7 Best Security Practices: (3) Frequent Security Assessments

Continuing my blogs on Gary Miliefsky's article "The 7 best practices for network security in 2007", I'd like to continue by discussing the need for Frequent Security Assessments.

The basic premise is to continually double-check yourself. The real question is "whose standard should you check yourself against?"

In the world of Windows, you can start with the Microsoft Baseline Security Analyzer (MBSA) which determines the state of security for your Window's servers. If you'd like to dig a bit deeper and look at everything from your Windows environment to IT policies to training to perimeter defense (and more), you can check out Microsoft's Security Assessment Tool (MSAT).

If you want to step outside of Redmond and use a third-party standard, you can look at:

• The NSA's guide for Windows Server 2003
• The NSA's guide for Windows XP - the Security Configuration Guides are extremely detailed
• The Center for Internet Security's Benchmark/Scoring Tools

For more on how ScriptLogic solutions fit into the assessment of Windows security, see my previous posting on How Much Does Data Theft Really Cost.

7 Security Best Practices: (2) Security Awareness

In my last blog, I discussed establishing security policies. Following Gary Miliefsky's article, the next step I'd like to discuss is the issue of security awareness organization-wide. Even with the best desktop management solution in place that patches systems, protects against malware, restricts access to removable storage, and locks down the desktop to limit user ability, users still need to be aware of a few issues that will enhance the security you've established as well as help users understand why the security is in place:

• Corporate Security Policies - Cover password policies (such as how often passwords are changed, minimum complexity requirements, etc), use of "confidential" information, discuss the security configuration of their desktop and why it is the way it is, etc.
• Online Do's and Don'ts - discuss the threat of phishing scams, questionable sites that attempt to install malicious software, etc.
• Acceptable Use Policies - Often performing business tasks online never puts the organization at risk (the users are going to known sites to perform tasks, etc) so the issue of "can I pay my bills online from work" etc. should be addressed.
• Legal Concerns - if you have a General Counsel in-house, have them discuss any issues they are aware of that can impact the organization. For example, if you are a publically traded company, ensuring information that can be misconstrued as insider information needs to be sent via trackable methods (e.g. and email system that is being archived).
• Security Breaches - discuss what to do in the event a user recognizes security has been broken - a shared password, the "accidental" installation of suspected malware, etc. Letting users know they won't lose their job for telling the truth can often lead to a faster resolution of the situation and a more secure network overall.

So how are you suppose to convey these messages? There are a few "old school" methods such as:

• Scheduled Meetings
• Acceptable Use Handbooks
• Company-wide Email Blasts

But the company of today faces challenges in getting everyone into one room to ensure the message is heard. Here are several other more high-tech methods:

• Setup a Security Awareness Portal - use Windows SharePoint Services, Microsoft's free version of SharePoint Portal Server. You can host this on any modern Windows server OS. You can also use products like Drupal and WordPress are free blog/portal sites you can install on just about any web server.
• RSS Feeds - if you can't make the users come to the portal, take the portal to the users. Outlook 2007 supports RSS Feeds, as well as about a thousand more feed readers. Users can pull down updated content relevant to them. This provides for a more custom experience for the user.
• Webinars - Use GoToMeeting, LiveMeeting or Webex to setup a live webinar to promote your security message. These solutions allow for asking questions, showing slide decks, a computer desktop (for demonstration of any security do's and don'ts).

Use these methods to keep employees up to date on not just the latest corporate policies, but on the lates scams, viruses, patches that will be placed on their systems (and when), etc. Putting all of this together will make your employees a part of your security strategy, not the reason for it.

7 Security Best Practices: (1) Security Policies

I recently read an article in Network Word entitled "The 7 best practices for network security in 2007" written by Gary Miliefsky, who founded NetClarity and was involved in the founding of the U.S. Department of Homeland Security.

He breaks network security into 7 basic Steps:

1) Roll out corporate security policies
2) Deliver corporate security awareness and training
3) Run frequent information security self-assessments
4) Perform regulatory compliance self-assessments
5) Deploy corporate-wide encryption
6) Value, protect, track and manage all corporate assets
7) Test business continuity and disaster recovery planning

I'm going to spend my next few posts and discuss each of these aspects of security, beginning with the first step, Roll Out Corporate Security Policies, in this post.

