Archive for the ‘Misc’ Category

Splunk-ing

Friday, August 15th, 2008


No I am not talking about visiting caves.  Splunking is the process of using a product called Splunk.  It’s a security search engine that allows you to view log information from various sources such as firewalls, servers, and other network devices and report on them.  Think of it as as Google for IT stuff.  Beyond the functionality, which is excellent, the really nice thing about this product is that it’s open source meaning it’s essentially free to use, if you don’t want any professional advice or support and you are not pumping tons of data into it.

This 2 minute video give you all the information you need to get started.

 

How does it work?

Splunk like Google needs data to work.  Google’s strength is that it can not only search through tons of data but it can correlate it, making some assumptions in terms of what should be displayed and in what order.  Splunk works much the same way.  It uses data generated from virtually any networked computer device and then allows you to search for things that are important, such as signs of potential or known problems.  By default it can gather information from Event Logs automatically, syslogs, file shares and with a growing list of plug-in’s can read data from other sources.

So how does it benefit the average company?

Splunk is a framework that can make sense of data.  In it’s simplest form, it can show you on one page the condition of a system, security information, change controls, web page stats, etc. 

If you’re looking for a way to easily report on the IT log data you already have you should look at Splunk.

My Favorite Error Message

Tuesday, August 12th, 2008


I’ve seen some interesting software error messages, some with bad English, some incorrect translations and ones that make absolutely no sense. 

Have you ever sent an error report to Microsoft from IE?  Most of the time I don’t because they tend to blame everyone but themselves for the problem.

I was tempted today because my IE has been crashing all day.  To my surprise I saw the following….

This problem was caused by Windows, which was created by Microsoft Corporation. Currently, there is no solution for the problem that you reported.

Wow.  An admission of guilt. 

:-)

GNSC to be quoted in Popular Mechanics Magazine

Monday, July 28th, 2008


Art Costigan, Information Security Analyst at GNSC will be featured in an article on hard disk security in the October edition of Popular Mechanics Magazine.  It will be on news stands in mid September.

Children’s Online Protection Act

Sunday, July 27th, 2008


 

The Third Circuit Court of Appeals ruled that the Child Online Protection Act, or COPA, is unconstitutional. The Act violates the First Amendment and is too broad, the court said. Free speech groups that worked to fight COPA, including the ACLU and EPIC, applauded the decision.

“For years, the government has been trying to thwart freedom of speech on the Internet, and for years the courts have been finding the attempts unconstitutional,” said Chris Hansen, senior staff attorney with the ACLU First Amendment Working Group. “The government has no more right to censor the Internet than it does books and magazines.”

This law is the one that required all schools to provide safeguards to prevent pornographic and other adult material from being viewed by minors.  While this decision may have some impact on libraries, it probably won’t have much impact on school districts who have for years installed filters on their computers.  I think the thing to remember here is that as parents and concerned citizens, you should ask your school district or library what their position is on this an take the appropriate action you see fit.

Some Friday Humor and Wisdom

Friday, July 25th, 2008


 

In the last couple of years, I’ve seen my share of crazy things happen.  Anyone who has spent as many years in IT as I have will have accumulated a load of “stories” that become part of your base of knowledge, and eventually be transformed into IT security wisdom.  Here are a few of my more recent ones. 

The “Know it All Director.”  Nothing is more frustrating than meeting an IT Director who thinks he knows everything.  The danger here is that if they are in Stage 1 of the “4 phases of learning”, that company is in big trouble.  Solution:  Suck it up.  Admit you don’t know everything and get some help.  You can still take all the credit.

The “Office Power User” This is the guy who helps everyone and always brings in his special “Windows 98 utilities” from home.  Solution:  Don’t plug anything into your computer at work.  No USB drives, no iPods, no Cameras, NOTHING.  99% of problems start by cross contaminating PC’s

The “Download King” This is the guy who is the local challenger to Shareware.com.  He’s got just about everything in the world on his PC and knows how to use it.  However he never get’s his work done.  Solution:  If it’s free software, you probably shouldn’t download it.  Free works great for social engineering.  If there is a security breach, always start at this guy’s computer first.

The “I Need a Patch Guy”.  This is the IT administrator who when the network cord is too short, plugs the Windows server directly into the WAN firewall jack, “just for a minute”.  The result is a compromised Windows server and an infected network.  Solution: Don’t ever plug a patched or unpatched server into a WAN interface.  The average time to infect an unpatched Microsoft computer is 4 minutes.  With a simple firewall it’s 16 hours. 

The “I Have a Firewall Guy”.  This is the manager who runs his business operation with a Net Gear or Linksys firewall and complains to his ISP about performance.  Solution:  Don’t use a $50 firewall, not even at home.  Get something good and pay someone to set it up. 

The “Spam King or Queen.”  This is the man or woman who gets 25 times more spam than any one else and is always complaining.  A simple look at their internet activity will show they spend more time surfing than working.  Solution:  Never give out your email to anyone you don’t know.  Treat it like your SSN.  Assume the other person you are giving it to will lose it or abuse it.  One time I even told a customer the best thing to do is give them a new email address and charge them for new business cards.

The “I Have the Best IT Guy in the World, Guy.”  This is the manager who hires his cousin or nephew because he “builds computers” at home.  Question:  Would you hire a CEO just because he knows the difference between a Quarter and a Dollar Bill?  Solution:  Vet your network staff.  You’re handing them the keys to the kingdom.

Beginnger’s Blogging Slides

Friday, July 18th, 2008


If you weren’t at the Business @ Breakfast meeting in Bedford on July 17th, here is a copy of my presentation on Blogging.

MailMarshal and Blackberry

Tuesday, July 8th, 2008


The Blackberry Enterprise Server connects your internal email server with your Blackberry users.  However for companies who have hosted mail environments, who cannot afford a BES server, or have users on the Blackberry webclient, there is no central function to control their blackberry population.  There is a solution.  4 years ago, GNSC began using MailMarshal SMTP as a way of managing their internal Blackberries.  With MailMarshal SMTP you can create dynamic policies that allow Blackberry users to receive, send and manage emails on a non-BES platform. 

MailMarshal SMTP can do much more than just stop spam, it can email-enable applications, act as a systems monitor, control key functions in other systems and help assess the “temperature” of your employees attitudes during times of stress.  Contact me today if you would like to run you ideas past us.  We are the MailMarshal SMTP experts.