - Spiceworks can do this, but I don't like it as stated above. So I have been using Observium. Really powerful, and free for basic use. The paid (more updates and some support) version is ~$200/year. Not going to break the bank with that one. Its also pretty, capable, and as secure as you choose to make it. On a side note, remember to use different SNMP community names for every class of device, make them random and long, disable Version1 (and 2 if you can) and try to use read only whenever possible. Oh, right, and setup Apache to run HttpS. Install guides are on the Observium website and Apache SSL tutorials abound. I used this one for CentOS.
3) Log Collection and Correlation - Make an ELK (ElasticSearch, LogStash and Kibana) stack. This has gotten easier since I first started talking about it. SPLUNK is still the gold (platinum?) standard and it still costs a huge amount to run. What I have been toying with lately is using my deeply limited free splunk install to fine tune my log correlation rules (one server at a time) and then applying what I learn to the ELK stack. You can get a basic idea of what windows logs to keep an eye on by going here or here or here. If your running a VM, you can use the very badly named SexiLog which is an OVF running elastic with tweaks for keeping track of VM logs, but can also handle everything else too. Lastly there is the Nagios version. It has a nice front end, comes with support. It is not free, but is far less expensive than splunk and very robust. Here is a nice little write up on it.
4) IDS/SIEM - The fair warning of Time=Money goes six times over on this one. These things take a lot of attention to get them set up correctly, and even then they need to be tweaked all the time. That being said, AlienVault OSSIM works well enough for most of us. AlienVault USIM is the paid product and is expensive, but has good support.
5) Up-time and Accessibility - Most of us have external servers/services and internal servers with outward facing sites. Monitoring it from inside the network is not the best way to keep tabs on it. I use/like the Monitor.us free monitoring dashboard. Simple pings, uptime, full page loads, etc... From two locations around the world.
With a VMware/HyperV server and these tools, you can get a decent view of your network without spending too much money. If you spend some time at home building these out in your lab (or even a work lab if your lucky enough to have one) you should be able to get it all running together without too much time spent, but as always RTFM.
Good luck.
Whatever else that sentence may say about the state of business, it is often true.
Here is a quick list of resources that are free or super cheap that can help you (the IT department) get the situational awareness you need in order to keep things secure. Just remember that Time=Money so while the initial Money cost is low, the Time cost makes up for it.
1) Inventory and Maintenance - Spiceworks. Actually I am less and less happy with Spiceworks because it "requires" admin level access to desktops and servers (and switches) to give really useful data. As such it kind of scares me. However, it is free and useful. Just be very careful with it.... maybe don't leave it on all the time? I have not yet found a comfortable level of use but I'm working on it.
2) SNMP Monitoring - Spiceworks can do this, but I don't like it as stated above. So I have been using Observium. Really powerful, and free for basic use. The paid (more updates and some support) version is ~$200/year. Not going to break the bank with that one. Its also pretty, capable, and as secure as you choose to make it. On a side note, remember to use different SNMP community names for every class of device, make them random and long, disable Version1 (and 2 if you can) and try to use read only whenever possible. Oh, right, and setup Apache to run HttpS. Install guides are on the Observium website and Apache SSL tutorials abound. I used this one for CentOS.
3) Log Collection and Correlation - Make an ELK (ElasticSearch, LogStash and Kibana) stack. This has gotten easier since I first started talking about it. SPLUNK is still the gold (platinum?) standard and it still costs a huge amount to run. What I have been toying with lately is using my deeply limited free splunk install to fine tune my log correlation rules (one server at a time) and then applying what I learn to the ELK stack. You can get a basic idea of what windows logs to keep an eye on by going here or here or here. If your running a VM, you can use the very badly named SexiLog which is an OVF running elastic with tweaks for keeping track of VM logs, but can also handle everything else too. Lastly there is the Nagios version. It has a nice front end, comes with support. It is not free, but is far less expensive than splunk and very robust. Here is a nice little write up on it.
4) IDS/SIEM - The fair warning of Time=Money goes six times over on this one. These things take a lot of attention to get them set up correctly, and even then they need to be tweaked all the time. That being said, AlienVault OSSIM works well enough for most of us. AlienVault USIM is the paid product and is expensive, but has good support.
5) Up-time and Accessibility - Most of us have external servers/services and internal servers with outward facing sites. Monitoring it from inside the network is not the best way to keep tabs on it. I use/like the Monitor.us free monitoring dashboard. Simple pings, uptime, full page loads, etc... From two locations around the world.
With a VMware/HyperV server and these tools, you can get a decent view of your network without spending too much money. If you spend some time at home building these out in your lab (or even a work lab if your lucky enough to have one) you should be able to get it all running together without too much time spent, but as always RTFM.
Good luck.
Is this really such a surprise
A friend of mine wrote this article:
And I just fail to see why this is new or noteworthy.
Some things that need to be noted.
Mr. Goldfarb is an incredibly intelligent person. He is also an accomplished and experienced security professional. He has years of Security operations experience, experience I do not have. His job is very much one in which he spends his time evangelizing FireEye Products and information security in general.
I think that some of my reaction comes from my background, and that might very well cover his viewpoint as well.
Mr. Goldfarb was never in IT operations. Rather he has spent his career almost exclusively in Security Operations. This is not a bad thing, and he will tell you at length why the two must be separate entities and why having a Sec.Ops. background is important for a CIO/CSO to function properly.
I disagree.
I came up through the IT world, so of course I have an IT Ops centric view of things. At one job the Sec. Ops. team was built form the IT and Network group. It gave Sec. Ops. an insight not only into how our network functioned, but into the human side of things as well. An understanding of who traveled where, which employees were killing the system updates because they worked late and when to expect total security failure due to specific employee activity.