In his article, Gary lays the foundation of network security by discussing security policies. Several industry-accepted standards can be used as a basis for establishing company security policies:

• IT Infrastructure Library (ITIL)
• Control Objectives for Information and related Technology (COBIT)
• ISO 17799

Additionally, often I find organizations are willing to adhere to regulatory standards established for the US government, such as Federal Information Security Management Act (FISMA), now merged with the FIPS 200 standard.

The key to these standards is to remember that none of them are technology-specific, vendor-specific, solution-specific or implementation-specific; they are guidelines to establishing a secure infrastructure and are open to some interpretation.

I unfortunately can say that I have actually read each and every word of those standards (to figure out where ScriptLogic's solutions fit) and can tell you that they all boil down to a few key issues you need to address:

• Assessment - determine the current state of security
• Assignment - establish standards for implementing security consistently
• Auditing - validate security controls and testing access
• Accountability - establish processes that utilize justifications and approvals
• Availability - build a business continutiy and/or disaster recovery plan
• Assurance - maintain an environment not prone to outside influence via malicious code

The combination of these basic concepts makes up ScriptLogic's Security Lifecycle Map which we use to denote where our solutions fit in the security "big picture."

What is a "Virtual Desktop" Anyway?

If you've paid one bit of attention to the IT industry at all, you've been bombarded with the concept of a "virtual desktop." To some it means streaming applications down to the desktop so users can run any app anytime. To others it means running an entire Guest OS desktop inside a virtual machine that can be hosted on a standard desktop or on a server (using solutions such as VMWare's VDI, or Microsoft's upcoming "Vista Enterprise Centralized Desktop"). Still to others it means accessing published apps via a Terminal/Presentation Server environment. Let me give you a good example of how blurred the lines are becoming.

Take a published app from a Citrix Presentation Server - the user experience is they click on an icon on the desktop and the application appears (it is actually running on a Presentation Server but is displayed in a frame around the application window). Now take a technology I saw at VMWorld where a virtual machine image is sitting on the desktop (but behind the scenes) and is accessed by VMWare's Player. The trick is the user doesn't see the entire VM player, they see only a windowed app (that is actually running within the VM). Sound familiar? It should - the user experience is exactly the same - it is only the underlying technology that differs.

So there in lies a perfect example of the confusion the IT industry as a whole is facing.

To simplify this confusion down a bit, I believe the question organizations should be asking themselves isn't "what is a virtual desktop?" but instead "what benefit will I get from a virtual desktop?" The answer is organizations perceive a virtual desktop will give them user productivity in the form of instant access to a consistent, secure and functional working environment. While that may not help you decide which type of virtualization is right for you, it should provide som clarity as to why you even care (or should care) about desktop virtualization.

While virtualization is potentially simplifying the lives of end-users by delivering a desktop that allows them to work anytime, anywhere, it is also causing more work for IT:

IT now needs to deal with users that have a physical desktop, but sometimes connect from home into a Terminal or Presentation server environment, or even perhaps utilize a virtual machine running on their personal desktop from their home that connects to work over a VPN. How is IT supposed to keep all of these desktops and user environments consistent when a given user can be using a physical, virtual or terminal desktop?

The answer lies in a desktop management solution that can not only function across all three environments, but one that also (and more importantly) can distinguish between them so that each environment can be not only appropriately configured for use, but also secured.

For example, Desktop Authority's Validation Logic has the ability to differentiate when a user is logging on from a Terminal/Presentation server, from within a VMWare Guest OS, or from any of 7 classes of physical machines (laptop, desktop, server, etc). This gives IT a tremendous amount of power to properly configure each user based on (among other things) the type of environment (physical/virtual/terminal) the user is currently using.

So while the industry continues to jump on the Virtual Desktop bandwagon, adding in "yet another form of virtual desktop" to expand the already confused borders of definition, keep in mind that you will be needing, no matter the virtualization method, a way to manage those desktops.

How Much Does Data Theft Really Cost?

Any security software company touting protection against data theft always has some amazing ROI to show how much a potential buyer will save. But what is the real cost? Insurance underwriter company Darwin has a specialty insurance product - Tech//404 - that addresses "the technology and information risks of providers and technology-dependent organizations." This special policy protects against exposure in the areas of network security, data privacy, compliance, and more all revolving round data loss.

As part of their value proposition, thay have built a data loss calculator using numbers of records as the basis for calculation. I used the smallest number yielding results, 1000 records, and found the results to be surprising as to the amount of loss, and impressive in regards to Tech//404's attention to the detail of a loss.

