Wireless solutions and summer holidays

As we all look forward to our summer holidays, I look back and think I was fortunate to be a Technical Director in an organisation where we could bring on a variety of wireless solutions, as well as complementary solutions.  When looking at solutions, it’s easy to become vendor centric, and not find a way to talk about or link a variety of vendors to provide a comprehensive solution.

Wireless Access

There are many solutions out there that can provide a number of unique features, whether it’s directional antennas, blanket coverage, security, cloud controllers, controller-less or controller based wireless solutions.  I will tar them all with the same brush and suggest that although you need to pick the right one for the environment, they are only offering a connectivity method for wireless devices to connect to a network or the internet. 

Network Access Control (NAC) and Security

NACs have made a comeback as more and more people realise that the wireless network needs to be secured in some fashion.  They offer the ability to identify users, devices, connectivity methods, as well as time to create a comprehensive policy to control. There are other security solutions that are focus on just wireless, where NACs are typically available for wired, wireless and VPNs.

Guest Management and Social Media

People will say they want to “monetise” their wireless network.  Of course there is a cost associated with running a public wireless network, but you can’t always capitalise on it.  Most people will use 3G/4G networks, or worse case turn to your competitor offering complimentary access.  More important is how to manage these users when they access your network.  By management, I don’t mean just a user repository, but also the ability to integrate payment engines, ticketing systems, tracking and how long they can access the network for.

There are many articles highlighting how many hundreds of advertising dollars have to be spent before achieving a like on Facebook, a follow on Twitter, etc.  The issue historically is how you can leverage this from your known customer base.  If your wireless access solution includes or there is an application that can integrate social media to it, then you can leverage your existing customer base to grow your social media one.

Enjoy your holiday!

I liken the Wireless Access to people outside bars, trying to entice you in with free drinks.  The NAC and Security systems, are the bouncers, while the Guest Management and Social Media, is the receptionist taking your entry fee and asking you to join the mailing list.

Next time you’re on holiday trying to find wireless access, I hope you remember this analogy and smile! :)

The Myths and Reality of the "Cloud"

As an Information Security Professional, I am often asked by people “What is the Cloud?”  My answer depending on the audience is that it’s a marketing term to cloud (please excuse the pun) the technology that is used, where your data or application is held on someone else’s computer.

The term cloud was popularised in general culture, thanks to Apple and their iCloud to allow your Apple devices to be backed up into an offsite location.  Terms such as cloud computing have been used by Google, Microsoft and Salesforce, who give application access without having to connect to servers within your organisation.  We hear of terms such as Cloud Backup, where your data much like the Apple iCloud principle, is held in an offsite location.

As I say, I believe Cloud is an all-encompassing marketing term, rather than the saviour to all our IT woes.  In the not too distant past, there were terms like, Software as a Service (SaaS), Infrastructure as a Service (IaaS) and Platform as a Service (PaaS), which described the solution being provided.

With the popularity of the term Cloud, a number of solution providers have jumped onto the bandwagon, leveraging the good work and good name form the likes of Apple, Google and Microsoft, and using it for their own gain.  Let me explain…

Cloud technology should deliver the following:

Uptime

Delivered via multiple servers and multiple datacentres, with the various failovers in place.

Security

Meeting a number of compliancy regulations, delivered through processes, procedures, physical security, virtual security, encryption, firewalls, etc.

Environmental

Reducing the environmental impact of their datacentres, utilising renewable energy sources, or local environment resources, such as geothermal cooling in Iceland.

Reduce Costs/Change Payment Models

Delivering true lower TCO or real ROI, as well moving from a CAPEX payment model to an OPEX payment model helping company cash flow.

“A La Carte” Approach

It should not be an “all or nothing” approach to moving services to the Cloud.  With any technology that breaks from the norm (and Cloud technology is that to most people), there have to be easy transitional steps, moving only the solutions that make sense.

This is the reality for a number of the larger brands or organisations with integrity and the mission to deliver a quality solution.  The issue will come when less reputable or companies with less integrity want to join the Cloud bandwagon, and the above points are compromised or neglected.