Admittedly this was not at a HUGE company, we had ~200 total employees, 10% of which were in some way directly working with, for or in IT. We did however have about 70% of the company traveling internationally at least once a month, with 5 offices on 3 continents. This was a small but by no means simple environment. The extra insight allowed the Sec. Ops. team to head off major issues, prep for "walking disasters" and ignore normal activity coming from what might seem unusual locations.
I also worked for a contractor that provided the IT Ops, but not the Sec. Ops. for a government organization. The organization had several thousand employees, around 1% were involved in IT, and around the same percentage traveled regularly. The contractor that provided Sec. Ops. had no clue what was going on at the human level and there was constant work interruption because of misinterpreted activity. Either allowing malicious activity to continue unabated, or stopping legitimate activity because it tripped some pre-built signature. The employees and IT Support staff hated working with the Sec. Ops. group because they never seemed to know what was going on, despite being well staffed and very bright.
What I am saying is that employee aware correlation of events is nothing new, and no great surprise for anyone who has ever worked on/with a helpdesk. I have endless stories across multiple employers about strange event X that happened every single time a particular employee used a computer. Always traceable to something they were doing, and occasionally causing widespread issues. Ignoring those connections has never been a workable plan.
If the security world at large has so disconnected from those who use the infrastructure they are securing that Mr. Goldfarb's article is news, then I think its time to look again at the inclusion or exclusion of IT in the current Sec. Ops. mix.
Phishing, spear phishing, user targeting, etc... The list of attack techniques that focus on the employee and not the technology is extensive. It is extensive and the attacks are ubiquitous. Why is it a surprise that Sec. Ops. needs to know what the people who use the technology do in order to keep them and the work environment safe? We are supposed to be ensuring the safety of the business so that the people who work there can do business, whatever that business is. Does ignoring their business activities make sense? Is this idea something that CIOs and CSOs are unaware of?
On the other hand its always possible that Mr. Goldfarb happened to be thinking on this, that it was no great surprise or unusual insight, and he just needed a topic for a post.
In either case, I thank him for giving me a reason to write another post of my own.
On a related note (having to do with correlating your log events) --
Lately I have been spending a lot of time working with an ELK stack.
(if you don't know what it is, its a fantastic tool for correlating log events across servers, services and environments.... Its just not always the easiest thing to get running smoothly. You can find more on it here: https://www.elastic.co/ and if your either outsourcing your log collection or don't have any, its a great thing to invest some time into. It now goes into my list of things any IT dept should have.)
I am not yet fluent in its use, however it strikes me as trivial to use it in a manner that will correlate user login events with activities that raise eyebrows. Or even just timing. This might be the first step in allowing you to see who is doing what, when and even possibly where in an SMB environment.
The User's Point of View
And I just fail to see why this is new or noteworthy.
Some things that need to be noted.
Mr. Goldfarb is an incredibly intelligent person. He is also an accomplished and experienced security professional. He has years of Security operations experience, experience I do not have. His job is very much one in which he spends his time evangelizing FireEye Products and information security in general.
I think that some of my reaction comes from my background, and that might very well cover his viewpoint as well.
Mr. Goldfarb was never in IT operations. Rather he has spent his career almost exclusively in Security Operations. This is not a bad thing, and he will tell you at length why the two must be separate entities and why having a Sec.Ops. background is important for a CIO/CSO to function properly.
I disagree.
I came up through the IT world, so of course I have an IT Ops centric view of things. At one job the Sec. Ops. team was built form the IT and Network group. It gave Sec. Ops. an insight not only into how our network functioned, but into the human side of things as well. An understanding of who traveled where, which employees were killing the system updates because they worked late and when to expect total security failure due to specific employee activity.
Admittedly this was not at a HUGE company, we had ~200 total employees, 10% of which were in some way directly working with, for or in IT. We did however have about 70% of the company traveling internationally at least once a month, with 5 offices on 3 continents. This was a small but by no means simple environment. The extra insight allowed the Sec. Ops. team to head off major issues, prep for "walking disasters" and ignore normal activity coming from what might seem unusual locations.
I also worked for a contractor that provided the IT Ops, but not the Sec. Ops. for a government organization. The organization had several thousand employees, around 1% were involved in IT, and around the same percentage traveled regularly. The contractor that provided Sec. Ops. had no clue what was going on at the human level and there was constant work interruption because of misinterpreted activity. Either allowing malicious activity to continue unabated, or stopping legitimate activity because it tripped some pre-built signature. The employees and IT Support staff hated working with the Sec. Ops. group because they never seemed to know what was going on, despite being well staffed and very bright.
What I am saying is that employee aware correlation of events is nothing new, and no great surprise for anyone who has ever worked on/with a helpdesk. I have endless stories across multiple employers about strange event X that happened every single time a particular employee used a computer. Always traceable to something they were doing, and occasionally causing widespread issues. Ignoring those connections has never been a workable plan.
If the security world at large has so disconnected from those who use the infrastructure they are securing that Mr. Goldfarb's article is news, then I think its time to look again at the inclusion or exclusion of IT in the current Sec. Ops. mix.
Phishing, spear phishing, user targeting, etc... The list of attack techniques that focus on the employee and not the technology is extensive. It is extensive and the attacks are ubiquitous. Why is it a surprise that Sec. Ops. needs to know what the people who use the technology do in order to keep them and the work environment safe? We are supposed to be ensuring the safety of the business so that the people who work there can do business, whatever that business is. Does ignoring their business activities make sense? Is this idea something that CIOs and CSOs are unaware of?
On the other hand its always possible that Mr. Goldfarb happened to be thinking on this, that it was no great surprise or unusual insight, and he just needed a topic for a post.
In either case, I thank him for giving me a reason to write another post of my own.
On a related note (having to do with correlating your log events) --
Lately I have been spending a lot of time working with an ELK stack.
