Do your Linux servers use LVM? If not, you should strongly consider it. Unless, you are using ZFS, BTRFS, or other “controversial” filesystems. ZFS and BTRFS are outside of scope for this discussion but are definitely worth reviewing if you haven’t heard of them and are running Linux in your environment. Logical Volume Manager for Linux is a proven storage technology created in 1998. It offers layers of abstraction between your storage devices in your Linux system and the filesystems that live on them. Why would you want to add an extra layer between your servers and their storage you might ask? Here are some reasons: Flexibility You can add more physical storage devices if needed, and present them as a single filesystem. Online maintenance – Need to grow or shrink your filesystems, online, and in real-time? This is possible with LVM. It is possible to live migrate your data to new storage. Thin provisioning can be done, which can allow you to over-commit your storage if you really want to. Device naming – you can name your devices something that makes sense instead of whatever name Linux gives the device. Meaningful device names like Data, App, or DB are easier to understand than SDA, SDB, SDC This also has the benefit of reducing mistakes when working with block devices directly. Performance – it is possible to stripe your disks and improve performance. Redundancy – it is also possible to add fault tolerance to ensure data availability. Snapshots This is one of my favorite reasons for using LVM. You can take point-in-time snapshots of your system Those snapshots can then be copied off somewhere else. It is also possible to mount the snapshots and manipulate the data more granularly. Want to do something risky on your system, and if it doesn’t work out, have a quick rollback path? LVM is perfect for this. So how does it work? According to Red Hat :“Logical Volume Management (LVM) presents a simple logical view of underlying physical storage space, such as hard drives or LUNs. Partitions on physical storage are represented as physical volumes that can be grouped together into volume groups. Each volume group can be divided into multiple logical volumes, each of which is analogous to a standard disk partition. Therefore, LVM logical volumes function as partitions that can span multiple physical disks.” I think LVM is much easier to understand with a diagram. The above image illustrates some of the concepts involved with LVM. Physical storage devices recognized by the system can be presented as PVs (Physical Volumes). These PVs can either be the entire raw disk, or partitions, as illustrated above. A VG (Volume Group) is composed of one or more PVs. This is a storage pool, and it is possible to expand it by adding more PVs. It is even possible to mix and match storage technologies within a VG. The VG can then allocate LVs (Logical Volumes) from the pool of storage, which is seen as raw devices. These devices would then get formatted with the file system of your choice. They can grow or shrink as needed, so long as space is available in either direction for the operation. You really should be using LVM on your Linux servers. Without LVM, many of these operations discussed above are typically offline, risky, and painful. These all amount to downtime, which we in IT like to avoid. While some may argue that the additional abstractions add unnecessary complexity, I would argue that LVM really isn’t that complicated once you get to know it. The value of using LVM greatly outweighs the complexity in my opinion. The value proposition is even greater when using LVM on physical Linux nodes using local storage. SAN storage and virtual environments in hypervisors typically have snapshot capabilities built-in, but even those do not offer all of the benefits of LVM. It also offers another layer of protection in those instances. Alternatively, the aforementioned ZFS and BTRFS are possible alternatives, and arguably better choices depending on who you ask. However, due to the licensing (ZFS) and potential stability (BTRFS) issues, careful consideration is needed with those technologies. Perhaps those considerations are topics for a future blog… Want to learn more? Please reach out, we’re here to help.
Network Access Control (NAC) – Keeping the Devices and Users Where They Belong. I work in a lot of network environments and I see a lot of different approaches to security and networking. One constant I have found is that all IT professionals struggle to adequately identify and secure the devices that may be on their network. Aside from having insane levels of security and prohibitive onboarding practices for devices, it is almost impossible to dynamically assign network access without the use of a network access control solution. I will dive into the basics with my mostly vendor agnostic explanation. What a NAC is. At the most fundamental level, network access control systems are designed to help identify devices and users on your network and then do something with the identification. The solution often integrates with most directory or identity providers. It can be used for authentication, authorization, and access. (AAA) The system can leverage hard-coded attributes of the user or device and enforce a security posture to them. The NAC can also leverage other components like how the device is connecting, where the devices are connecting from, and other more nuanced dynamic characteristics of the connectivity and identity. What the system does with that information is the most important part. As an example, it is rare that every person in a business network should have the same access. However, it is not rare that many people in a department or division would have very comparable access or restrictions. Similarly, devices that are generally doing the same job likely require identical network access. If the NAC can leverage user attributes like department or division then it can use similar attributes for a device. It understands that an HVAC air handler requires the same access as was assigned to the other air handlers that share the same