Just 1000 records yields an average loss of over $166K, or $166 per record! Forrester Research did a survey of 28 companies and found the cost per record to span from $90 to $305 per record! So what is an organization to do? First, let's discuss where the security breaches exist in a typical organization:

• Lenient permissions to resources
• Unmanaged group memberships providing access
• Convenient access to writeable and removable data mediums (USB, CDR, etc)
• Insecure endpoint open to external malicious attack

To protect against these points of security failure, you will need a good security plan. I look at security as three basic processes:

• Assess - Determine the state of your security: see who has access to what resources, who has membership in groups with access, what resources are exposed to "everyone", determine which endpoints provide access to steal data (via USB, CD/DVD burners, bluetooth, FireWire, etc), and determine the security of endpoint OSes from malicious attack.
• Assign - Based on your assessment, establish appropriate levels of security: Lock down permissions to resources, restrict group memberships, eliminate access to "Everyone" and "guest" groups and users, lock down endpoint devices and protect endpoints from malicious code with antivirus, antispyware and antiphishing solutions.
• Audit - Watch (or at least be alerted to) the activity on sensitive systems. This includes auditing the usage of sensitive data, the management of group memberships, management of resource permissions, auditing access to removable storage, and monitoring the state of your patching and virus/spyware/phishing scanning efforts.

One of the many value propositions we make at ScriptLogic is the protection against data theft. Following the security lifecycle of "Assess, Assign, Audit", our solutions help in the areas of:

Assessment:

• Active Directory - Active Administrator searches for permissions in AD to determine who can make changes that affect access to data, such as the ability to change passwords or modify group memberships.
• Windows File Servers - Security Explorer searches for in appropriate permissions on NTFS Volumes. Enterprise Security Reporter reports on groups and their membership that have been granted permissions on NTFS Volumes.
• Windows Clients - Desktop Authority scans managed systems for the latest patches and the presence of spyware.

Assignment:

• Active Directory - Active Administrator establishes consistent delegations to ensure no inappropriate permissions are granted via group memberships.
• Windows File Servers - Security Explorer consistently assigns permissions across multiple servers.
• Windows Clients - Desktop Authority patches insecure systems, removes spyware, locks down endpoint devices and provides the ability to maintain a consistent, secure and functional working environment for your users without the need to granting them administrative privileges to be able to work.

Auditing:

• Active Directory - Active Administrator centrally audits the management of AD, making IT aware of changes as they occur.
• Windows File Servers - Enterprise Security Reporter reports on security changes using its' "Delta Reporting" capability, making you aware of inappropriate modifications to security.
• Windows Clients - Desktop Authority audits access to endpoint devices, informing IT of inappropriate activities.

In the world of Microsoft Windows it is possible to proactively protect your network from data loss by establishing a simple security plan of "Assess, Assign, Audit" and using the right solutions to put that plan comprehensively into action.

Will Apple ban iPods?

In a recent Network World article, Cara Garretson talks about a new "proof of concept" iPod virus (which is very harmless - but it proves the point that it is possible for an iPod to carry a virus). The issue at hand is, of course, the iPod's ability to serve as a portable drive which can potentially deliver malicious code.

I remember reading about how Samsung banned its own cell phone in the production plant (because of the phone's ability to take pictures and email them) so I wonder will mp3 player manufacturers like Apple ban their own players?

The answer isn't banning the device, but in securing the end point, for both eliminating the introduction of malicious software, but also the stealing of company information (80GB is a ton of information, folks!).

The answer is the policy-driven securing of end-point devices. Desktop Authority's USB & Port security option is a good example of how this can be accomplished.


With over 20 device types supported, this option to Desktop Authority ensures secure end points. But because it also touts a granular permissions model that can deny access as well as allow read-only or read/write access, users can be allowed to access those devices that are required to accomplish their work (such as making a CD Burner function like a CD-ROM drive so data can be read from a CD), which raises user productivity.

Desktop Authority - Security with Productivity.

The Disaster-Ready Desktop

Virtual Strategy magazine posted an interesting article today on how most companies are at financial risk due to a lack of disaster planning. It cites that organizations lose anywhere from $84,000 to $90,000 per hour of downtime in trying to get their servers back up and running.

The interesting part about disaster planning is that noone ever seems to plan for the disaster-ready desktop. Think about it: It's all well and wonderful if you have all your AD, servers, and services back up and running because of a DR plan, but what about the desktops that will connect to those servers?