(if you don't know what it is, its a fantastic tool for correlating log events across servers, services and environments.... Its just not always the easiest thing to get running smoothly. You can find more on it here: https://www.elastic.co/ and if your either outsourcing your log collection or don't have any, its a great thing to invest some time into. It now goes into my list of things any IT dept should have.)
I am not yet fluent in its use, however it strikes me as trivial to use it in a manner that will correlate user login events with activities that raise eyebrows. Or even just timing. This might be the first step in allowing you to see who is doing what, when and even possibly where in an SMB environment.
A useless teaser article, and my own near useless advice.
This article so annoyed me that I had to mention it.
I keep an eye on the latest version of the "how to break into security" article. They often have some good suggestions, and I like to see how it has changed over time.
However, this one counts as a waste of time and bandwidth. The first thing I noted was that the style is wordy yet vapid. Taking a LONG time to say simple things and not saying much at all. Here is my recap:
[The author] started as a teacher, then got tired of it, went back to school for an MFA, did not expect to become a journalist, has been in the security journalism field for a year, discovered things change fast and everyone is looking to hire.
All actually useful information is promised in the next installment.
The title of this amazing Opus?
With a title like that I expected more than a promise of information later. No where in this "article did the author give us solid reasons for certification, a list of certs, a suggestion of what certs matter to which groups....nothing.
Thank you CSO Online magazine for bringing us the amazing article.
I can only hope that when the series is done, the aggregate is useful.
So waht should you do if you want to start in the security field by getting a certification or two?
First, have a plan. Second, don't spend money you don't have. I know a number of people who got themselves into trouble spending thousands on certifications dreaming of a high paying job without actually having a plan that went beyond getting the cert.
This past August I went to the BSides Las Vegas conference. They managed to wrangle a Q/A session with a bunch of head hunters representing some big name companies in the security sector. The question of Certs came up early and was quickly dismissed. Its not that certs don't count, its that they are a single data point, and not even the most important.
The most important thing they wanted to know was "what are you doing in your lab?" Which really means, what are you teaching yourself at home? Have you taken the time to test yourself on a few VMs running on your laptop? Have you secured your own network? Your own life? Can you speak intelligently about security? Those discussions, more than the letters after your name, were the most important and telling item looked for during an interview.
As for those who DO like certification, that group was made of consulting and contracting firms. Their contracts often require certs for the people they put in place, but those certs change regularly and given the right person the company will pay for the test and sometimes even the training.
So what does this all mean for you? It means get some informal training on sites like Cybrary and HackerAcademy or even Coursera. This wont give you any certs, but it will give you a foundation. Then get some VMs up and running, re-purpose those old PCs, grab dying machines from friends/neighbors/the municipal dump and build a lab[here and here and here].
Lastly, get excited and go learn. If you find yourself up til 2am working on a thorny tech issue with your security lab, your doing it right.
I have been criticised in the past for this view, so I will explain it now and you should understand that it is an opinion, not a set of facts.
You do not have to love Security or IT or Fixing things to go into it, but you will be a far better practitioner if you do. The best indicator of success is the ability to persevere. Its far easier to persevere when you like what your working on. So yes, you can take a bunch of certs, pass them all, and have the technical knowledge to be a security professional without a home lab. However the person with the home lab who struggles to understand and to practice will be a far better hire.
This advice is free, take it for what its worth.
I keep an eye on the latest version of the "how to break into security" article. They often have some good suggestions, and I like to see how it has changed over time.
However, this one counts as a waste of time and bandwidth. The first thing I noted was that the style is wordy yet vapid. Taking a LONG time to say simple things and not saying much at all. Here is my recap:
[The author] started as a teacher, then got tired of it, went back to school for an MFA, did not expect to become a journalist, has been in the security journalism field for a year, discovered things change fast and everyone is looking to hire.
All actually useful information is promised in the next installment.
The title of this amazing Opus?
Why certificates matter, and which ones matter most
With a title like that I expected more than a promise of information later. No where in this "article did the author give us solid reasons for certification, a list of certs, a suggestion of what certs matter to which groups....nothing.
Thank you CSO Online magazine for bringing us the amazing article.
I can only hope that when the series is done, the aggregate is useful.
So waht should you do if you want to start in the security field by getting a certification or two?
First, have a plan. Second, don't spend money you don't have. I know a number of people who got themselves into trouble spending thousands on certifications dreaming of a high paying job without actually having a plan that went beyond getting the cert.
This past August I went to the BSides Las Vegas conference. They managed to wrangle a Q/A session with a bunch of head hunters representing some big name companies in the security sector. The question of Certs came up early and was quickly dismissed. Its not that certs don't count, its that they are a single data point, and not even the most important.
The most important thing they wanted to know was "what are you doing in your lab?" Which really means, what are you teaching yourself at home? Have you taken the time to test yourself on a few VMs running on your laptop? Have you secured your own network? Your own life? Can you speak intelligently about security? Those discussions, more than the letters after your name, were the most important and telling item looked for during an interview.
As for those who DO like certification, that group was made of consulting and contracting firms. Their contracts often require certs for the people they put in place, but those certs change regularly and given the right person the company will pay for the test and sometimes even the training.
So what does this all mean for you? It means get some informal training on sites like Cybrary and HackerAcademy or even Coursera. This wont give you any certs, but it will give you a foundation. Then get some VMs up and running, re-purpose those old PCs, grab dying machines from friends/neighbors/the municipal dump and build a lab[here and here and here].
Lastly, get excited and go learn. If you find yourself up til 2am working on a thorny tech issue with your security lab, your doing it right.
I have been criticised in the past for this view, so I will explain it now and you should understand that it is an opinion, not a set of facts.