I have heard of Cloud organisations running applications on single servers, in a single datacentre.  I use the term datacentre loosely, as under-stair cupboard may be a better description.  Data security is often compromised, as it’s seen as a cost with no visible or immediate benefit.  Some providers insist the movement for all applications and infrastructure, whether it’s appropriate or not.  There are many providers who struggle with incremental billing, insisting that one, two or even three years are paid upfront prior to implementation.

There have also been examples of service providers going out of business where the Cloud technology was shut down or even held to ransom.  With the importance of the application and more so your data, what contingencies would you have in place if this were to happen.

There are some real benefits to moving to the Cloud, if done appropriately and with due diligence.  Just be aware there are some less than reputable organisations selling Cloud solutions, being delivered by “smoke and mirrors” rather good infrastructure, good processes and procedures, good security and a company is good financial standing.

Don’t be afraid to ask questions and if it doesn't feel right, don’t use them, your organisation depends on it!

NHS database delayed

After my previous blog post, I have seen an increase in awareness and concerns around the NHS database rollout.

Yesterday, it was announced that the rollout has been delayed for six months, as the public were not appropriately made aware of what would be happening to their data.

BBC News: http://www.bbc.co.uk/news/health-26239532

As a side note, as I was passing my Doctor's surgery, I picked up an opt out form:

As you can see the data being moved from the GP surgery to the database is you NHS Number, Data of Birth, Post Code and Gender, along with your medical records.  The data being used or sold will be age bands, area and gender, along with your medical records.

I have concerns around how the data will be transferred to the main NHS database, as well as the data itself.  I appreciate that they will then modify the data before selling it, but I would then have concerns around how this data is stored, who will have access to it and what safeguards are in place to protect the original data, rather than the anonymised data.  There is then the ethical questions around selling patient data to third parties.

It sounds extreme, but if a third party had access to your medical records and your postcode, it would take much to correlate this with information in the public domain to get your in address and/or telephone number.  If you had a serious medical condition, would you want to be bombarded by calls and letters selling care homes or even funeral services!

I wait to see what happens in the next six months around this, but suspect I will still opt-out!

Data Privacy...

The Data Protection Act is there safeguard our personal information when being held by organisations.  That in itself we hope would be good enough, but if it isn't it is policed by the Information Commissioner's Office (ICO) who are an independent authority.

The ICO have the ability to issue fines up to £500,000 where there are serious breaches to the Data Protection Act and Privacy and Electronic Communications Regulations.  There have been some notable cases in the news, including:

• NHS Surrey, who lost sensitive information belonging to 3000 patients, which was left on a computer that was auctioned.  The fine, £200,000 (Source: BBC News)

• Sony, whose Playstation database was hacked. The fine, £250,000 (Source: BBC News)

• Brighton  and Sussex university Hospitals NHS Trust, who have hard drives stolen containing personal data, including medical records, National Insurance numbers, and staff home addresses.  The fine, £325,000 (Source: BBC News)

• North East Lincolnshire Council, who lost sensitive information of hundreds of children on an unencrypted memory stick. The fine, £80,000 (Source: ICO)

• Ministry of Justice, who emailed the details of prisoners at HMP Cardiff to three of the inmates families. The fine, £140,000 (Source: ICO)

As you can see, these data breaches whether intentional or not, happen a lot.  It would want you to ensure the organisations who have your data have the necessary safeguards, but it's all to apparent that these are not in place, whether they are encryption solutions, firewalls, strong passwords, two factor authentication, data leakage prevention solutions, website firewalls, staff training, etc.

With all this in mind, did you know that the NHS have the right to share your personal information unless you opt-out of the scheme.  I for one will be opt-ing out as soon as possible.

More information here:
http://www.nhs.uk/NHSEngland/thenhs/records/healthrecords/Documents/NHS_Door_drop_26-11-13.pdf
http://www.bbc.co.uk/news/health-25919399

It's been a while... [CISSP]

It's been a while since I've blogged, and for that I'm sorry.  The other thing I haven't done in a while is take an exam, so what better way to get my blog kick started again, but talk about the exam I've recently taken!

I've been working at e92plus for a while and have meant to take my CISSP (Certified Information Systems Security Professional) exam, but was put off by my peers with the old adage that "it's a mile wide and an inch deep" or putting other things first, like my family.