device attributes. Enforcement Policies With the use of what some vendors call roles with enforcement policies, one can automate the application of access based on identity. This allows for a scalable solution that can deliver the same application of security without the intervention of an administrator for every network connection. This concept is called role-based access. I use the term application of security very loosely because each vendor accomplishes this task in different ways. Some will tunnel the user traffic to a firewall or wireless controller and apply stateful firewall policies to the user traffic. Others will change the network or VLAN the device is on so that the access is restricted to that network segment. Some rely on client-side software to enforce the application of a role assigned from the NAC. Other helpful things a NAC can do Integrate with endpoint AV software to assess the vulnerability of a client and use that as an attribute for access. Apply the same security posture to both wired and wireless clients. Centralize the administration and logging for all AAA exchanges. Integrate with edge firewalls from Cisco, Palo Alto, Fortinet, and others What a NAC is not A network access control solution is not the panacea that will make all your aliments cease. NACs by themselves hold a great deal of machine learning potential. It does require some semblance of initial administration to create the logic by which they will apply the enforcement of policies from. They are not infallible. Like any computing system, they do need some TLC when first deployed. Once they are up and running, you can sleep easier at night knowing that there is an intelligent application of security for anything connecting to your network. Here are a few other things they cannot do NACs are not meant for IP address management. I see a lot of people trying to use them as this and most are ill-suited for the task. Just because it has a record of the IP address does not mean it should be used as a database. They are not plug and play. No matter what the vendor tells you it will be a very involved deployment. Not every NAC integrates with every other product. Each vendor has their own special sauce that makes using their NAC with their equipment more appealing. Cisco, HPE Aruba Networking, FortiNet all have features that are only available when you are using their equipment with their NAC. Use Cases I would recommend a NAC to anyone who runs a network with more than 100 users. If we assume that each person will likely have three computing devices, then that is 300 end-user devices. Not all of them being corporate-owned and managed, we would need to delineate access for each user group and device type. We will then need to ascertain if we want to apply different security based on how the device/user connects or if the device presents a risk to the company. This sounds like a lot of work and it can be. But, the work would only need to be done one time if we were programming logic into a NAC solution. Best application of NACs Securing wired ports – We all know that users will bring in devices from home to use so why not protect your environment from the inevitable. Wireless for everybody – Just because the device is connected to the same SSID as all the other devices, it does not have to mean that they have the same security applied or are on the same logical network. Dynamic logins for your most sensitive devices – Securing your switches, routers, and firewalls with Radius or TACACS+ is how you protect against getting hacked from the inside. This is not meant as a comprehensive analysis of each of the major players in the marketplace. In fact, there are some decent open source and free NAC-like products out there that are relatively capable. Most of those do not support machine learning and cannot identify devices very well. However, they can provide authentication and authorization functions. At the very least my hope was to impress upon anyone in the
Defining Software Asset Management (SAM) By definition, Software Asset Management (SAM) is a business practice that involves managing and optimizing the purchase, deployment, maintenance, utilization, and disposal of software applications within an organization. To many of our customers, SAM is associated with software compliance, software audits, risk mitigation, risk analysis, and cost savings. All of these ring true. My experience with SAM as a discipline spans all types of businesses, whether SMB, Corporate, Enterprise, all the way up to Government and Education. SAM, whether we realize it or not, truly is a subject that affects nearly all organizations at some point in time. If you’ve ever been faced with a Software audit, or have been tapped on the shoulder for a “voluntary” compliance check by a Software Manufacturer, SAM is typically the discipline utilized to come the rescue. Over the course of my 18 years in IT, SAM has been one of the top growth areas across the software segment. Whether a small-mid sized or large enterprise, the risks and impact to the organization remain the same. Organizations who are found out of compliance can expect to be dealt heavy fines, whether from the BSA (Business Software Alliance) or the software manufacturer; negative internal & external exposure (especially for state/local government and publicly traded organizations); and in many cases I’ve seen, a loss in employment to those directly in charge of managing the software assets in question. So, yes, SAM is a critical discipline. When we talk about SAM, as a starting point, we consider the following: Title Version number What licensing considerations apply (by user/device/processor/core/etc.) Whether or not the license is covered via maintenance What we understand about SAM goes far beyond being under-licensed. I’ve seen many cases where legacy buying behaviors often reveal over-licensing. By understanding what you’ve purchased, whether or not it’s used, and how often it’s used, we create a business case for future purchases – Or sometimes the opposite: the case to support a NON purchase event.
