Blog

In today’s IT climate everything can be monitored – do we have to be aware of everything? What really matters is getting relevant data and using this information to your best advantage. Monitoring critical IT devices in your business will give you a lot of valuable data about your network. Filtering and applying this data correctly will save your organization time, money and worry. The value in theses savings can be enormous. Investing early in the right monitoring solutions and filtering will help your organization obtain, and keep, a competitive edge.

The value of monitoring is in the relevant data that can be analyzed and put to a purpose. For modern companies, a smoothly running IT infrastructure is an essential and critical business requirement. Operational problems that are not caught early enough create business emergencies that most businesses can not afford. When the network goes down, email goes down, or perhaps customers can’t purchase products in the web store. Even a web page that takes too much time to load can cost you customers. Without properly working servers and firewalls, security risks are too big and all these problems directly affect your daily work.

Properly monitoring your network infrastructure will enable you to use this data to both prevent business emergencies from happening. Monitoring correctly mitigates the impact of those that cannot be prevented. In this blog we’ll show you how we monitor IT infrastructure to keep the network healthy and up and running.

Features

With current tools we are able to monitor everything in your infrastructure including LANs, WANs, server, websites, applications, and more; we can monitor more than ever before.

Monitoring was first introduced as technology to monitor physical IT devices, to tell you that the device was online. Now, main features include performance monitoring which gives a high-level snapshot of the overall health of each device. Important devices in your network that remain monitored can include firewalls, switches, servers, disk drives and storage units and wireless AP’s.

This information is plotted in easy to read graphs which are used to provide baseline performance and operational trends. This helps to identify and avoid problems, typically low memory, low disk space, bandwidth congestion or excess CPU usage conditions.

The purpose of monitoring all these sensors on different devices is to ensure that the infrastructure has no critical issues, fits the business needs and is suited for the future development of the customer business.

Monitoring Dashboard at Lanworks

Disk space monitoring

For example, when your backup servers are low on disk space you can decide to buy more space in a timely manner and if you know how fast space fills up you can decide how much more space you need.

CPU usage

When one of your older devices keep maxing out CPU load for long periods of time, that is a sign that you should probably investigate perform both software upgrades and hardware upgrades before there are significant failures, leaving you with an unfortunate – and preventable – emergency situation.

Bandwidth monitoring

Bandwidth monitoring will show Internet bandwidth utilized at any given time; what applications are using most of your connection?  Perhaps there happens to be a user who is using up all the bandwidth while downloading videos. Knowing how much bandwidth you use will let you plan for network expansion, at the same time, you might be paying for a lot of bandwidth that you really don’t need. Infrequent traffic spike occurrences remain expected. Generally, it is a good idea to do backups overnight in which case your internet traffic might peak to 90% – but if this is a regular occurrence during business hours this is a predictive indicator that the internet service is undersized for the requirements of your business.

Webserver performance

Websites are getting more and more comprehensive and as a result they are becoming slower. At the same time customers are becoming more and more impatient. Just a one second of delay in loading times leads to lower conversation rates (contacts or purchases), poorer rankings in search engines like Google, and it all leads to lower sales.

Lanworks can monitor the loading time of your website and the time it takes to have a successful login or purchase in the shopping cart. We can use the data to determine if your website is up to today’s standards and also test how your website will react to sudden spikes in traffic.

Flexible Alerting

Monitoring environments remain built such that management continuously receives reports from the IT department which show events and current problems in your operational environment. All these alarms will likely fill up their inbox and soon they won’t pay attention to the alarms anymore.

Lanworks monitoring service can  leveraged to prioritize short-term actions and actual impact to the overall business process if one of the IT services fails. Reducing the information overload being sent to your manager, and it works because not all alarms need instant attention. For example; networks in general operate with a substantial margin of safety. When a load balancer fans out traffic to 5 switches each operating at 60% of its rated capacity, failure of 1 switch would result in each of the remaining switches going to 75% of its rated capacity. In this case of 1 failing switch business processes like emails or online shop orders will still work. And therefore its not always necessary to have alarm messages go directly to the management team.

