Shoulder Surfing...

Working in IT security, I understand and advocate the importance of PINs and passwords, as well as explaining why they shouldn't be shared.  My 8 year old and 6 year old have computer lessons at school from which they understand the importance of keeping passwords secret. 

On our home PC, I've created profiles for them where they insisted on having passwords and even I as the administrator/father don't know their passwords.  It makes me proud when I try and trick the password out of the them, that they won't tell me.

Imagine my surprise when my wife recounts her day, where my 2 year old son was happily playing on the iPad and listening to iTunes.  I tell my wife that my iPad is PIN protected!  I've been "shoulder surfed" by my two year old son!

Not a major problem as I don't keep important information on it, but he can play Angry Birds whenever he wants (and pretty much does)...

 

What if this was a work environment, it would not be acceptable if this had happened.  In fact, I would suspect someone would get either a verbal or written warning for such a security lapse.  Maybe I have a certain amount of paranoia, but I don't check my email on my mobile when there are people close enough to shoulder surf me.  Not that I have anything that private or personal, but I don't know what's in that email until I open it.

 

The facts around visual security are pretty much as you expect:

• 80% chance that you've already become a victim of others reading over your shoulder
• £1.9 million is the average cost to businesses per incident of physical data theft
• 96% of data breaches in 2010 were avoidable
• 52% of laptop users in the UK are ignoring visual security issues
• 67% of working professionals surveys in the US had worked on some type of sensitive data outside of the office.

Visual security of on-screen data can be a key part of the implementation of ISO 27001.  So if you excuse the reflection, you can see both my laptop and desktop screen when looking at them head on.

 

 

Here is my screen from an angle and slightly above to give the view of a shoulder surfer, you can see my 3M privacy filters working their magic.

 



 

When the view angle exceeds 30 degrees, the screen is protected.  You can also see a notch in the top right allowing these to be removed to give the normal visibility back.

 

e92plus have started distributing the 3M privacy filters and free samples can be requested from here: http://www.securityplusonline.co.uk/3m  



An Introduction to Neocoretech NDV

Neocoretech does not have an operating system requirement, as part of the installer will install a bespoke Linux build, optimised to run the Neocoretech solution. The installation package can be deployed in minutes via a CD ROM, with subsequent servers dynamically integrated into the architecture.

NDV supports multiple operating systems, including Windows and Linux, with both 32-bit and 64-bit distributions supported.  The GUI based management console is intuitive, utilising a “drag and drop” interface.

High Availability can be quickly configured and deployed, without a requirement for a SAN.  Direct Attached Storage is utilised for media storage, but with an innovative architecture, RAM is utilised to create quick virtual PCs, without the IOPS storm even if multiple virtual PCs are started.

“Read-only” virtual PCs can be created giving the user a clean PC every day.  This leads to convenient management, standard build control, better disk usage and better administrative control. Persistent (personal) virtual machines can be created as well, giving a more conventional PC experience.

There are three deployment options, including:

1)      Single server deployments, hosting all the functions

2)      Two server deployments, giving a highly available architecture

3)      Multiple server deployments, giving distributed functionality and large scale deployments

If you are interested in becoming a reseller or want to see a web demo, please contact e92plus for more information.

DroboApps and Firefly iTunes server

After following the instructions on the DroboApps website: (http://www.drobo.com/droboapps), I installed Apache and the DroboApps Admin Utility.

Using the DroboApps Admin Utility, I installed the Firefly application. I then changed the server name and the default password, and I was up and running.  Browsing to the DroboApps share, I dropped my music into the media folder within the Firefly folder.

The only issue was that my iTunes could not see the shared library!  A bit of searching found this Apple support article: http://support.apple.com/kb/TS2972

It seems that my software firewall was not allowing TCP port 3689 and UDP port 5353. Once opened up, iTunes instantly found the shared library.

All my music is currently being moved off my netbook, into the secure and resilient environment of the Drobo.

- Posted using BlogPress from my iPhone

Introduction to DroboApps

There is a strong community of developers, creating applications for the Drobo devices.  The applications are called DroboApps, and the download files can be found here: http://www.drobo.com/droboapps/

Being new to DroboApps, I went against my technical gut instinct, and read the manual!  There is a very useful document highlighting how to install DroboApps, along with some installation examples: http://support.datarobotics.com/app/answers/detail/a_id/468

Having enable the DroboApps functionality on the appliance, I had a look through to see what I need to download, along with what I wanted to download.

Going through the DroboApps, I downloaded the following:

• DroboApps Admin Utility
• Apache (required for the admin utility)
• Firefly (iTunes library)
• Fuppes (Media server with DLNA support)
• Lighttpd (HTTP server)
• Pure-ftpd (FTP server)

As mentioned previously, the reason Drobo caught my attention previously, was the fact I could have more just two hard drives in an appliance, and that it could be my iTunes library.

DroboApps Admin Utility, Apache and Firefly will be installed soon.  I will document and review the features then.

Introduction to the Drobo Dashboard and Configuration

The hardware was very easy to put together, and the software was just as simple to set up.  There are a lot of screenshots here, but you can see it was pretty much a case of "next, next, next" to get the dashboard installed.  Once installed, you will have the dashboard up and running.