HPE Aruba Networking UXI Sensor In early 2018, HPE Aruba Networking announced they were buying Cape networks, the developers of the Cape sensor. Rebranded as the HPE Aruba Networking User Experience Insight (UXI), the sensor sits on your network. It alerts you whenever your network is having problems. It may not seem like much, but it is an amazing little device that could help IT departments everywhere. When deployed, the HPE Aruba Networking UXI sensor acts like a user on your network, except much smarter. No more complaints about “the internet isn’t working”. Instead, you get personalized alerts telling you exactly what is going wrong. Whether that means DNS is unresponsive, or merely yahoo.com is having an outage. The sensor is designed to work straight out of the box on any network. It just needs to be registered to a dashboard. Then give credentials to the wifi or plug it into the ethernet. It takes so little set up. It can be mailed to a remote site and set up by anyone. All configuration is done in the web portal. All standard tests and alert thresholds come preconfigured. No set up is even needed, though you can definitely still customize it. HPE Aruba Networking Dashboard The dashboard is simple and easy to use. It gives you access to a lot of information about your network. Hover over any piece on the home page to get alert info. Then, click to drill down further and see a trove of other information, such as signal strength, channel, response times for things like dns or dhcp, even websites if you set them up. The sensor can be configured to check both internal and external services. Whether you use internal websites and fileshares, or Google docs and Microsoft OneDrive, you can test them all to be sure they are up and running. If they aren’t, the IT department is the first to know. Proactive Alerts Alerts are sent via email whenever certain customizable thresholds are met. This enables IT departments to know about a problem before a user has a chance to report it. They will also know exactly what went wrong without having to hunt around for the cause of the issue. The alert says which service is down. Quickly letting IT know if the entire internet is down, or if its just the DNS service on a server. Website issues can also be shown through the alerts. Knowing exactly whats wrong, quickly enables the IT department to address the issue faster. This results in less down time and less unhappy users. Cloud Accessibility The dashboard and all data are hosted in the cloud. This allows for you to access it anywhere, at any time. No need to be on site to diagnose an issue. No worries about not being able to see data and alerts while a site is down. Diagnosing issues is half the battle in the helpdesk world. Eliminating this problem, enables the IT department to be far more efficient and timely in resolving those issues. Location, Location, Location Arubas UXI sensor should be placed in a spot where wifi is used most, or problem areas that you would like more information on. It comes with a couple different ways to mount it. It can also be set on a desk or table just as easily. A secure mounting bracket can be deployed in public areas without the fear of it disappearing. All it needs is power either provided by the included power adapter, or by a PoE solution. The sensor also isn’t just limited to wifi. It works over ethernet as well, so you can check all network connections at once. A user experience sensor is a valuable tool for any company, small or large. The key feature is that it enhances the response time of any IT department. Faster response times mean less downtime, which means less time your company is running smoothly. The solution is constantly being updated with more features being added every day to make the jobs of you and your IT department easier. Contact ProCern for more information on this solution or other networking products for your organization.
What Is Azure Site Recovery? Business outages are caused by natural events and operational failures. Organizations need a business continuity and disaster recovery (BCDR) strategy that keeps apps and data safe and available during both planned and unplanned downtime. It also needs to be able to recover those apps and data to normal working conditions as soon as possible. Azure Site Recovery meets these needs through the following avenues: Simple, automated protection and disaster recovery in the cloud Orchestrated disaster recovery as a service (DRaaS) Replication and disaster recovery to Azure Continuous health monitoring with Site Recovery Why Site Recovery? There are a host of reasons why Azure Site Recovery is an excellent option for BCDR, including recovery in the cloud, resiliency, testing, flexible failover, and continuous monitoring. Disaster Recovery in the Cloud Replicate workloads running on VMs and physical servers to Azure, rather than to a secondary site. This eliminates the cost and complexity of maintaining a secondary data center. With Site Recovery, you have the ability to replicate any workload running on-premises, Hyper-V VMs, and Windows/Linux physical servers. Resilience Site Recovery orchestrates replication and failover, without intercepting application data. Replicated data is stored in Azure storage, with the resilience that provides. When failover occurs, Azure VMs are created based on the replicated data. Testing Without Disruption Azure Site Recovery allows you to easily run test failovers to support disaster recovery drills without affecting production environments. Rich Recovery Plans with Flexible Failover and Recovery Recovery plans allow modeling to customize failover and recovery of multi-tier applications spread over multiple VMs. Order groups within plans, and add scripts and manual actions. Recovery plans can be integrated with Azure automation runbooks. You can run planned failovers for expected outages with zero data loss, or be prepared for unplanned failovers with minimal data loss. Easily fail back to the primary site when it’s available again. Continuous Health Monitoring Site Recovery monitors the state of your protected instances continuously and remotely from Azure. Interested in learning more about how Azure Site Recovery can improve (or even become) your “plan for a rainy day”? Please contact us today to learn more about this exciting solution!