You do not have to love Security or IT or Fixing things to go into it, but you will be a far better practitioner if you do. The best indicator of success is the ability to persevere. Its far easier to persevere when you like what your working on. So yes, you can take a bunch of certs, pass them all, and have the technical knowledge to be a security professional without a home lab. However the person with the home lab who struggles to understand and to practice will be a far better hire.
This advice is free, take it for what its worth.
Monday, December 15, 2014
Watch this space
I am working on my flowchart/list of basic security activities.
It shows how to go from nothing to something to usable security.
The issue is that I am trying to find a mid-line between detailed instructions and useful overview. Something that lets you know what to do, without getting bogged down in minutia, and at the same time avoids being so vanilla general that its useless.
I'll keep you posted.
It shows how to go from nothing to something to usable security.
The issue is that I am trying to find a mid-line between detailed instructions and useful overview. Something that lets you know what to do, without getting bogged down in minutia, and at the same time avoids being so vanilla general that its useless.
I'll keep you posted.
Its a "proven failed" method, so why use it?
This is not a conclusive post with detailed instructions.
Rather this is an open ended question for which I have a few quick thoughts.
As always with me it comes down to attacks of opportunity vs targeted attacks.
If you reduce your attack surface and harden your known attack points (firewall, wifi, desktops, remove/change default passwords, snmp, printers, etc) you greatly reduce the chances that a drive by/attack of opportunity will take you down.
However on its own, those items represent a "proven failed methodology".
Which is to say, if all you do is harden the space, without monitoring and investigating, you will fail.
Your network will get popped, hacked, cracked or other terminology meaning someone got to information and access on your network that they were not supposed to get at.
So why do it? Can't I just monitor activity and see the attacks and deal with them at that time?
If defense if doomed to failure, doesn't it make more sense to put my money into detection and reaction?
NO.
Simply put, if you cant reduce the number of attacks you cant respond in any real sense.
Think of your average *airport. Is the security fail-proof? No. Is it tight enough to stop a dedicated hijacker/attacker/bomber? No. However the in place security stops the average person from bringing a gun on board an airplane, and ups the required effort by a dedicated attacker to remove many if not most of the available avenues of attack. This reduces the number of attacks to be dealt with and that in turn makes it possible to look for the kind of original attacks that cant be defended against directly (ok the metaphor starts to break down, but hopefully you see the point).
This topic requires more discussion, proof of effectiveness, detailed reports on what works and why and to what extent. but for now, this is a good start. As an aside, Sony had neither proper defense nor accurate monitoring. they missed the incoming, the outgoing and the jumping between machines that happened inside. They cannot be used as an example of good security at any level.
Good lawyer-ing maybe.
*airport security is a hot topic and one that is debated by people much more in the know than I am.
Needless to say, many security professionals feel that US airport security is "security theater" and that it has never caught a single terrorist. I don't want to get into that discussion, but I cannot ignore its existence.
I fall on the side of "its not good security, whatever it may actually be" and I recognize that there are limits on what they can do politically. For more than that, go find one of the many blogs that harp on this non-stop.
[edited for typos]
Rather this is an open ended question for which I have a few quick thoughts.
As always with me it comes down to attacks of opportunity vs targeted attacks.
If you reduce your attack surface and harden your known attack points (firewall, wifi, desktops, remove/change default passwords, snmp, printers, etc) you greatly reduce the chances that a drive by/attack of opportunity will take you down.
However on its own, those items represent a "proven failed methodology".
Which is to say, if all you do is harden the space, without monitoring and investigating, you will fail.
Your network will get popped, hacked, cracked or other terminology meaning someone got to information and access on your network that they were not supposed to get at.
So why do it? Can't I just monitor activity and see the attacks and deal with them at that time?
If defense if doomed to failure, doesn't it make more sense to put my money into detection and reaction?
NO.
Simply put, if you cant reduce the number of attacks you cant respond in any real sense.
Think of your average *airport. Is the security fail-proof? No. Is it tight enough to stop a dedicated hijacker/attacker/bomber? No. However the in place security stops the average person from bringing a gun on board an airplane, and ups the required effort by a dedicated attacker to remove many if not most of the available avenues of attack. This reduces the number of attacks to be dealt with and that in turn makes it possible to look for the kind of original attacks that cant be defended against directly (ok the metaphor starts to break down, but hopefully you see the point).
This topic requires more discussion, proof of effectiveness, detailed reports on what works and why and to what extent. but for now, this is a good start. As an aside, Sony had neither proper defense nor accurate monitoring. they missed the incoming, the outgoing and the jumping between machines that happened inside. They cannot be used as an example of good security at any level.
Good lawyer-ing maybe.
*airport security is a hot topic and one that is debated by people much more in the know than I am.
Needless to say, many security professionals feel that US airport security is "security theater" and that it has never caught a single terrorist. I don't want to get into that discussion, but I cannot ignore its existence.
I fall on the side of "its not good security, whatever it may actually be" and I recognize that there are limits on what they can do politically. For more than that, go find one of the many blogs that harp on this non-stop.
[edited for typos]
Wednesday, December 10, 2014
A comment on passwords
Things we all know:
Passwords are important
We should not share our passwords
Passwords are annoying
We have too many passwords
Things the IT world knows about people's and passwords:
Passwords will be reused
People will add a 1 to the end
People will base them off their lives
People hate passwords
So honest truth, none of us are great with our passwords. Unless forced we rarely change them, we have a default we use for "unimportant" accounts and we often use bad passwords.
The problem is that there is no longer an unimportant account. Social networking accounts can be used to reset email passwords, email accounts can be used to reset almost any password, and eventually every one of those can lead back to your bank.
So what makes a bad password?
we have all seen this XKCD comic on password strength. Ok that defines (in one way) a good password, but what is a bad password?
Too short: short passwords are easy to crack or fake.
Easily guessed: There are any number of "Common Password" lists out there. If your password is anywhere on that list, you have a bad password. Just as bad, using a password that is uniquely yours, ie your favorite author/book/sport/sport team/etc. Those are also easily guessed.