At Lanworks we take care of all notifications and contact you with solutions when there is an issue that needs your attention. We use our monitoring data to show you why some devices might need immediate attention.

In-depth reporting

Part of our Monitoring Services at Lanworks are the customer-specific monthly reports that we prepare and send to you. After all, its is most important that we address bottlenecks before they cause problems. Our Monitoring Services comes in easy to read graphs in the monthly reports. Our intent to provide a high-level snapshot of the overall health of each device over the monitoring period. These Graphs can be used to provide baseline performance and operational trends – and to proactively identify and avoid problems.

Sample:  Lanworks Monthly Monitoring Report

In conclusion; Lanworks’ Monitoring Solutions under our managed services support program is here for you so you can solely concentrate on your business.

Ransomware – it might arrive as a worm, or a virus. Maybe it got to you through an infected web page, or a specially crafted PDF, photograph, or Word document. In the end, it doesn’t really matter. All of these potential problems mean the same thing – unhappy users, compromised systems, downtime, and business risks. The most prevalent style of ransomware is a category called ‘Crypto Locker’. This malware will encrypt some, most, or all of the data on your system – even including parts of your operating system and generally all of your user files (and it can include USB drives and network-attached drives) and basically holds you to ransome. The people developing the Crypto Locker attack will provide a ransom message on your computer instructing you to pay a fee in order to get your computer decrypted and make your data accessible again. Ransomware is on the rise – there are more ransomware attacks all the time, and it is the single fastest-growing segment of malware.

There are a few really important things to consider about ransomware incidents.

1. You lose access to your data on, and through, that system. (Or systems. We’d like to hope that if we do get infected, only one system is a problem, but in reality, if one system has a problem, its not generally alone). This data is encrypted by the ransomware, so even if you find a way to boot into the system using an OS that isn’t compromised – maybe a USB stick, boot from network, or boot from DVD – the data is still going to be encrypted and unavailable.
2. The odds are against you as far as taking a clean system and decrypting your data. Some of todays encryption algorithms are VERY time consuming to break – that’s kind of the point of encryption – and there’s no guarantee that the encryption on your computer is even using a standard algorithm.
3. It’s entirely likely that your attacked has taken advantage of the flaw in your machine to pilfer your data, so any secret information – credit cards, passwords , trade secrets, customer contacts – should be considered to be ‘stolen’ and available to malicious persons and organizations.
4. If you go through the steps and pay the ransom fee, there is no guarantee that your attacked is *actually* going to decrypt your machine. It’s not like you can complain to the Better Business Bureau and ask for a refund. And even if they DO decrypt it – there are no guarantees about the accuracy or completeness of your remaining data.
5. Basically, if you get a machine that gets bricked by serious ransomware – you might as well treat it as if it’s been destroyed. You *may* be able to reinstall it as a net new, clean machine and repurpose it – but some varieties of malware can prevent this from happening properly as well.

At this point, most of us are reading this list and going ‘This is TERRIBLE!! I NEVER want to have to deal with this – what can I do???’

Like most things in life, there are no absolutes – if you absolutely need zero risk, then you need your system to be offline….. but there ARE things you can do to help minimize the risk, and control the damage. Here are five of the top things you can do to help ensure that Crypto ransomware doesn’t ruin your day.

One:  User Education

This is probably the most important – and most often overlooked – option that any organization can employ to help protect their environment from ransomware. Train Your Users. Educate Your Users. If you’re an IT professional, a lot of what you’re educating them on may seem self-evident to you – I mean, isn’t it obvious to everyone that this UPS package email isnt’ from UPS, and they NEVER send these emails to end users? That’s got to be malware, right?

Well…..