I did mean to take the exam this summer, but other commitments meant I rescheduled it to the end of this year.  September this year was my 7 year anniversary at work, so I decided to go for it, rather than reschedule it to next year.

I did my research and I bought a few books.  I had the following books:

• The Official (ISC)2 Guide to the CISSP CBK (3rd Edition)
• All in One CISSP Exam Guide by Shon Harris (6th Edition)
• CISSP Study Guide by Eric Conrad, Seth Misenar & Joshua Feldman (2nd Edition)
• CISSP 11th Hour Study Guide by Eric Conrad
• Exam Cram CISSP Practice Questions by Michael Gregg (3rd Edition)

Before I tell you how I found these books, I have to give some of my background. I've worked in IT for 19 years, starting from a more generalist IT support role, to a more focused security role.  I have been an MCP since 1998, as well as hold an MCSE for NT4 and Windows 2003.  I have had roles where I was part of the DR/BCP planning team as well.  I carry out presales consultancy, installations, some support and training in a number of solutions, but seem to focus on two factor authentication and SSL-VPNs.

With that in mind, I'll let you know what I think of the books!

The Official (ISC)2 Guide was a little dry for me, but was starting at too basic a level for me.  I would expect my less experienced engineers to be able to read and understand the topic from this book, but it's a thick book!

The Shon Harris book is recommended by a lot of people, but I found the book too chatty for me.  I wanted my facts and less fluff.

The Eric Conrad books helped me pass my exam!  It was written at the right level for me, and there was a lot less "chat" with these books.  The study guide is around 500 pages, but the 11th Hour book which I read on the train into London is less than 200 pages summarising what I consider the essentials.

The Exam Cram was good for the software to let me test my knowledge after reading the Conrad book.

My experiences may not work for you, but I was using the books above, the supporting Conrad website for podcasts and tests, as well as the TechTarget website.

There is no score, but I was thankful I passed the exam today!

I have been unsociable (more so than normal) for the last month or so, and my Freeview (PVR) box is overfilling with programmes I haven't watched.  My children will see me again, just in time for Christmas!

So Merry Christmas to you all and if you decide to do you CISSP, let me know how you get on.

Creating a SSTP split tunnel in UAG

I like to provide remote access by publishing applications on UAG, but there are times when a full VPN tunnel gets around a number of issues, but may reduce your security posture.  I don't like to make changes to the security unless they are respected or being used by responsible people.  For most people using the SSTP VPN tunnel feature in UAG would be adequate, but there are times when a user needs a split tunnel.

I was told that SSTP in UAG did not support split tunnels, but there seems to be a workaround with this blog post: http://blogs.technet.com/b/fsl/archive/2011/01/26/uag-sstp-split-tunnel.aspx

In trying this myself, I did the following:

I went to the following location: C:\Program Files\Microsoft Forefront UAG\Endpoint Components\3.1.0 (The location of your files may be different depending to what service pack level you are at with UAG). 

Copy the 'sstp.pbk' file to the desktop, and rename the original file in the original location (I chose 'sstp.pbk_old').  Go back to the desktop and double click on the 'sstp.pbk' file you just copied.

You will be presented with the following box, where you need to select 'Properties':

Highlight 'Internet Protocol Version 4 (TCP/IPv4)', and then click on the 'Properties' button:

From this screen, you will need to selected the 'Advanced' button:

From this box, uncheck the 'Use default gateway on remote network' option, and close all the boxes.

Take the modified 'sstp.pbk' file and copy it back to the original location.

To prove the difference it makes, I took a 'route print' using the original 'sstp.pbk' file, and a 'route print' of the modified 'sstp.pbk' file.

I haven't tested this in anger, but looks like it will solve the issue we currently encountering.

UAG ActiveX issues on IE10

I saw something today that I had not encountered before.  I had a user connecting to my UAG setup, but it seemed like the UAG client would install when running as administrator, but would not run.

After running a remote session, I spotted that there was an extra icon that I had not seen before on the IE10 address bar:

 

It turns out this is an ActiveX filter built into Internet Explorer.  Although with it running, the UAG components can not execute, meaning only web applications will run.

This feature can be disable by going to the cog icon, clicking on "Safety" and then unchecking "ActiveX Filtering"