1. Once the Drobo Dashboard software is installed and running, it is looking for Drobo devices.

2. The Drobo device is detected, but at this point my device was still starting up.

3. Clicking on the "Advanced controls" and looking at the "Data" tab, I can see what is in the device and it has correctly identified my four 1TB 3.5" SATA hard drives.

4. The "Tools" tab, offers a number of commands, alert settings, device settings and updates.

5. The dashboard shows how much free space I have and the shares available.

6. Expanding the "How is my storage being used?" shows more drive information.

7. As I selected the option to check for updates, this box somes up.

8. Clicking on the highlighted option to change the Admin password, shown in images 6 & 7 above, brings up the "Admin" under the settings.  There is also an option to enable DroboApps (which I plan to investigate more in the future)

9. By default, the Drobo device will protect your data in the event of one hard drive failing.  There is a option to enable dual disk redundancy, which will protect the data in the event of two drives failing.  It does use more hard disk space, but I guess it depends how important you data is.  As my device will be holding family photos and my MP3s, I will be enabling the dual drive redundancy.

10. On the "Network" tab, the network settings can be configured.  I will be setting this to match my internal network.

11. On the "Shares" tab, shares and users can be created.  By default, you have one share called "Public" and the administrative user called "Admin" by default.

13. On the "Email Alerts" tab, the email server information can be configured.

As you can see, the software interface is clear and concise.  Lots of features are available and seems much easier to configure that my existing NAS device.  Now the device is on my network, I will be investigating more about DroboApps.

Introduction to the Drobo FS

I had a surprise at work today, as a box was left on my desk.  Drobo kindly shipped a Drobo FS to me to test and use.

At e92plus, we have just started distributing the Drobo range of products and like any technical person, the technology interested me, but hands on experience with a product is much more fun!

A number of things drew my attention to the Data Robotics (Drobo) range of drive enclosures, even before we signed them up to distribute their products.  I was aware that different makes and sizes of hard drives could be used within one enclosure.  This goes against the things that I have learnt about RAID technology and have been using for over 17 years, but then again RAID is over 25 years old!!

I was also aware that some of the Drobo range would allow applications (Drobo Apps) to be run on the device, so it could be a web server, FTP server, iTunes server, etc.

There was a boast that it was easy to set up without the complex configuration normally associated with RAID systems.  I think I had a head start as I have worked with RAID for a number of years, as well as already owning a Netgear NAS appliance at home.  I've been looking to replace this with a device that support the storage of an iTunes library, which my current device does not do.

After plenty of research, I came to the conclusion that I need a Drobo FS at home, and all of this was decided before I was even aware of it at work.  It was good to see that something I had researched a while ago was not only good enough for home, but have a number of devices suitable for business uses.

Here's the box that arrived today:

The box contained a number of items:

• Drobo FS Device
• Drobo FS User Guide
• Drobo Resource CD
• Straight Ethernet Cable
• AC Adapter
• Power Cords (UK & European)

The device is very attractive, metal chassis and a plastic front bezel, held on with magnets.  It has a very good blend of aesthetics with a quality/sturdy build quality.  It felt very solid compared to the my existing NAS appliance.

The instructions on the box were very straight forward:

1. Install Drobo Dashboard from the Drobo Resource CD
2. Insert at least two 3.5" SATA hard drives, metal side up (Note: Any data on the drives would be wiped)
3. Connect an Ethernet cable and the AC adapter, then follow the dashboard instructions

I had four 1TB SATA hard drives spare, so this is what I'm using as part of this test.

Software installation to follow in the next post:

Barracuda Backup Service

I briefly mentioned the Barracuda Backup Service after attending the EMEA partner conference, but what if you want to know more.....

Well e92plus are hosting a technical training session on the HMS Belfast in London on Friday 19th March.

More information and registration for this event can be found here: http://www.e92plus.com/training-and-events/training-detail/10-03-19/Barracuda_Backup_Technical_Workshop.aspx

Microsoft Forefront TMG (Threat Management Gateway) - Introduction

Microsoft TMG is the successor to ISA Server 2006, which still has the features from ISA, such as an application layer enterprise class firewall, with proxy, cache and VPN services. So all the good things from ISA 2006 that we know and love are still there.

 

There are many new features within TMG, including:

• Gateway anti-virus scanning, which uses the Microsoft scanning engine
• URL filtering, which can web traffic using Microsoft Reputation Services
• HTTPS inspection, using dynamically, self signed or trusted CA certificates
• Network Inspection System, which is vulnerability based intrusion dection & prevention
• Email Protection, as TMG can be the Exchange Edge Transport for Exchange 2007 SP2 or 2010, as well Forefront protection for Exchange
• Remote Access, using SSTP, Direct Access and NAP integration
• Forefront Protection Manager integration
• SCOM 2007 & 2007 R2 integration
• ISP redundancy for two links
• VoIP (SIP) support
• Enhanced NAT, to allow one-to-one NAT

Thanks to Celestix, and Richard Hicks for providing the above information.

