security

MFA… set it up now!

July 6, 2021 By Son Huynh

It is a good time to implement Multi-Factor Authentication (MFA), if you have not already done so. Microsoft researchers recently discovered and disrupted a large-scale business email compromise (BEC) infrastructure hosted in multiple web services. The hackers used compromised mailboxes via phishing emails. They added forwarding rules to get access to emails about financial transactions.

Initial access via phishing

The attack starts with a phishing email, sent to the mailboxes, with the typical voice message lure and an HTML attachment.

Figure 1. Sample phishing email used to steal credential to be used for BEC attack

Once the end user opens the attachment, the embedded JavaScript produces an imitation Microsoft Sign-in page.

Figure 3. Forwarding rules created on compromised account.

Microsoft Alerts would have sent you an email warning of the compromised email account. It looks like this.

The user account has been restricted from sending outbound messages. Learn more.

Details:

https://www.microsoft.com/security/blog/2021/06/14/behind-the-scenes-of-business-email-compromise-using-cross-domain-threat-data-to-disrupt-a-large-bec-infrastructure/

Recommendations:

It’s very likely that the user account has been compromised. We recommend that you review the following information and take any actions as necessary. Learn more

– Review mailbox delegates

– Review mail forwarding rules to external domains

– Review global mail forwarding property on mailbox

– Enable mailbox auditing logs

– Review audit log details for the user account

– View/edit mailbox settings

– Ensure protection

To protect accounts from further compromise, we recommend you enable the following features on the account:

– Enforce complex passwords on the account

– Enable multi-factor authentication

When the end user entered their password, they are presented with “File not found”

Figure 2. Phishing page serving a fake error

In the background, the JavaScript transmitted the credentials to the attackers to an external cloud provider.

Email forwarding rules were also created. They look like this.

Keep in mind that multi-factor authentication (MFA) prevents attackers from signing into mailboxes. Attacks like this can be blocked by enabling MFA.

Contact us to get setup!

“De-Mystifying” Solid State Drives-SSD’s Technology

May 29, 2018 By John Campana

Not all SSDs technology is the same. In this review we are highlighting the differences between the different HPE branded SSD drives. HPE uses several different technologies and design requirements so that our server SSDs can meet the reliability and endurance requirements of server storage.

Wear leveling and over-provisioning

HPE SSDs incorporate wear leveling and over-provisioning to meet the endurance requirements for enterprise environments. These technologies increase the lifespan of an SSD drive in an enterprise environment.

Over-provisioning distributes the total number of writes and erases across a larger number of blocks and pages over time. On Enterprise SSDs, the over-provisioning can reach as high as 25 percent above the stated storage capacity.

Wear leveling uses sophisticated algorithms that re-map logical SCSI blocks receiving frequent writes to different physical pages. It evenly distributes erasures and rewrites across the medium to maximize endurance. A pointer array on the SSD controller contains the logical-to-physical map. SSDs can recover or rebuild the map quickly after a power loss.

Power loss protection HPE

ProLiant SSDs have power loss protection. It ensures that if the drive loses power (including hot plug removal), it can be ready in a short time. Power loss protection also ensures that user data in write cache writes to the drive. HPE SSDs can sustain a power loss without requiring the lengthy metadata rebuild process required for SSDs without power-loss protection.

Value, mainstream, and performance SSDs

HPE supports three SSD Enterprise classes (Table Below) to meet the requirements of different application environments: value, mainstream, and performance SSDs. They all deliver I/O performance comparable to Enterprise spinning media drives. SSDs differ from spinning media drives primarily by the read/write workload levels they can support and their expected service life.

Enterprise value SSDs provide relatively large storage capacities at low costs, but they do not have the endurance of the mainstream or performance SSDs.
Creativity mainstream SSDs have smaller capacities but greater endurance than value SSDs.
Enterprise performance SSDs from HPE have similar capacities to mainstream SSDs but have even greater endurance.
SSD performance

SSD performance

All SSDs can operate in environments unsuitable for spinning media drives:

Environments subject to high shock and vibration, up to 1000G
Environments subject to higher operating temperatures, depending on the SSD

Based on published workloads, we expect HPE SSDs to last the typical service life for a new server. The lifespan of NAND memory in SSDs is determined by the number of write/erase cycles it experiences. SSD endurance is different from disk drive endurance. A server SSD reaching the end of its service life is likely to start failing once it exceeds the NAND endurance limit. A SAS disk drive may continue operating for several years beyond its stated service life. An SSD removed from a system without power may not be readable after a short time, but most spinning media drives will retain their data for a decade or more. SSDs are unsuitable for use as archival storage because they do not have great data retention characteristics.