There are a few possible situations most will plan for (and some of the relevant desktop considerations that should be taken):

• Server Failure (think single server) - If a failover server is utilized, desktops may need to be reconfigured to point to a new server. This can mean reconfiguring of drive mappings, printers, registry entries, INI file entries, Outlook profile settings, and more all in the name of a server name change. Having a solution that reconfigures every related aspect of the desktop to point to the alternate server(s) would save countless hours of manual reconfiguration and lack of productivity.
• WAN Failure - If a remote office cannot access their data center, IT can be inundated with calls regarding failing applications, errors when attempting to connect to a resource (even one as simple as a drive mapping or network printer), etc. Having a solution that removes the error-proned desktop elements (drives, printers, shortcuts, etc) along with message boxes on the desktop informing users of the outage and reconfiguration would save lower support calls, raise employee awareness and, assuming users can work on something during the outage instead of spending time calling IT, user productivity should be raised.
• Site Failure (power outage, natural disaster, chemical spill, etc) - All servers and desktops in the office would be unavailable, requiring a comprehensive failover site. The good news is this scenario has the best opportunity to be tested, as it should be self-sufficient once up and running. Having a solution that comprehensively deploys the desktop configuraiton meeting the business needs at the time of disaster is critical. It can be part original configuration, but it stands to reason (and experience) that not every system will work flawlessly and therefore some alternate configuraiton will be necessary to resume user productivity.

In all these cases, the desktop requires some amount of reconfiguration. A desktop management solution that closely meets the needs during a disaster cannot simply focus on deploying applications; it must focus on the whole desktop - apps, drives, printers, profiles, registry tweaks, security settings, etc. Anything IT needs to manipulate, the desktop management solution needs to deploy easily.

File System Auditor 2.0 Public Beta

We recently released a public beta 1 of File System Auditor 2.0. This new verison touts some exciting new features:

• New easier-to-use interface
• Installation without the need for Server reboots
• Ships with canned Process Exclusion Filters (which you can optionally enable) for common Anti-Virus, Anti-Spyware, Backup and File Replication Software
• Auditing of permission changes
• Centralized configuraiton of audited file systems (version 1.x required installtion and configuraiton of each server separately)
• Improved cluster support

If you're new to FSA, it audits, reports, and alerts Windows file server activity, showing who touched which files and folders, when, and on what server, all from a centralized console.

The public beta is available at our Beta Site. You can also read more about the current version of File System Auditor.

ScriptLogic wins Redmond Reader's Choice 2007 Awards!

Well, OK, not all of them, but we did win a few. For those of you not entirely familiar with these awards, every year Redmond Magazine asks its readership to vote of the solutions they feel best meet the daily needs of IT.

Desktop Authority was the recipient of the "Best Network Automation and Batch Processing Tool" category. This is the third year in a row we've won this award.

Active Administrator won the "Best Group Policy Manager-ISV" category for the second year in a row. To clarify, anywhere Microsoft has a product in a given category, Redmond separates out the ISVs to show beyond native solutions, what the IT industry is using.

This is not only a win for ScriptLogic, but judging by the fact that so many administrators are using Desktop Authority for desktop management and Active Administrator for group policy management and have voted for our solutions, IT is a winner as well.

Desktop Authority 7.6 Released!

The latest version of our Desktop Authority platform was released to the public late last night after weeks of beta testing by our customers. Version 7.6's primary focus was to be completely Vista compatible to assist those migrating to Vista by first extending DA's Validation Logic to support detecting the Vista OS, then by adding Vista-specific features, such as managing User Account Control settings and then finally by ensuring every aspect of Desktop Authority works with Vista as well as it does for 95-XP desktops.

Having a management platform that works equally well with Vista as it does with older OSes is key to ensuring a smooth Vista migration, which is why nearly all the feature focus in Desktop Authority 7.6 is on Vista.

One other feature that is extremely notable is the addition of a VMWare Validation Logic entry. To support those environments that are running a mix of physical and virtual desktops (in varying ratios), Desktop Authority can be used to identify VMWare-based virtual clients and, if need be, configure them differently from their physical counterparts, making Desktop Authority equally a valid management platform for organizations migrating from Physical to Virtual.

If you've never tried Desktop Authority before, a 30-day, fully functional trial is available for download.