 

At e92plus, we have a webinar to give a more comprehensive introduction to Microsoft TMG and the Celestix MSA appliance range.  Book your place here

e92plus are awarded Microsoft Gold Certified Partner status

More information here: Microsoft Gold Certified Partner status for e92plus


- Posted using BlogPress from my iPhone

Celestix Technical Training - Microsoft UAG & TMG

Celestix will be giving training in Microsoft UAG and TMG (which will replace Microsoft IAG and ISA server) on the 3rd February.

If you are a reseller based in the UK and this is of interest, please register here

Websense V10000 - Web Security Appliance

Most people are aware that Websense are a market leader in the web filtering market, but tradionally has only been a software only option.

The software can either filter via a network sniffer (via a mirror or span port on a switch) or integrated with another solution such as a Cisco firewall or Microsoft ISA server.

The software has some limitations or lacked features that were being demanded from an enterprise perspective. These were addressed with Websense Security Gateway, which gave the following features:

• Web proxy server
• Integrated anti-virus solution
• Real time content classification
• Real time security scanning

This brought other considerations, due to the nature of this software, it would only be supported on a Linux platform. At the time I spoke with a number of customers who were put off by this, as they only had Windows administrators, and did not have the capacity to support a Linux server.

Websense took this onboard, and developed the V10000 appliance, which is a Websense branded appliance, which runs a Linux operating system and runs the Websense Security Gateway software within a virtualised environment. The specification of the hardware, will allow the appliance to run the Email Security and Data Security features in the future as well.

In short, Websense have produced an enterprise class proxy server, with enterprise web security in an appliance form factor.

At e92plus, we are technically proficient with the Websense range, where we not only carry out web demonstrations, deal with presales questions, deliver proof of concept deployments, architect and deploy full solutions, we also deliver both bespoke and certified Websense training.

SecurityPlus - IT Security Newsletter from e92plus

As you may know I work for e92plus, an IT Security Distributor based in the UK.

Richard Hicks of Celestix Networks and a Microsoft MVP wrote an interesting article about re-perimeterisation for our newsletter.

We are very grateful to Richard Hicks and Celestix for their continued support.

The article can be found here: SecurityPlus from e92plus

BETT 2010 - London Olympia 13th to 16th January

BETT is an educational technical show that is based in London.

This year we have two of e92plus' vendors at the show, Xirrus (innovative wireless solution) and NComputing (cost effective desktop virtualisation)

I will post more detailed information about each of these vendors later.

More information about the show is available here: BETT 2010

Barracuda EMEA Partner Conference & Barracuda Backup Service

I returned from Prague inspired with the Barracuda philosophy, as well as getting a better insight into the existing product range, and new products and features.

It was great to meet the senior management team of Barracuda, and meet people so driven and inspired by them.

It was also a good opportunity to meet existing e92plus resellers and our Dutch work colleagues from e92plus NL, as well as meet other resellers from around EMEA. It was good to meet Keith, who recognised me from this blog!

The product the caused the most buzz at the conference was the new Barracuda Backup Service.

Using a Barracuda appliance and software agents, you will be able to back up the servers within your organisation. This will obviously give a great alternative to existing tape back ups, but easy restoration and aaccessibility to your data as the appliance is onsite.

Obviously, you will say, what if something were to happen to the building, datacentre, appliance, etc, well the other component of the service is an offsite back solution. Previously this service was only available in the States, but due to some data laws within Europe, the data should not be store outsite of certain countries or Europe. The new datacentres for this European wide launch of this solution will be based in the UK, with new datacentres opening around Europe as and when.

This will allow data to be backed up onsite and allow quick restoration. In a DR situation, the data can be restore from the datacentres. You are able to select which data is sent offsite, so you are able to stop certain data from leaving your organisation.

More detailed information on the Barracuda website regarding the Barracuda Backup Service

The product is officially being launched on the 14th October at Storage Expo 2009 , and e92plus are holding sales training on 23rd October

How much is the service, well aside from the appliance and subscription cost, the offsite data storage is purchased in 100GB chunks, at only....... €69 per month per 100GB!!!

Work out the cost of your existing tape solution, and the savings will become obvious.

Wanted: ISA & IAG Technical Consultant / Engineer - South East UK

At e92plus, we are looking for a Celestix Engineer, where the focus will be to carry out web demos, presales, architecture, deployment and some support for the Celestix product range.

The range currently includes the Celestix MSA (Microsoft ISA appliance), Celestix WSA (Microsoft IAG SSL-VPN appliance), Celestix Load Balancer (Linux based load balancer) and Celestix HOTPin (Celestix's own two factor authentication solution). As a number of the deployments from e92plus are Websense Web Filter/Web Security integrated with ISA server, there will be a requirements to understand that as well.

Previously this role was covered by me, which was fine when we had a lower volume of calls, but as the Technical Manager, I have a number of other tasks to cover as well. The idea is to remove the day-to-day Celestix requirement from me and have a dedicated engineer. Obviously I'll be there to as a back up and mentor whoever takes on this role.

For those interested, here is the job description

Feel free to contact me on the blog address, if you are interested in this role, or have any questions.