Performance comparison

Second generation HPE SSDs perform significantly better than the first generation from 2008. Table 6 shows that second generation midline SSD performance is comparable to Enterprise SAS drive performance. SSDs excel at random read operations, where performance can be over 100 times better than that of spinning media drives.

Conclusion

Cause of the advancements in storage technology, you now can decide from a broad spectrum of drives, each with unique performance and reliability characteristics. When considering which technology to select for your implementation, you need to contemplate these requirements

Capacity needed
Expected I/O load
Desired lifecycle
Required reliability

HPE has industry-leading drive technologies to handle all of your storage requirements. All of their storage products are rigorously tested and certified for their targeted applications.

By: Vam Gangam – Lanworks Head Office, Mississauga (Toronto), Ontario

Lanworks – Over 30 years of experience in providing Personalized IT for Your Business

HP’s bread and butter is back with massive updates and solid tech for its G10 models. HPE’s ProLiant DL380

March 15, 2018 By John Campana

HP DL380 G10 review

HPE’s ProLiant DL380 has consistently been at the top of the best seller list – and with good reason, as this is its most capable rack server. There’s little it can’t turn its

hand to and we exclusively bring you the first hands-on review of HPE’s new Gen10 flagship.

There’s plenty to get excited about as along with support for Intel’s Xeon Scalable CPU family, the DL380 Gen10 receives a complete refresh in the storage department with a new modular design. HPE’s Smart Array RAID controllers have also been uprated to offer more storage and interface choices.

The server supports 3TB of DDR4 SmartMemory and can handle up to 192GB of HPE’s Persistent Memory NVDIMMs. These target high-demand apps such as analytics or databases and provide 8GB of high-performance DRAM, backed up by 8GB of flash mounted on a standard form factor DIMM module.

And then there’s HPE’s new iLO 5 management controller. It offers a heap of new features as along with improved server monitoring, it has a laser-sharp focus on platform security with silicon fingerprinting, encryption and breach detection technology.

Storage

For our review we selected the Performance model 826556-B21 which sports a pair of 12-core 2.3GHz Intel Xeon Gold 5118 CPUs teamed up with 64GB of DDR4. A quick glance at the front shows HPE has retained the 8+8+8 drive bay configuration layout, allowing up to 24 SFF drives to be presented.

You can fit HPE’s universal media unit in the left bay, which provides dual USB3, a DisplayPort plus optical drive and room for two SFF drives beneath. There’s more going on at the back: three dual SFF hot-swap cages can be added, taking the tally to thirty drives.

The SFF chassis also supports up to 20 NVMe drives. If capacity is a key requirement, it’ll take twelve LFF drives at the front. Three at the back and even four in the middle with HPE’s custom mid-plane kit. All models start with HPE’s embedded Smart Array S100i chip, which supports RAID 0, 1, 5, and 10 for up to 14 SATA drives.

Management and security

The iLO 5 uses a new ASIC and its Secure Start swings into action when the server is powered on. It validates its firmware using HPE’s Silicon Root of Trust fingerprinting and if it fails this, it’ll stop the server booting. Next up is Secure Recovery which validates the iLO fir

mware and if the test fails, automatically flashes it with the resident recovery image.

Included in the iLO 5 Standard license is active sy

stem ROM validation and if this fails, it’ll activate the redundant system ROM. Should both ROMs fail validation? The Advanced Premium Security Edition license can run a firmware scan and a repair process will also run daily system firmware validations.

The iLO 5 is twice as fast as iLO 4 with double the memory. We found its Intelligent Provisioning OS deployment tools and virtual media services much quicker and more responsive. The iLO 5 web interface gets a major revamp making it even more informative and HPE has switched entirely to its agentless management service (AMS), negating the need to load any OS agents.

Existing users of HPE’s OneView must upgrade to v3.1 to support Gen10 hardware. Which requires patience as we found this takes around two hours. With this applied, we added the server’s iLO 5 credentials to the lab’s OneView Hyper-V VM and kept an eye on CPU and power usage plus temperatures. We ran remote control sessions and powered the server up and down.

Power and networking

There’s growing room, our model includes 3-slot PCI-Express riser cards with space for 2-slot tertiary riser over the PSU bay. The HPE’s tool free design has two main risers are easily removed with just a flick of the wrist.

All models come with quad embedded Gigabit ports and you can upgrade with a choice selection of FlexibleLOM mezzanine cards. The server supports one card which fits in a dedicated slot at the rear of the motherboard. HPE offers dual and quad-port fibre or copper 10GbE plus a dual-port 10/25/40GbE card.

Some of the rules regarding memory population have changed and we experienced it first hand.