Re-used: a password used in two places is bad. IF one place gets hacked, your password will likely be tried by an automated system in a bunch of standard locations. It will also be added to one or more of the known password lists and then more easily tried elsewhere during the next hack.
Unusable: This is a tough one to deal with, without help. If your password is a 42 character result of encrypting your cats dna and then multiplying it by your dog's dna.... its not going to be usable. However, you can fix this one easily with a password safe.
How to make a good password:
DON'T
Don't bother manually making a good password. Within the last 5 years more than a BILLION active passwords have been exposed. That means you can assume that whatever cool and innovative trick your using to make your passwords has been used by someone else and their password was exposed somewhere along the lines.
So don't make passwords by hand. Use a password generator.
Between the password save and the password generator you should no longer be looking at your passwords, ever.
I personally like 1password and keepass as my favorites. Lastpass and splashID are also OK, but not my favorites.
Which ever one you use, create a long password to secure it with, and then never create a password again. Let the safe generate and store and enter your password. Use the functionality built into most of them that tells you when its time to change old passwords.
Yes, the safe is a single point of failure in your personal security, however its a reasonable trade off. You, as an individual, are unlikely to get targeted. That means no one is trying to steal and crack your password safe. It does not mean that you are safe from an attack of opportunity.
Those strong passwords and thus your password safe making you a much less likely target for automated easy attacks.
and that is today's ramble.
Passwords are important
We should not share our passwords
Passwords are annoying
We have too many passwords
Things the IT world knows about people's and passwords:
Passwords will be reused
People will add a 1 to the end
People will base them off their lives
People hate passwords
So honest truth, none of us are great with our passwords. Unless forced we rarely change them, we have a default we use for "unimportant" accounts and we often use bad passwords.
The problem is that there is no longer an unimportant account. Social networking accounts can be used to reset email passwords, email accounts can be used to reset almost any password, and eventually every one of those can lead back to your bank.
So what makes a bad password?
we have all seen this XKCD comic on password strength. Ok that defines (in one way) a good password, but what is a bad password?
Too short: short passwords are easy to crack or fake.
Easily guessed: There are any number of "Common Password" lists out there. If your password is anywhere on that list, you have a bad password. Just as bad, using a password that is uniquely yours, ie your favorite author/book/sport/sport team/etc. Those are also easily guessed.
Re-used: a password used in two places is bad. IF one place gets hacked, your password will likely be tried by an automated system in a bunch of standard locations. It will also be added to one or more of the known password lists and then more easily tried elsewhere during the next hack.
Unusable: This is a tough one to deal with, without help. If your password is a 42 character result of encrypting your cats dna and then multiplying it by your dog's dna.... its not going to be usable. However, you can fix this one easily with a password safe.
How to make a good password:
DON'T
Don't bother manually making a good password. Within the last 5 years more than a BILLION active passwords have been exposed. That means you can assume that whatever cool and innovative trick your using to make your passwords has been used by someone else and their password was exposed somewhere along the lines.
So don't make passwords by hand. Use a password generator.
Between the password save and the password generator you should no longer be looking at your passwords, ever.
I personally like 1password and keepass as my favorites. Lastpass and splashID are also OK, but not my favorites.
Which ever one you use, create a long password to secure it with, and then never create a password again. Let the safe generate and store and enter your password. Use the functionality built into most of them that tells you when its time to change old passwords.
Yes, the safe is a single point of failure in your personal security, however its a reasonable trade off. You, as an individual, are unlikely to get targeted. That means no one is trying to steal and crack your password safe. It does not mean that you are safe from an attack of opportunity.
Those strong passwords and thus your password safe making you a much less likely target for automated easy attacks.
and that is today's ramble.
Thursday, November 20, 2014
Network scanning tools - adding one more
Earlier I did a short list of tools I have used for scanning my network.
I forgot one that I use:
SoftPerfect Netscan
Which is ugly but really useful. Has a neat button for finding DHCP servers (uber useful), can list ports, shares, AD info and a bit more. IT also exports to CSV (which oddly AngryIP cannot, though I still reach for it first) which is useful when building your first couple of lists.
<aside>
Why do I care about ugly?
Emotion & Design: Attractive things work better
That's why. That is only one example of research and anecdotes showing that what we see affects how we feel. How we feel affects how well we work.
Ugly tools are not less effective, but they are less likely to be used and a tool on the shelf is useless.
</aside>
Now I have covered the tools I use regularly for scanning my network (I think).
However there are LOTS of free tools out there that each do something different and useful in network scanning.
Explore, test, find the one that fits your needs, and when all else fails combine wireshark with nmap to get the details on almost anything.
I forgot one that I use:
SoftPerfect Netscan
Which is ugly but really useful. Has a neat button for finding DHCP servers (uber useful), can list ports, shares, AD info and a bit more. IT also exports to CSV (which oddly AngryIP cannot, though I still reach for it first) which is useful when building your first couple of lists.
<aside>
Why do I care about ugly?
Emotion & Design: Attractive things work better
That's why. That is only one example of research and anecdotes showing that what we see affects how we feel. How we feel affects how well we work.
Ugly tools are not less effective, but they are less likely to be used and a tool on the shelf is useless.
</aside>
Now I have covered the tools I use regularly for scanning my network (I think).
However there are LOTS of free tools out there that each do something different and useful in network scanning.
Explore, test, find the one that fits your needs, and when all else fails combine wireshark with nmap to get the details on almost anything.
Thursday, November 13, 2014
Escalating privileges ....
Before I pointed at this talk which refers to this web page full of notes (look under files) which further points at other talks regarding security holes on windows machines using (mostly) items already on a standard windows install.
This one is entertaining but hard to understand because the one of the speakers talks very softly and the other loudly.