No. No, this isn’t obvious to everyone. Package delivery emails, donate to a flower fund for a funeral, look at this funny picture, please acknowledge this legal document email, please refresh your bank credentials – there are lots of avenues for malware creators to ‘market’ their products to your users. Emails, web pages – targeted attacks using social engineering by ‘knowing’ enough about your users to seem legitimate. Phishing scams looking for information  are very common – and the information retrieved can often be used to crafted very targeted malware messages – and they get better crafted and sneakier all the time.  For someone who’s profession isn’t seeing this stuff all the time, they CAN be fooled.  A user who has never had a problem before, and hasn’t been educated on the issues, is much more likely to open that ‘tracking document’ to see what it is – or to run that ‘New Hilarious Game’ application. Assuming that other people know what the problems are just because you – the IT professional – knows what web pages and emails and jokes and documents are problems .. well.. lets’ just not make those assumptions. That’s safest for everyone. Be sure of your users.

This means that its truly critical for your organization to get training for your users – teach them about phishing, social engineering, malware attachments, phony web pages, and ways to protect themselves – and as a bonus, this protects your entire organization. Train and educate your users. You won’t regret it, and neither will they.

Two: Patch your systems

There’s a pattern to a lot of ransomware we’ve been seeing lately. It’s a pretty simple pattern, too. It goes like this: Major Ransomware and Crypto Locker attacks are exploiting known vulnerabilities that have had patches available for 90 days or more.  WannaCry, as an example, couldn’t hit many organizations because they were already patched.

Now, there are problems with this. ‘My organization runs a ton of custom software and we need to test everything rigorously and can’t patch on a regular basis’. That’s the most common refrain around patching and upgrading.  This is going to sound like a flippant answer, but it isn’t really – the solution is … you need to reprioritize.

It really is a matter of priorities. How much does thoroughly tested software help you if 200 of your 205 workstations are cryptolocked and have effectively been destroyed? Or if both of your email servers are destroyed because you run a custom integration with a calendar application?  If you have real legal and regulatory requirements to complete testing prior to patches, put the effort in to optimize your testing and evaluation processes, and get them done quickly.

Many financial institutions in Canada have historically run years behind on software currency. When the Y2K ‘crisis’ was occurring, there were organizations scrambling to get applications off of OS/2 , because it couldn’t be made Y2K compliant. Today, with end-of-life announcements for Windows 7 and Windows Vista, there are organizations still running Windows XP – with all the security risks that entails.  Organizations in this position are painfully aware of their risk exposures – and the buzzword project running through *all* of the related IT and security groups is ‘Currency’. Maintaining an effective security posture requires a minimum level of software currency – and the churn on this is only going to get faster. Deal with it now, get your desktops patched and current, get your servers patched and current, and get your processes and requirements streamlined with the proper investment to ensure your systems remain intact and available.

Priorities – doing business and operating your systems while NOT being compromised has to be a higher priority than having a long, complicated, unwieldy test cycle. Or perhaps you should rephrase it like this: Having an optimized test cycle that allows to remain current on software and security posture has to be placed in a higher priority.

If this was a true statement for the majority of organizations around the world, we wouldn’t have had a Wannacry problem. It’s currently far from the truth – don’t be the next newspaper story as a victim who could have avoided the problem because your corporate priorities aren’t helping you.

Three – Next Generation Behavior-based Client Anti-Virus Protection

Endpoint security can play a huge role in your environment. Traditionally, this has meant signature based antivirus – but there’s a huge hole in this kind of application. It’s the signature itself.

How long does it take to identify and classify malware, get analysis done on its behavior, develop a ‘file’ signature for what this risk looks like when being transported to your computer, and then push that signature out to however many million machines need it?  It isn’t instantaneous – and while it’s happening, your endpoints are exposed. Clients, servers, doesn’t matter – if ransomware gets activated on the endpoint before your signature-based AV can find it, we are back to the 5 unhappy realities of ransomware – you’ve been compromised and the machine is best considered ‘destroyed’.

Next-Generation clients are available. These clients – similar to advanced Intrusion Detection/Prevention Systems – can do behavior-based analysis to determine when a file on your machine is attempting to be malicious. Pattern-based analysis for access to network drives, or underlying OS mechanisms; attempting to rewrite files in large scale, or to write into the boot sector, or secondary boot files of your OS; network scanning, or attempts to access ‘risky’ identified networks for botnets and command-and control networks; unusual broadcast activity in the local LAN environment – and many more behaviors – these analyses can find ‘risky’ files and applications, AND can send these apps up into a security cloud for analysis. While they are at it, they are an effective protection against ‘zero-day’ attacks – attacks for which no signature exists and where endpoints that only have traditional AV are exposed.