DIMMs is Installed only if the agreeing processor is installed.
If only one processor is installed in a two-processor system, only half of the DIMM slots are available.
To maximize performance, it is recommended to balance the total memory capacity between all installed processors.
When two processors are installed, balance the DIMMs across the two processors.
White DIMM slots denote the first slot to be populated in a channel.
Mixing of DIMM types (UDIMM, RDIMM, and LRDIMM) is not supported.
The maximum memory speed is a function of the memory type, memory configuration, and processor model.
The maximum memory capacity is a function of the number of DIMM slots on the platform, the largest DIMM capacity qualified on the platform, the number and model of installed processors qualified on the platform.

Conclusion

HPE’s DL380 just keeps getting better with every generation and the latest Gen10 delivers new and welcome features in abundance. This highly expandable 2U rack server offers a wealth of storage choices. The new iLO 5 controller provides top-notch remote management and platform security.

Enterprises and SMBs looking for a powerful and secure 2U rack server that can grow with them. They will find the ProLiant DL380 Gen10 an ideal partner.

Click on ANYTHING without risk of breach…

February 26, 2016 By Ali Syed

Click on ANYTHING without risk of breach

This is the message from Bromium, a company approaching endpoint security from a very different angle, using virtualization and hardware technologies included in Intel and AMD processors.

Bromium Advanced Endpoint Security is deployed, managed and orchestrated by the Bromium Endpoint Controller, a scalable management system built on standard enterprise infrastructure components that is engineered to reliably manage hundreds of thousands of enterprise endpoints Windows and Mac. It includes tools to Protect, Monitor, Analyze and Manage the entire enterprise.

Bromium Endpoint Protection is built on the Bromium Microvisor, a Xen-based, security-focused hypervisor designed to automatically isolate each vulnerable user task, such as visiting a website, reading an email, opening a document, or accessing a USB drive. Today’s enterprises are supporting a number of legacy applications which in turn may be dependent on legacy browsers, java or active X components. Also, do not forget the “road warriors”, living on public networks outside of the prying eyes of internal security team. In these scenarios there is very little that can be done on the technology side and a lot of focus is being put on user training, however, the attackers are getting more innovative in targeting their audience leaving the user exposed. Being infected in the office is one thing, being infected on the road presents a very different scenario, just imagine going into a meeting with a new client, turning on your laptop and finding out that your system has been hijacked or will not even start, not the best first impression.

How is Bromium addressing this? Endpoint Protection uses endpoint CPU micro-virtualization, a light-weight micro-VM that cannot modify Windows or gain access to high-value files, data, networks or sites, or access any OS services, to hardware-isolate each untrusted website, document or executable to defeat attacks from the Web, email, social media and USB. Endpoints are protected even on untrusted networks, and automatically self-remediate when attacked. When an endpoint is attacked, malware may execute in the context of a micro-VM, but no content of value is available to be stolen, and the attacker cannot pivot onto the enterprise network to further the attack and as the website, document or executable is closed the micro-VM is discarded and so is the malware.

This isolation enables Bromium to protect endpoints that have not been patched, or those that are tied to legacy third-party plugins and applications. The architecture automatically defeats and automatically discards malware, and eliminates costly remediation—keeping users productive.

As attacks are being executed, the monitor alerts the Bromium Endpoint Controller that an attack is in progress and provides detailed real-time forensic data that allows the attack to be visualized in increasing detail using Bromium Threat Analysis. Since all forensics data is stored on the local client the solution does not require a centralized server for storing the endpoint monitoring data. Bromium presents the entire application flow, providing a complete view of the attack tying together thousands of low-level monitoring events.

Bromium turns the security problem on its head: It eliminates the need to detect malware, because it protects the system by design. Users can safely click on anything— and even when they make a mistake the system will defend itself. The enterprise can stop mandating new controls on the endpoint that hamper users, and rely on hardware that it has already purchased and deployed.

Bromium does not replace your existing Anti-virus, Anti-malware, Intrusion Detection or Patching solutions, it is there to compliment and enhance the overall user protection against all external threats. It also gives the administrators confidence and time in that latest signatures, patches and vulnerability fixes can be deployed in a more controlled manner, rather than ‘now’.

This personal overview of Bromium was written by Lanworks Senior Solutions Architect, Arthur Zylka

How Juniper’s Space Security Director Accelerated A Complex Firewall Deployment

December 4, 2015 By John Campana

With the rise of the always on, at home workforce, companies actually have multiple locations that are geographically dispersed. And this shift of the traditional ‘head office’ model is just a sneak peak of the future of business.

Fast Company reported survey results from business leaders at a Global Leadership Summit in London – “34% of company leaders will have more than half of their company’s full-time workforce working remotely.” And according to a 2015 survey from Global Work Place Analytics, 80% to 90% of the workforce would like to telework at least part time with two to three days a week being the ideal balance of concentrative work (at home) and collaborative work (at the office).