This one is facsinating, but ... the ....pauses....of.....the....speaker....drive...me....to....sleep.
I found it funny that the word insomnia is at the bottom of his slides.
Regardless he is clearly talented and knows what he's talking about and worth noting.
Most of this is a distraction from the basics.
As noted by my SANS instructor: "if you don't know what is on your network, and you don't know your patching level, [targeted] attacks are not what you need to worry about."
HOWEVER, having at least a passing knowledge of how these attacks work will help when you are doing the next base-unit build out and inventory. (did I mention you need to inventory and baseline your base-build so you know where your starting?)
Before I pointed at this talk which refers to this web page full of notes (look under files) which further points at other talks regarding security holes on windows machines using (mostly) items already on a standard windows install.
This one is entertaining but hard to understand because the one of the speakers talks very softly and the other loudly.
This one is facsinating, but ... the ....pauses....of.....the....speaker....drive...me....to....sleep.
I found it funny that the word insomnia is at the bottom of his slides.
Regardless he is clearly talented and knows what he's talking about and worth noting.
Most of this is a distraction from the basics.
As noted by my SANS instructor: "if you don't know what is on your network, and you don't know your patching level, [targeted] attacks are not what you need to worry about."
HOWEVER, having at least a passing knowledge of how these attacks work will help when you are doing the next base-unit build out and inventory. (did I mention you need to inventory and baseline your base-build so you know where your starting?)
Wednesday, November 12, 2014
An online training source and a comment on watching/listening
There is an excellent and inexpensive way to get more security training.
Coursera
Here is the TED talk that pointed it out to me.
Offering a series of courses on on CyberSecurity from UMD - College Park. A good school. I suggest taking the Signature Track if you can afford it (a few hundred dollars) or the free version (no real proof of completion) if you can't.
Its a combination of videos and reading and online discussion, quizzes and projects.
It is not a small undertaking but it is a good overview. It goes into a lot of programming so its not absolutely ideal for IT, but its still very good.
Now, a short discussion on listening to and watching videos.
If you are like me, you have very little free time.
Once upon a time I had a 45-90minute commute.....each way. So I would listen to podcasts in the car.
I learned an awful lot of stuff, most of it utterly useless.
Then my commute changed and all of a sudden I was down to 12 minutes each way. Sounds like a win, except I missed my podcasts.
I noticed a speed button on my podcast software. I upped it from 1 to 1.25. That worked. Took some getting used to, but it meant that I could hear more than 12 minutes of podcast on my way to work. Slowly, over time, as I realized I could hear every word and understand it, I upped the speed.
Now I can listen to my usual podcasts (no major accents, topics I am familiar with) at 2.5 speed and new subject matter at 2X.
That Ted Talk I linked to above? 10 minutes. That's a lot better. Also, because the time used is shorter, I find I concentrate better.
I used to think, based on limited reading of the research, that reading faster meant better comprehension but I recently found that there is no consensus on this and the research is deeply conflicted.
That being said, for me at least, faster listening IS better.
Even Youtube lets me speed most videos up to 2X.
DO with it as you will, it might just be useful.
As for what podcasts I currently (or in the past) Listen to:
The History of Rome (completed) and now the Revolutions podcast
12 Byzantine Rulers (complete)
Hardcore History (ongoing)
My History Can Beat Up Your Politics
Ted Radio Hour
Ask Me Another
Paul Security Weekly
The Bugle
Ted Talks
BIG Ideas
Intelligence squared US
Intelligence Squared
HAK5
SANS ISC Stormcast
RadioLab
All of which looks like a lot but most only produce an hour a week at 1X and some only an hour a month and others are done so I stopped......
All in all, I take in a lot of info this way, in half the time it was meant to take up.
Coursera
Here is the TED talk that pointed it out to me.
Offering a series of courses on on CyberSecurity from UMD - College Park. A good school. I suggest taking the Signature Track if you can afford it (a few hundred dollars) or the free version (no real proof of completion) if you can't.
Its a combination of videos and reading and online discussion, quizzes and projects.
It is not a small undertaking but it is a good overview. It goes into a lot of programming so its not absolutely ideal for IT, but its still very good.
Now, a short discussion on listening to and watching videos.
If you are like me, you have very little free time.
Once upon a time I had a 45-90minute commute.....each way. So I would listen to podcasts in the car.
I learned an awful lot of stuff, most of it utterly useless.
Then my commute changed and all of a sudden I was down to 12 minutes each way. Sounds like a win, except I missed my podcasts.
I noticed a speed button on my podcast software. I upped it from 1 to 1.25. That worked. Took some getting used to, but it meant that I could hear more than 12 minutes of podcast on my way to work. Slowly, over time, as I realized I could hear every word and understand it, I upped the speed.
Now I can listen to my usual podcasts (no major accents, topics I am familiar with) at 2.5 speed and new subject matter at 2X.
That Ted Talk I linked to above? 10 minutes. That's a lot better. Also, because the time used is shorter, I find I concentrate better.
I used to think, based on limited reading of the research, that reading faster meant better comprehension but I recently found that there is no consensus on this and the research is deeply conflicted.
That being said, for me at least, faster listening IS better.
Even Youtube lets me speed most videos up to 2X.
DO with it as you will, it might just be useful.
As for what podcasts I currently (or in the past) Listen to:
The History of Rome (completed) and now the Revolutions podcast
12 Byzantine Rulers (complete)
Hardcore History (ongoing)
My History Can Beat Up Your Politics
Ted Radio Hour
Ask Me Another
Paul Security Weekly
The Bugle
Ted Talks
BIG Ideas
Intelligence squared US
Intelligence Squared
HAK5
SANS ISC Stormcast
RadioLab
All of which looks like a lot but most only produce an hour a week at 1X and some only an hour a month and others are done so I stopped......