Cloud computing has definitely impacted how most enterprise IT Departments are managing their overall IT architecture. Businesses are constantly reevaluating what infrastructure will work best for their environment. Is it private cloud, public cloud, or hybrid cloud? What are the differences between these types of clouds? Cloud computing has definitely impacted how most enterprise IT Departments are managing their overall IT architecture. Businesses are constantly reevaluating what infrastructure will work best for their environment. Is it private cloud, public cloud, or hybrid cloud? All three options provide similar benefits, including cost-effectiveness, performance and reliability but ultimately which deployment method a business chooses is dependent upon their business needs. Public Cloud Public cloud is a term for cloud computing services offered over the public Internet and available to anyone who wants to purchase them. This type of cloud typically offers the greatest level of efficiency in shared resources however they are typically more vulnerable than private clouds. Microsoft Azure is an example of a public cloud. All hardware, software, and other supporting infrastructure is owned and managed by the cloud provider. You share the same hardware, storage, and network devices with other organizations or “cloud tenants.” You access your services and manage your account using a web browser. A public cloud may be a good option when: Your workload for applications is used by lots of people, such as email You have SaaS (Software as a Service) applications from a vendor who has a well implemented security strategy You need incremental capacity (ability to add computer capacity for peak times) You are doing collaboration projects You are doing an ad-hoc software development project using a Platform as a Service (PaaS) offering cloud Testing and developing environments Public cloud storage is for the most part cheaper than on-premises storage especially when you look into the upkeep and upgrades you may need with your hardware. Most cloud-storage services can accommodate periodic surges and typically have security protocols in place to protect your data including backup in a second location. The biggest warning is to make sure that your business takes the extra time and due diligence to ensure you have security and governance issues well planned. This option may work best for small businesses since they typically do not have a lot of proprietary information that requires extra security. Private Cloud A private cloud consists of computing resources used exclusively by one business or organization. It can be located physically at a business’ on-site datacenter or it can be hosted by a third-party service provider. The services and infrastructure are always maintained on a private network and the hardware and software are dedicated solely to the organization to allow your business to customize its resources to best fit your specific IT requirements. Private clouds are often used by government agencies, financial institutions and other mid to large size organizations where its critical to have control over their IT environment. Advantages include: Ability to customize the cloud environment to meet your specific business needs Improved security since your resources are not shared with others High Scalability Here are some additional indicators that your application may be a good fit for the private cloud: Application has very predictable usage patterns and low storage costs You need high performance access to a file system. For example, a media company that creates or produces large videos An application that may be poorly written or infrequently used that may not be worth the effort of moving it to the public cloud Hybrid Cloud A hybrid cloud is becoming a more popular choice for businesses of all sizes. It is where both public and private cloud are utilized to host your data. In a hybrid cloud, both data and applications can move between private and public clouds for greater flexibility. Cloud bursting is also an option when using a hybrid cloud. Its when an application or resource runs in the private cloud until there is a spike in demand such as during the holiday season when online shopping is at its peak and then at that point, the organization can “burst through” to the public cloud to tap into additional computing resources. Advantages of hybrid clouds: Control: you can maintain a private infrastructure for sensitive assets Flexibility: take advantage of additional resources in the public cloud when you need them Cost-effectiveness: You pay for extra computing power only when needed Ease: You can migrate to the cloud gradually and phase in workloads over time. A hybrid environment is only as strong as the integrations that unite them. The team managing the infrastructure should always be running performance monitoring, regular testing, and data ingress and egress procedures to reveal possible areas of difficulty and when to further evolve the application. When deciding what cloud platform works best for you, its best to analyze your business’ needs and what will work the best for your budget, security, and compliance. ProCern is available to sit down with you for a discovery of what will work best for your organization. Contact us today to find out more on how we can help.
Ensure a Stress-Free Migration So, you think you’re ready for the jump to Microsoft 365? You have done your research; licensing, cost-savings, administration, migration strategies, best practices, etc. You have weighed the costs of doing the migration in-house or choosing a vendor to assist. What’s next? Ensuring a stress-free migration for you and your users will need 3 things: Smart planning Smart decisions Time There are many things recommended to make the migration go smoothly. One key piece of smart planning is ensuring the Active Directory accounts, which are migrating to Microsoft 365, are prepared for the migration. Successful directory synchronization between your on-premise directory and Microsoft 365 requires that attributes are properly configured. The following 5 tasks should be completed in Active Directory to plan for a smooth migration: 1. Active Directory Cleanup Tasks Perform the following cleanup tasks in your on-premise directory: Ensure that each user has a valid and unique email address in the proxyAddress Field Remove Duplicates in the proxyAddress field Ensure each user has a valid and unique value for the userPrincipalName atrribute in the user’s user object For best use of the global address list (GAL), be sure the information in the following attributes is accurate: givenName surnamedisplayName Job Title Department Office Office Phone Mobile Phone Fax Number Street Address City State Zip Country 2. Directory Object and Attribute Preparation Directory synchronization will fail if some