As companies continue to grow and add remote office locations, IT teams once again are challenged with getting employees connected, all while keeping data safe. All of these locations need to have the devices securely connected to your network and protected from outside threats, so a firewall in each location is a must. But how does an IT team manage the set-up and monitoring of each individual firewall?

Your IT Staff Can’t Be Everywhere At Once

This explosion of remote sites means that organizations are going to have a lot of security hardware spread out across a country, or even globally. Every time a new location is added, not only does the equipment need to be physically delivered and connected, but it then needs to be configured to work on your network. And the truth is, most employees at these locations are not going to have the expertise to do this for you.

The challenge for IT departments – it’s not going to be possible to have your IT staff economically travel to every location to set up a firewall.

Here’s an example…

One of our larger enterprise customers needed to bring an additional 70 new remote locations online within the space of a month. There was no way their networking team could travel across the country and complete the project on time. Although engaging outside contractors to help would be one way to solve this pain point with locations across Canada, which would have been an expensive option. Instead, we proposed that they use a Juniper’s Security Director to automate and “template” the deployment.

Juniper Space Security Director – Scalable and Responsive Security Management

Juniper’s Space Security Director uses an intuitive web-based interface to centrally manage and enforce security policies across your network. With Security Director you can:

Scale your policies across multiple SRX Firewalls
Centrally control and manage VPN, IPS, application security and security intelligence
Enforce application usage policies through included AppFW management
Leverage existing VPN profiles to create site-to-site IPsec tunnels with a few clicks

For our customer, Space Security Director was the idea tool to help them achieve their goal of deploying and configuring the SRX Firewalls at their new branch locations in under a month. Not only does Security Director automate the deployment but it also offers operational simplicity by providing configuration management and policy pushes to the entire firewall fleet.

Our Partnership Resulted in a Successful Project

Lanworks worked with the customer to help them evaluate Space Security Director, and after our sales team had demonstrated to them that Juniper’s offering was the answer to their problem we continued to partner with them to ensure the project was a success.

Our Network Engineers helped design and architect Security Director for the customer, with the goal of allowing their own staff to be able run the project with minimal assistance resulting in lower service costs to them.

The SRX Firewalls needed were pre-provisioned at their head office, sent to the remote locations across Canada and quickly configured without needing any intervention by any of the branch location’s employees thanks to Space Security Director. By partnering with us and Juniper, our customer completed what seemed an unsurmountable task on time and under budget.

No matter where you are in any of your security projects, Lanworks is here to help. Connect with one of our sales associates today to begin your partnership with Lanworks.

The Business of Security: True Zero Day Threat Protection

November 12, 2015 By John Campana

Cyber security has never been a hotter topic. The palpable panic experienced by many an IT Manager in the aftermath of the Ashely Madison hack drove the frenzy around security. In our latest whitepaper, 5 Must Watch Technologies and How to Win With them, we took a look at how businesses can protect themselves from Zero Day Threats.

Our research found that 15 million new malware samples (a rate of 160,000 new samples daily) were generated in 2014 (Panda Security). Additionally, Palo Alto Networks is finding 30,000 new pieces of Zero Day malware on a daily basis, up 50% from last year. Yikes!

What is a Zero Day Attack?

Before we delve into how to prevent a Zero Day attack, let’s take a moment to define the attack. The Zero Day is a period of vulnerability when a hole exists in the network’s security, unknown to the vendor, until after it’s exploited by hackers. Depending on the size & type of your business, a hacker could have spent days or months attempting to find that vulnerability in the network. Once they do, your network is poised for an attack, and your customers’ sensitive information is in the hands of the highest bidder.

What follows is a mad rush by the security vendor to patch the area and stop the mass information bleed. Sometimes there just isn’t enough time…

3 Steps to Prevent a Zero Day Attack

Taking a preventive approach when it comes to Zero Day Threat protection doesn’t have to be a long and arduous process. Here are the 3 steps you can take to prevent a Zero Day attack in your network’s security.

Think like a hacker
Never make the assumption that your network is safe, just because you recently updated the security. Just like a hacker persistently probes the network to discover a vulnerability, you need to do the same. The only way to prevent an attack is to know about it in the first place.
Pick the right security vendor
You’re only going to be as good as the security vendor you choose. Not all vendors offer the same Zero Day Threat protection capabilities, so make sure you do a good deal of research before picking a vendor.
Attend our webinar
Our webinar “The Business of Security: True Zero Day Threat Protection” aims to educate IT Directors and Managers on today’s threat landscape, preventive vs. detection strategies, and Palo Alto Network’s WildFire firewall technology. Register for the webinar here.

To learn more about Lanworks & the services we offer, check out our Network Solutions for more information.

MFA… set it up now!