All in all, I take in a lot of info this way, in half the time it was meant to take up.
suggested basics reading
Just some links I found that are useful for basic reading/watching/listening:
I have not yet found a good list of security basics for the IT department of small and medium sized organizations.
I'm looking, as I want my list to be based of research not gut.
I was at last years ShmooCon and there was an EXCELLENT talk on good inexpensive basic security. I had a five minute talk with the speakers trying to work out a way to extend their talk into a full blown conference. I was over-reaching. Just now, a full year later, I'm bringing this to your attention.
WATCH THIS FIRST it is that shmoocon talk posted on youtube.
The first 36 minutes focuses almost exclusively on AppLocker, a very useful and important tool in the IT toolbox.
Next up is client side firewalls. A much maligned and seriously overlooked option that makes a BIG difference in how things work. That is most of what they cover, but listen to the words and concepts. They are talking about the basics, not the fancy expensive stuff. Listen to minute 47 and 48. Aaron states "make it too expensive to attack you and they will go elsewhere".
These two succeed in putting good basic security into their environment.
The rest of us should follow suit.
The SANS reading room, basics section.
An older writeup by someone working in the pharmaceutical world. Not great but does have some good ideas.
CSO Online basics series, some of which is very good and much of it is .... not so good. read carefully.
Mississippi Government page on basic online security which is mostly a group of links, much of which is worth reading.
I have not yet found a good list of security basics for the IT department of small and medium sized organizations.
I'm looking, as I want my list to be based of research not gut.
I was at last years ShmooCon and there was an EXCELLENT talk on good inexpensive basic security. I had a five minute talk with the speakers trying to work out a way to extend their talk into a full blown conference. I was over-reaching. Just now, a full year later, I'm bringing this to your attention.
WATCH THIS FIRST it is that shmoocon talk posted on youtube.
The first 36 minutes focuses almost exclusively on AppLocker, a very useful and important tool in the IT toolbox.
Next up is client side firewalls. A much maligned and seriously overlooked option that makes a BIG difference in how things work. That is most of what they cover, but listen to the words and concepts. They are talking about the basics, not the fancy expensive stuff. Listen to minute 47 and 48. Aaron states "make it too expensive to attack you and they will go elsewhere".
These two succeed in putting good basic security into their environment.
The rest of us should follow suit.
The SANS reading room, basics section.
An older writeup by someone working in the pharmaceutical world. Not great but does have some good ideas.
CSO Online basics series, some of which is very good and much of it is .... not so good. read carefully.
Mississippi Government page on basic online security which is mostly a group of links, much of which is worth reading.
Tuesday, November 11, 2014
Secure Messaging - an EFF review
Very Interesting.
This is NOT in the basics. However it is worth noting.
Many if not most of us use chat/messaging of some sort every day.
We often consider those conversations private. Unfortunately they are often no more private than a discussion in a crowded bar or party. It will take some effort for others to listen in, but its far from private.
The EFF has done a high level basic overview of a great many messaging services and programs available today.
Then they put their findings into a chart (HERE).
Go look, read carefully, tell me what you think.
The interesting notes I picked up on in my first read through were:
1) Gchat sucks for security
2) The various i-Apps are surprisingly not as bad
3) Adium and Pidgin, old standbys for me from my last job, really are very good, of course the server back end needs to be secure as well..... using them with google chat will not give you the same results.
Take-away: for most of us out there, there is not a lot of choice. Your average person does not run their own XMPP server. They want their data accessible from one tool, and they want to use the same service their friends use.
For those of us tasked with running secure environments, you have to think about where you will spend your resources. Your time is not limitless and unless you really lucky, neither is your budget.
Read it over, think on how it affects you, and in all likelihood, go back to what you were doing before.
Knowledge is power, time is money, so ....
Borrowing from physics: The integral of power over time defines the work performed.
Which is a long way to go in order to say:
If you put your knowledge to work, you save (or make) money during that time.
In this case, knowledge of how to handle basic security situations, put into the hands of your staff and put to use will save LOTS of time and money down the road.
This company http://www.knowbe4.com/ takes the (sadly) unusual (in the IT world) step addressing the root cause of many i not most security breeches. The average worker's lack of knowledge.
How many times has someone held the door for your in a place that requires swipe cards to get in? Or buzzed you into a building without asking who you are and why your there?
That person is being nice and completely undoing any security usefulness of a very expensive lock.
That person probably thinks they are doing nothing egregious, and depending on the location and time it likely is harmless..... right up until its not.
If that person knew the math and the consequences, they probably wouldn't be so "nice". They would probably understand that this act of kindness to a stranger is misplaced and in many ways an act of sabotage to their building or office.
KnowBe4 works with staff to train them in how to think about security, to avoid phishing scams and even spear phishing attacks.
I have not had the opportunity to work with them, as they are outside my current budget, but I have had long conversations with their sales people and engineers. I am impressed with the approach and track record.
Check them out.
Monday, November 10, 2014
Scanning that network
Some options:
There is the master of all network scanner: Nmap and its Front end ZenMap (downloaded in the same package) Of which Hak5 has done a lovely little series on using.
but it aint pretty, and often feels like hunting mosquitoes with a howitzer.
I will admit this, with time and effort you will get more specific and more useful information from Nmap than most other free tools. However for your first review of your environment, it will create more confusion than clarity.
If your on a windows machine, there is an old but excellent sysinternals (hey, go with people you trust, and you cant get much more trustworthy than them) tool called ShareEnum which is part of the SysinternalSuite. Its starting to show its age, but its still solid(interestingly, MS says the suite was updated on 9-11-14, but this specific tools was not). It will give you the machines, shares, IPs, some ports and SNMP responses for a list of community strings.