of the Active Directory users have one or more duplicate attributes. If there are duplicate values, the first user with the value is synchronized. Subsequent users will not appear in Office 365. The following attributes should need prepared: Mail Attribute must be unique within the directory mailNickname (Exchange alias) Cannot begin with a period (.). Attribute must be unique within the directory proxyAddresses Can accept multiple values Value must not contain a space Attribute must be unique within the directory Invalid characters: [ “ | , / : < > + = ; ? * ] sAMAccountName Maximum characters: 20 Attribute must be unique within the directory Invalid characters: [ “ | , / : < > + = ; ? * ] targetAddress Maximum characters: 255 Value must not contain a space Attribute must be unique within the directory Invalid characters: [ “ | , / : < > + = ; ? * ] All SMTP addresses should comply with email messaging standards UserPrincipalName Must be in the Internet-style sign-in format: [email protected] Invalid characters: [ “ | , / : < > + = ; ? * ] The @ character is required in each value The @ character cannot be the first character The user cannot end with a period (.), &, a space, or @ Routable domains must be used, local or internal domains cannot be used 3. Prepare the userPrincipalName Attribute Active Directory is designed to allow the end users to sign in to the directory by using either sAMAccountName or userPrincipalName. End users can sign in to Microsoft 365 by using the user principal name (UPN) of their work or school account. Directory synchronization attempts to create new users in Azure Active Directory by using the same UPN that’s in the on-premises directory. The UPN is formatted like an email address. In Office 365, the UPN is the default attribute that’s used to generate the email address. It’s easy to get userPrincipalName (on-premises and in Azure Active Directory) and the primary email address in proxyAddresses set to different values. When they are set to different values, there can be confusion for administrators and end users. 4. Add an Alternative UPN Suffix (if needed) There may be a need to add an alternative UPN suffix to associate the user’s corporate credentials with the Microsoft 365 environment. A UPN suffix is the part of a UPN to the right of the @ character. UPNs can contain letters, numbers, periods, dashes, and underscores, but no other types of characters. 5. Match the On-Premise UPN with Microsoft 365 UPN If directory synchronization is already setup, the user’s UPN for Microsoft 365 may not match the user’s on-premise UPN that’s defined in the on-premise directory service. This can occur when a user was assigned a license before the domain was verified. To fix this, use PowerShell to fix duplicate UPN to update the user’s UPN to ensure that the Microsoft 365 UPN matches the corporate user name and domain. When updating the UPN in the on-premise directory service and to have it synchronized with the Azure Active Directory identity, remove the user’s license in Microsoft 365 prior to making the changes on-premise. It is common for the on-premise domain to have a .local extension. In these cases, it is required to add an alternate UPN suffix to the .local domain which matches the email addresses of the users begin migrated. For example, if the local domain is contoso.local, but the email domain is contoso.com (i.e. users have email addresses of [email protected]) an alternate UPN suffix is required on the local domain. In addition, the user’s primary UPN needs to be modified to reflect the UPN which needs to match the email domain. IdFix Tool Microsoft provides a tool to make this process easier, it is called the IdFix tool. In fact, Microsoft does not recommend making the above changes without the tool. IdFix can find errors, report on errors, and even allow to take actions to edit or remove the attributes. All prior to attempting synchronization. Conclusion These are the main values in Active Directory which need to be validated or modified to ensure a smooth transition to Microsoft 365, and IdFix can assist in identifying these values.
You might ask, “with current flux in budgets and instability in the marketplace, why would you look at a refresh?” That is a great question. The answer is not a refresh in a “what am I going to buy” kind of mentality. Instead, a refresh PLAN that will allow you to immerse yourself in your environment and thoroughly understand exactly where it sits. Let me explain further. What is a Data Center Refresh Firstly, what do I mean by a data center refresh? I would define this as a strategic IT infrastructure project intended to overhaul storage, servers and related network devices. Refresh project plans that address on-premises hardware, cloud-based platforms and services, and the in managed or co-located data centers — or a hybrid approach involving all. But is that all it is? I would argue that there is more to this. You can also develop a good data center refresh plan that is a top-to-bottom assessment of the current state of your IT infrastructure. This not only tells you what might be aging, but also what is costing you too much money to maintain. Discover where possible security vulnerabilities might be, or something as simple as what firmware needs to be updated. What to Consider with a Hardware/Software Refresh Knowing this, the next step would be to understand what to consider when looking at a Hardware/Software Refresh. For example: What hardware has reached its end-of-life (EOL) stage? Use performance metrics like load tests to indicate what needs a thorough overhaul. What original equipment manufacturer (OEM) warranties are expiring? Is the current OEM still supporting all of your hardware versions/generations? Is my company meeting regulations regarding equipment and data storage? Will there be significant business expansion that requires an overhaul in data storage devices and related capabilities? Prioritizing Next, you would need to prioritize what part of your infrastructure needs to be refreshed or enhanced. A couple areas to start would be: Windows Server Review – A Windows server upgrade, such as upgrading Windows Server 2008 to 2016 or Windows 10, can be planned proactively as part of a wider server refresh cycle. Data center Optimization – this is a moment to compare the costs, convenience and amenities of your current environment with an alternative. For example, if you’ve been using on-premises servers, compare it to the latest in Co-location or Cloud Services Future Storage Needs – When scaling is on the horizon, experts recommend an estimated server storage expansion plan by at least four times your current capacity. This might be something to focus on as work from home models become more and more prevalent the future, flexible storage needs will need to be met. Auditing Other Devices (again