The added benefit? No huge signature database means a smaller memory and performance footprint, and a smaller impact to your user experience, while still providing exceptional levels of protection for your endpoints. Symantec Endpoint Protection v14, Palo Alto TRAPS, Cylance and others, are example clients that help protect your organization right out to the user desktop.

Four – Next Generation Firewalls with Threat Protection

NGFW appliances have some capabilities that traditional firewalls simply didn’t have. Some of them are critical in today’s threat landscape. Much like the Endpoint Next-Gen client, the firewall has new methods to detect malware. File downloads are checked against databases of known files – but can also be checked against a ‘security cloud’.  Files that are unknown can be ‘trickled’ at a slow download rate into the firewall (and end user) while they are uploaded into the security cloud for analysis in a safe ‘sandbox’ environment. Between the NGFW appliance performing inbound malware analysis and cloud ‘sandboxing’ , your Endpoint clients won’t have large amounts of ‘unsafe’ material to investigate, and the combination presents a high level of safety and security for your environment.

WannaCry, as a recent example, was found, detected, and blocked by Juniper, Fortinet, and PaloAlto firewalls as a zero-day attack. No signature required, but the advanced threat and behavioural engines provided by all three firewall vendors kept customers with the NGFW solutions deployed safe.

Be safe – ensure that your organization isn’t relying on port-and/or-signature based firewalls for all of your network perimeter protection. Leverage newer NGFW capabilities and maximize the effectiveness of your security stance.

Five – Next Generation Email Gateways

Just like client Antivirus, and NGFW appliances, email gateways are evolving and growing too. A huge percentage of malware entering a network arrives via email.  Email attachments are often not properly analyzed at the firewall – they may be encrypted, or zipped through multiple layers of compression that can – on occasion – get through your NGFW. Or it may be a file type that has some special requirements – not that the NGFW is ineffective, only that the very determined attacked is, occasionally, going to sneak something through.  In most cases today, that route involves email.

Now, lets imagine that you had purchased an email that stores, uploads/sandboxes/detonates, analyzes, and either quarantines or releases email.

How big is your Internet connection – a 100Mb connection can , in theory, bring 8PB (petabytes) of data into your network in seven days. Lets assume , though, that you only have 10% usage – that’s only 800TB…. so next week – lets assume that 1% of that is malware (this is a conservative estimate for most -organizations).  That’s a staggering amount s 8TB of pure malware. If your firewall stops 99.9% of the malware , that still leaves you with 8GB of malware inbound to your network – and most of it is probably in email. I suppose we could count on our client endpoints to capture that 8GB as it arrives on each desktop and server – as long as every machine is patched and up to date on all its clients, and not one machine has been missed or has another problem.

Or you can have your email gateway upload, sandbox, detonate, and analyze all of your attachments before they go to your various endpoints – and if your email gateway gets 99.9% , your endpoint clients – combined – only have to deal with 8 megs of potential malware.  That’s likely only going to impact one or two machines in your network – and they have NGFW antivirus/anti-malware software to protect them from that last threat.

Defense in depth – layered security. Powerful perimeter defense with a dedicated, purpose built firewall to stop the vast majority of threats; powerful intermediate security at your email server to ensure that your organizational messaging is clean and safe, and distributed endpoint security at your general-purpose endpoints that can help stop remaining threats without negatively impacting your user experience.  And in the rare event where something still gets to the desktop machine, your user is educated enough to know not to open that attachment, and if they do open one by accident, their desktop is already patched and current, and turns out not to be vulnerable to that attack.

These things may not *always* line up this way – no one is going to guarantee 100% detection against every threat, every time, at every level – but look at the numbers, look at the odds, and give your organization the best security posture you can manage – take five steps to secure yourself.