Speaking of SNMP scanning, McAfee (I know, I know, but its a scan tool, not an antivirus machine killing pile of wonderfulness) makes a free and useful if clunky looking SNMP scanning tool called SNScan.exe which is pretty fast but really a one trick pony.
For full network inventory, including users on your AD, machines and switches, you can use something like spiceworks or lansweeper. Both are free, but spiceworks is unlimited free use, lansweeper costs money after the first 100 "assets". As management tools go, its inexpensive, but Im not certain its worth even that cost when compared with spiceworks or a more expensive solution.
The downside to spiceworks of course is dealing with the constant marketing, but that's how they pay for the service and software you get.
Between these items, and the AngryIP Scanner I talked about earlier, you can get a good basic scan going.
Of note, Lansweeper and Spiceworks will help you keep track of the scan results over time.
The rest that I mentioned (well..... nmap....but.....) not so much.
However, making sense of that data on round one, not always so easy.
Friday, November 7, 2014
RTFM....The BOOK
I said before that Read The F*****G Manual was an important part of the basics.
Well two people in the industry with far more chops than me took that to heart and wrote it down.
Ben Clark wrote and published the Red Team Field Manual. (amazon link: http://www.amazon.com/Rtfm-Red-Team-Field-Manual/dp/1494295504/ref=sr_1_1?ie=UTF8&qid=1415380905&sr=8-1&keywords=rtfm )
This is not a basics book. This is a book of references and tricks used by pen-testers and useful to anyone deep enough into security to be testing their environment in the same way.
Again, I highly recommend the book, but not as a basic or beginner item.
Don Murdoch wrote and published the Blue Team Handbook (amazon link: http://www.amazon.com/Blue-Team-Handbook-condensed-Responder/dp/1500734756/ref=sr_1_1?s=books&ie=UTF8&qid=1415381049&sr=1-1&keywords=blue+team+handbook )
This is a more useful book to the average sys-admin because it is geared more as a how-to than as a straight up reference. It augments your basic security understanding specifically as pertains to incident response. It in no way replaces a good basic foundation.
Caveat: I have not yet read either book. All my knowledge on them comes from listening to interviews with both authors. I intend to read the Blue team book and get/use the RTFM and I will update this post when I do.
Some Notes
It is my intention to update the blog weekly.
Normal updates will have a tag of RSP (regularly Scheduled Post) while other items that are small thoughts won't.
When I can, I will go back and comment on/update old posts with new data.
If the data is big enough, the update will be a post of its own.
Most of this is obvious stuff, but hey, if its not said it might be missed.
AAaaaannnnnnd....We're back
OK, three years ago I moved, thought I was going to be without a job for a while, and started a Security blog to help me learn network and computer security.
Immediately after starting the blog I got a job that took ALL my time and focus.
And now I moved again, but am maintaining my job.
In the intervening years I have learned a great deal about computer and network security.
I'm going to attempt to keep a regular blog for the purpose of gathering my thoughts on the subjet.
So let's start:
1) DO NOT go to security conferences until you have the basics down. (basics to be covered next time)
2) DO read and listen to topic specific news on the subject daily.
3) NEVER assume or even think that your done.
In the end, the basics are simple but HUGELY important and ridiculously time consuming.
I do not claim to have them down perfectly, I do not claim to have them fully understood.
I am working on them and I invite you to work along with me.
Step one:
INVENTORY
Do you know what you have in your environment?
Do you know what it does?
Whats on your network?
What does your network even look like?
All these things and more go into your inventory.
Why?
Because you can't fix or secure what you don't even know you have.
Here is how I did my first (yes, I have more than one) inventory. I happen to have a system for end point management already in place, but you can use something like SpiceWorks ( http://www.spiceworks.com/ ) if you have nothing else to help with all of this. It does not replace a physical inventory but it speeds up much of the software legwork.
1) Grabbed a simple IP scanner (angryIP at the time http://angryip.org/ there are better/more complete tools out there but for a first effort, its not bad) and scanned my known network (lets say 10.0.0.1/24) and then because I had the sneaking suspicion I
a) Scanned the entire block (10.0.0.0/8) in pieces
b) Scanned common blocks (eg 192.168.0.0 and 172.16.0.0) as well
Those steps wont necessarily provide useful information for everyone, but I did find items on the network that were not known to have connectivity before this. I exported all of it to Excel, more for the mac addresses than the IPs which I knew would change.
2) I did a walkabout. I walked from room to room, noting machines, network drops, equipment, APs and anything else that fell into my world. This data went into the same spreadsheet.
3) I started matching up data where I could so I could see what holes were left in my Knowledge. Which MAC addresses did I not have? Which ones did I have that I could not place?
4) Servers came next, specifically what software did I have on them? What Ports did each piece of software use?
5) Then I returned to the desktops, using my management tools, I collected a list of all installed software.
6) Switches and APs were then plotted: what connects to what, in which building and room, drop and port? What firmware versions? What OSes?
7) Firewall Rules: I listed them all out and made a data flow diagram showing what inspections are made to data coming in and going out.
8) Collate and report: turning the spreadsheet and diagrams into usable data is hard and time consuming. For one thing, at this point you don't even know for certain what is important. For me, I made an install count of software. I found that certain items were installed everywhere, others in only some places and others were one-off installs. Those lists made it much easier to find issues and make changes later on. I made sure to list all my hardware with as much data as possible on a single sheet, then I used VLookups to create lists of hardware based on specific criteria in other sheets. This meant I only needed to update one list to get updates data in all lists.
I did much of the same for software.
All of this took the better part of two weeks to do properly, while handling support and maintenance duties at the same time.
Now I have given you a taste of step one.
Next time I will list out all the basics as I see them. Then we will continue to talk about how I approached it, what tools I used, which podcasts and news feeds I keep an eye/ear on and where it all goes next.
Your comments and constructive criticism are very much welcome.
Subscribe to:
Posts (Atom)