especially in the increase in the work from home model that we have seen in 2020) Office Computer Devices Office Mobile Devices Peripheral devices, such as monitors, printers and copiers Network devices including routers, switches and network printers Network infrastructure like cabling and internet connection Review cybersecurity components for your entire data center Firewalls Spam Filters Authentications Traffic monitoring and controls IDS Applications Firmware/software updates Is your environment up to date? Do you have a lead that has the responsibilities for these updates? Which updates need to be done first? Is security or performance updates more important? Implement Best Practices Routine Once you have prioritized and completed these tasks/ and audits, you will have a much better idea of where to focus your budget. You can plan how best to take your environment through the next calendar or fiscal year. We also recommend developing a best practices routine for how you can keep yourself focused on next steps and maintaining your current environment optimally. Here are a couple of our most recommended: Perform Regular Audits, looking for the following red flags: Processor power Input or output speeds Load testing Bus speeds Server performance and benchmark tests Check Your Link Dependencies – Consider adding a formal dependency log into your auditing procedures to track and manage reconfiguration histories and schedules and ensure every application layer runs cohesively. Roll out Upgrades in Phases: Start with pilot upgrades in a production environment to check cross-system compatibility and functionality. Then, prioritize the Refresh based on Downtime Tolerance per group with the following server functions having downtime kept to a minimum: Application servers or any similar extension of your web servers Domain controllers SQL server Any related layers permitting business-critical operations to function, such as file access and email Comfort Food for the IT Soul In the end, whether you use these examples or not, the idea will be to put together a thoughtful, immersive, end to end deep dive. Discover what is working, what will soon need to be addressed, and what is critical to replace/enhance/ refresh. To me, that sounds like comfort food for the IT soul. That knowledge and understanding would help me sleep at night. Knowing that I don’t have some unknown surprises lurking in a unsupported product that is about to die, or a security vulnerability because I did not update my firmware, or any other host of small issues that this kind of plan can mitigate. If you would like to learn more on this from ProCern, we are of course standing by to help when and where it is needed!
What Is Ransomware? Ransomware is a form of Malware that, once activated, can deny access to files on smartphones, personal computers, and servers. In some forms, a Ransomware attack will go beyond denial of service; and the Cyber Criminals will threaten to publish your data. As the name suggests, Ransomware offers to unlock your files if you pay a ransom. While modern day Ransomware attacks can be traced back to 2005, the history of Ransomware goes back as far as 1989. The pace of these attacks doesn’t appear to be slowing down. In 2016, many sources had payouts approaching $1 billion by the end of the year. As you might imagine, having been around for such a long time, Cyber Criminals have developed several ways to launch Ransomware attacks. Within the data center, our first goal is to keep these attacks out of our systems and away from our production data. IT Professionals protect their production environments by using firewalls, anti-virus software, proper authentication practices, and end-user education, among other measures. Despite these efforts, there is always the possibility that an attack is successful and systems are compromised. In the event our corporate files do become impacted by a Ransomware event, we must be able to rely on our data backups to restore systems and not be forced to pay a ransom. However, this begs an important question: How can we be sure that our backups are protected? This is a question that is being asked more frequently by our clients. First, we need to acknowledge that backups are not free from the risk of being attacked by Ransomware. However, there are steps that can be taken to reduce the risk of exposure, even if the Malware has found its way into the Production infrastructure. These steps fall generally into three categories: Security, Replication, and Isolation. Security Provide a dedicated host for the backup application. Disable network interfaces not in use on the hosts involved in performing backups. Restrict the number of user accounts with access to the backup application and the host onto which it is installed. Disable access to communications ports and protocols not needed for the backup operation (i.e., HTTP, FTP, Telnet, etc.). Disable accounts not used for operation of the backup process. Disable services not used for operation of the backup process. Utilize best practices for user credentials (password complexity, aging, etc.). Keep Security Patches up to date on the host and the backup application itself. Replication Maintain at least three (3) copies of the backup files on at least two (2) different types of media and keep at least one (1) of those copies offsite. (3-2-1 Rule) Consider keeping a copy of your backup on tape or on spinning disk that is not connected to the network unless backups are running. The point here is to maintain an offline copy. If replicating between backup appliances, consider building a delay into replication to keep from immediately replicating files infected with the Ransomware. This tactic may allow you time to discover the proliferation of an attack and keep it from spreading to your replication target. Utilize hardware based snapshots on Production storage arrays and backup appliances (these are not usually presented to a file system and are therefore not subject to attack). Maintain multiple restore points using snapshots and the backup software. Isolation Maintain separate hosts for the backup infrastructure. Utilize offline backup media (tape or disconnected disk targets). Utilize hardware based snapshots. Utilize Cloud connected backup targets. The steps listed above are intended to provide guidelines for protecting your backup data from Ransomware. Execution of these steps is dependent on your own infrastructure, the type of backup targets you employ, the backup software you use, etc. There are many resources available that delve into this topic in greater detail. The intent of this post is simply to make sure you are including backups in your strategy to protect the enterprise against Ransomware attacks. And, of course, ProCern is ready to help you design a strategy that fits your needs and is right for your environment.
