Introduction to the Drobo Dashboard and Configuration

The hardware was very easy to put together, and the software was just as simple to set up.  There are a lot of screenshots here, but you can see it was pretty much a case of "next, next, next" to get the dashboard installed.  Once installed, you will have the dashboard up and running.

1. Once the Drobo Dashboard software is installed and running, it is looking for Drobo devices.

2. The Drobo device is detected, but at this point my device was still starting up.

3. Clicking on the "Advanced controls" and looking at the "Data" tab, I can see what is in the device and it has correctly identified my four 1TB 3.5" SATA hard drives.

4. The "Tools" tab, offers a number of commands, alert settings, device settings and updates.

5. The dashboard shows how much free space I have and the shares available.

6. Expanding the "How is my storage being used?" shows more drive information.

7. As I selected the option to check for updates, this box somes up.

8. Clicking on the highlighted option to change the Admin password, shown in images 6 & 7 above, brings up the "Admin" under the settings.  There is also an option to enable DroboApps (which I plan to investigate more in the future)

9. By default, the Drobo device will protect your data in the event of one hard drive failing.  There is a option to enable dual disk redundancy, which will protect the data in the event of two drives failing.  It does use more hard disk space, but I guess it depends how important you data is.  As my device will be holding family photos and my MP3s, I will be enabling the dual drive redundancy.

10. On the "Network" tab, the network settings can be configured.  I will be setting this to match my internal network.

11. On the "Shares" tab, shares and users can be created.  By default, you have one share called "Public" and the administrative user called "Admin" by default.

13. On the "Email Alerts" tab, the email server information can be configured.

As you can see, the software interface is clear and concise.  Lots of features are available and seems much easier to configure that my existing NAS device.  Now the device is on my network, I will be investigating more about DroboApps.

Introduction to the Drobo FS

I had a surprise at work today, as a box was left on my desk.  Drobo kindly shipped a Drobo FS to me to test and use.

At e92plus, we have just started distributing the Drobo range of products and like any technical person, the technology interested me, but hands on experience with a product is much more fun!

A number of things drew my attention to the Data Robotics (Drobo) range of drive enclosures, even before we signed them up to distribute their products.  I was aware that different makes and sizes of hard drives could be used within one enclosure.  This goes against the things that I have learnt about RAID technology and have been using for over 17 years, but then again RAID is over 25 years old!!

I was also aware that some of the Drobo range would allow applications (Drobo Apps) to be run on the device, so it could be a web server, FTP server, iTunes server, etc.

There was a boast that it was easy to set up without the complex configuration normally associated with RAID systems.  I think I had a head start as I have worked with RAID for a number of years, as well as already owning a Netgear NAS appliance at home.  I've been looking to replace this with a device that support the storage of an iTunes library, which my current device does not do.

After plenty of research, I came to the conclusion that I need a Drobo FS at home, and all of this was decided before I was even aware of it at work.  It was good to see that something I had researched a while ago was not only good enough for home, but have a number of devices suitable for business uses.

Here's the box that arrived today:

The box contained a number of items:

• Drobo FS Device
• Drobo FS User Guide
• Drobo Resource CD
• Straight Ethernet Cable
• AC Adapter
• Power Cords (UK & European)

The device is very attractive, metal chassis and a plastic front bezel, held on with magnets.  It has a very good blend of aesthetics with a quality/sturdy build quality.  It felt very solid compared to the my existing NAS appliance.

The instructions on the box were very straight forward:

1. Install Drobo Dashboard from the Drobo Resource CD
2. Insert at least two 3.5" SATA hard drives, metal side up (Note: Any data on the drives would be wiped)
3. Connect an Ethernet cable and the AC adapter, then follow the dashboard instructions

I had four 1TB SATA hard drives spare, so this is what I'm using as part of this test.

Software installation to follow in the next post:

UAG Registry Keys

Found this TechNet section when looking for something else and it may be very useful to you.

Here are the registry keys used by UAG:
http://technet.microsoft.com/en-us/library/ee809087.aspx

The one that is the most use, especially carrying out proof of concepts and "real" certificates are not being used:

HKEY_LOCAL_MACHINE\SOFTWARE\WhaleCom\e-Gap\Von\URLFilter\Comm\SSL


By default Forefront UAG validates both the certificate and the revocation list of each SSL backend server during the TLS handshake procedure. In the event where the certificate or the CRL are not valid, backend users are denied access to that given backend server. If a Forefront UAG administrator wishes to disable those validation tests, set the ValidateRwsCert and ValidateRwsCertCRL key values to 0, and then restart the IIS service on the Forefront UAG server.