Email scams have been around as long as email has existed. Many use the same techniques that scammers have been using long before the internet was a common tool. In the internet age, email scams have become more deceptive and common, and even seasoned internet users have fallen victim to these scams. Unfortunately, there is no program or anti-virus to protect us from these scams. They are social engineering attacks, or scams that rely on tricking users, rather than infecting machines with malicious code or software. The only way to protect yourself from these types of scam is to be aware of them and recognize the signs that an email is a scam. Email programs have improved immensely over the years by adding spam filters and junk folders, but no anti-spam filter is perfect. Below are a few ways to recognize email scams. How to Recognize Email Scams Fake Links Among the most common email scams are phishing scams. These are emails designed to look like a product or service you use (Office 365, paypal, etc.) and they include a link for you to click on and enter login credentials. These emails can be revealed as fake by checking the email address and the URL of the link. Often, the email address will be close to something that the actual company would use ([email protected] instead of @microsoft.com for example). Check the email closely to see if the address is spelled correctly. Another part of the email address to check is the domain (the part of the email address after the @ symbol). Check to see that it matches the company’s website. For example, Wells Fargo would be sending emails from an @wellsfargo.com email not wellsfargobank.com as their website is wellsfargo.com. Next, check the URL by hovering over the link with your mouse cursor. Again, it should match the company’s website. Do not click on the link if it doesn’t match the company’s website. If an email seems fishy to you, don’t trust it. If you aren’t sure, send an email or make a call to the company’s support line to verify the email is real. Advanced Fee Scams Another common type of scam is the advanced fee scam. Everyone has heard of the Nigerian prince that will pay you millions of dollars. Their money is locked up and can’t be accessed unless you send them a small fee that they will then use to recover their millions. Usually these emails include some sob story, and try to use your emotions against you. The best thing to remember about these types of scams is that if it seems too good to be true, it probably is. This scam has been around a very long time. The best way to deal with it is to just ignore the email, delete it, and move on. Employment Search Scams The employment search scam comes in the form of a job offer, requesting that you fill out a job application. These job applications are designed to get as much personal information as possible in order to steal your identity. Or, they may try to get access to your bank account and steal money that way. If you are being solicited by a company that you didn’t contact first, be very wary of a scam. Do your research on the company. Does the job title match the company’s industry? Do the job postings on their website match the information in the email? If the answers to these questions are no, the chances are good that you’ve discovered a scam. Disaster Relief/Charity Scams In times of disaster, where people have died or lost everything, donations sites will be set up to raise funds for those in need. Unfortunately, many people take advantage of this situation by setting up fake charities or phishing sites to get you to donate to them instead of the legitimate organizations. Donation requests through email are nearly always a scam, so ignore them all. If you want to donate to a charity or relief foundation, contact them directly through their website or via phone. NEVER click on a link in an email asking for donations. The best way to avoid getting scammed is to always be skeptical of anyone asking for your private information. Ask yourself some simple questions like: Do I know these people?Did I request this email? If the answer to these questions is “no”, it is most likely a scam.