As UAG checks certificates and CRL, where IAG really didn't this can be new to most people who have experienced IAG.

ActiveSync and email on iPhones (and other ActiveSync devices)

Recently I’ve been asked a lot about ActiveSync for iPhones, but I try to highlight the security implications for this.

I have spoken with a number of people who have ActiveSync running on their Exchange Servers, where they can access the server directly from the internet. I’m not a fan of having servers on the LAN available from the internet, but the pressure to deploy the access this is often overlooked. Especially as the Microsoft IAG and UAG solutions will allow you to reverse proxy the ActiveSync connection, eliminating the need for a direct connection to the Exchange server.

Ensure the handset you have has a level of encryption on it, as the company can be subject to hefty fines from the ICO, if personal data is not encrypted. Apple iPhones have AES 256-bit hardware encryption to protect the data at rest. The Nokia E-series that I have investigate have encryption on both device and storage memory.

Although as this is protecting data at rest, ensure there is at least a password on the device, or there is no point having the encryption. Enforcing password on the device, and comprehensive password policies can be created on from the Exchange server.

 

What is the handset is stolen? There is the ability to remote wipe the mobile device, as well as enforce a wipe if there are too many failed attempts to logon to the device.

 

The only concern is a number of requests for this access on personal iPhones, which is a worry from a data leakage perspective. Although a number of places have said they will ensure password policies and reserve the right to remote wipe the device when it is required, then make their employees agreeing to this. Personally, I am not a fan of this and would rather be working with corporate devices, where as a business you have more “rights” to your hardware.

 

From a technical perspective, you will need to do the following:

• Ensure ActiveSync is configured and running on the Exchange server, with the relevant password, encryption and wipe policies. Assign the access to the users who should be able to access it, taking care to remove access from everyone else (so they are unable to connect up unauthorised or personal mobile devices).
• Configure an ActiveSync portal on IAG, or create a portal for ActiveSync on UAG.
• Ensure all the Exchange server settings are entered correctly.
• Apply a real SSL certificate to the portal, as some mobile devices will not allow you to except a self signed SSL certificate.
• Publish the portal.
• Test the ActiveSync by defining the server name, domain/username and password here: https://testexchangeconnectivity.com/
• Expect it to fail on the OPTIONS section, but everything else should pass.
• Configure your device to point to the newly created portal.
• Allow device to synchronise and enjoy emails on your mobile device!

 

Avira International Partner Summit, Germany - September 2010

I was fortunate enough to be attend the 2nd Avira International Partner Summit, which was held in Germany last week.

There were partners from 35 different countries, so it was great to meet and chat with members of the extended Avira family.

Avira were a great host, not only offering information regarding growth and expansion of the previous year, new developments and structure changes, but also offering a listening ear with the issues and challenges faced by the various distributors and our reseller partners.

There were a number of useful workshops to allow us to voice our challenges in a commercial, marketing and technical environment, but also share ideas and solutions in these areas, and I was amazed at the parity despite the diverse audience.

There are many exciting things that will be announced and released from Avira in due course, and I will keep you up to date when I can!

Two Factor Authentication on GMail

An interesting article about Google protecting Google Apps, which includes GMail, with a one time password sent to your mobile phone:  http://www.scmagazineuk.com/google-adds-two-factor-authentication-to-gmail-via-sms-one-time-passwords/article/179266/

This technology has been available for a while, but this should create greater awareness of two factor authentication, and in turn make more companies realise this is required for their websites, services, applications and SaaS/Cloud offerings.

Vasco can provide two factor authentication to remote access solutions, such as traditional IPSEC VPNs as well as SSL-VPNs.  Vasco can provide two factor authentication to a whole network, using uniquely generated one time passwords to log into Windows instead of traditional passwords.  More importantly Vasco can be used to protect web services and web applications.  The one time passwords can be generated by hardware tokens, software tokens, tokens for mobile and smartphones, and even sent one time passwords via SMS.

Cloud maybe the next big thing as a delivery method, but what will you be using to secure it?

Is your anti-virus software doing it's job?

AV-Comparatives (http://www.av-comparatives.org/) have been reviewing and comparing anti-virus software packages for a number of years. 

The latest reports are available from this section of their site: http://www.av-comparatives.org/comparativesreviews/main-tests

The comparisons between these products are independent and are based on the findings, which are reported.

I know people find it a big upheaval to change your anti-virus provider, especially in larger organisations, but the results offer a very compelling argument to switch to Avira!