A Moment in History: Environmental Disaster On April 26, 1986, there was a large and highly destructive steam explosion in the number 4 Nuclear Reactor of the Chernobyl Nuclear Power Plant. This steam explosion ruptured the reactor core and caused an open air reactor core fire. This open air reactor fire went on for 9 days and spread a considerable amount of radioactive contamination over parts of the former USSR and Europe. The loss of life is and was undetermined, because of the both the secrecy of the USSR during this time and the lack of a distinct way for the medical professionals of Europe to pinpoint how many people developed cancer from this specific event. However, we do know that 2 deaths happened in the initial explosion. Twenty-eight more died in the days and weeks afterward due to acute radiation syndrome. It is considered the worst nuclear disaster in history. Data Breach Disaster In March and April 2019, a massive data breach occurred with Capital One. Thousands of users personal information, social security numbers, and bank account numbers were stolen. This breach was not discovered by Capital One until July 17, 2019, when the individual who stole the information tipped off Capital One that it happened. According to statements by Capital One, “the individual responsible was able to take advantage of a configuration vulnerability to steal sensitive records stored with Amazon Web Services”. The configuration vulnerability was a misconfigured firewall that the hacker obtained access to. 30 GB of Capital One’s sensitive information was downloaded. What makes this situation stickier, if not terrifying, is the hacker was an employee of Amazon Web Services from 2015 through 2016. It has been theorized that the hacker had some inside knowledge of how best to gain this access. According to multiple reports, this kind of breach is not uncommon with companies using a web-based cloud storage option. Companies are not changing their security procedures to match with the rapid change in the usage of the cloud. The Connection At this point you might ask, in what way are these two events similar or linked? The answer is not much. At least on the surface. For me personally, I just happened to watch a Chernobyl documentary on the same day I read of this data breach. It got my mind turning, as I researched and looked at both events. They were both disasters, but on totally different scales. One was a major environmental and human disaster, while the other will only affect people monetarily. However, if you dig deeper you can see one major theme with both events. There was a human element of mistakes due to not following proper procedures (and in some respects sheer arrogance). In both cases, awareness, understanding, and fixing the issues took way too long. This caused further damage to the millions that were affected. Disaster Awareness Seeing these similarities in such starkly different circumstances was eye opening for me. It caused me to do an introspective look at my personal and professional life. It got me asking, am I assuming too much? If I know the procedures to avert issues and disasters, does everyone around me know? Am I prepared to believe the impossible is possible, and change my way of thinking to ensure an issue does not grow into a larger disaster? How will I react when something does happen, will I panic or will I have a practiced triage process that I can move right into? How will this affect my family, my friends, my co-workers, and my work in general? You get the point. A wholesale look from top to bottom. Not surprisingly, I did find things that I can change/improve. New ways where I could be more open. I discovered several things that I did not think about before. In the end, it was refreshing and helped alleviate stress built up that I did not even know I had. Proactive Action I have promised myself that this is something I will do on a regular basis going forward. At this point in my long running internal dialog, I came to the realization that this is how customers must feel when a particularly well executed assessment is done. Or when their projects for a new backup/DR site come online. Or maybe when they change their entire IT outlook to safer, modern, and proactive technologies. Our customers, instead of waiting around for something to happen, are proactively changing the landscape to avert disasters. We as a solution provider are not changing the world, or averting disasters for millions, or developing plans for when accidents/disasters strike. It is actually our customers who are. For me, that is a really powerful thought. How wonderful is it to think that we can be there, side by side, as they work to ensure data breaches are not happening. Or how ProCern can bring up a new video surveillance system that will ensure better security for our customers and their customers? The answer to these questions is not just wonderful, it is humbling.
Finding Active Directory Issues Anyone who has ever worked with Microsoft’s Active Directory, either as an end user or administrator, has undoubtedly come across strangeness and unexplained occurrences. Active Directory serves many purposes: identity management, resource policy deployment, and user security management to name a few. Active Directory handles its extremely complex inter-workings in a very robust and flexible way. It is designed to resist outages and lost communication while continuing to provide services to users. While all of that is good from an availability standpoint, it also makes it easy to hide problems from its administrators. Help Desk conversations about Active Directory can often be heard with the phrases, “I don’t know why that happened,” “That’s weird. I’ve never seen it do that before,” and “Oh well, it works now.” These conversations can lead to the realization that Active Directory isn’t totally healthy and could be performing better than it is currently. Something as simple as logging on to a workstation may generate multiple errors that aren’t visible to the end user except in the symptom of a log on delay.The health of Active Directory can be affected in many ways. Changes to Active Directory throughout the years can add up to significant problems that seem to show up suddenly. Examples of these types of changes could be any of the following: Adding or removing domain controllers Upgrading domain controllers Adding or removing Exchange servers Adding or removing physical sites to your environment Extending the schema Unreliable communication between domain controllers These changes, if done incorrectly, can cause multiple problems including log on issues, replication failures, DNS misconfiguration, or GPO problems to name a few.Simple questions that you can ask yourself to determine if your Active Directory is currently not as healthy as it could be are as follows: Do your users complain of strange log on or authentication issues? Does it take an abnormally long time for users to log on to their workstations? Do your GPOs work sometimes and not other times? Do you get strange references to old domain controllers or Exchange servers that have long since been removed? Do you have issues resolving server’s names through DNS? Do your DNS servers get out of sync? Do DNS entries mysteriously disappear? And maybe most importantly, have you ever employed an admin that was given full rights to Active Directory who you later learned was not qualified? Active Directory is integral to the IT success of just about every company. Finding issues and correcting them before they become a problem can prevent outages and future losses in revenue. Whether you are currently experiencing noticeable issues or just want a “feel good” report on the current status of your Active Directory, ProCern can provide that peace of mind. With over 15 years supporting Microsoft Active Directory services for our customers, we have the experience and skills to get your Active Directory to a healthy state. Our proven method of using various tools to extract Active Directory information, analyze that data, and prepare and deliver a detailed report has proven very successful. Contact ProCern today to set up an appointment to talk about your Active Directory needs.