Do you actually care or do you just want a good feeling?

Since I started working in ITSec, there was this thing that was not clear to me but bugged me often. It looked like most companies understood that they were or could be victims of fraud, but their actions to deal with it were going from weird to good.

The other day, while listening to a freakonomics podcast on my way from work to home it hit me. The podcast was about hybrid cars and why one car is very popular and the rest not so popular. The deal was that the "green" popular car was well known because it looks completely different from the other cars so it could be differentiated. So what you are buying is mostly image, or how you feel about what others think of you.

Back to ITSec. I wondered why people are still buying stuff going from cheap to verrrry expensive technology and sometimes it does absolutely nothing. The "yes, lets buy this box/app, and all our problems will be gone" attitude is according to me very similar to the popular hybrid car.

The majority of the organizations buys stuff to have a clean conscience. Let me explain that hypothesis.

The chance of being a victim online for any organization is quite real. Most solutions work partially against old attacks if they are configured correctly. Since organizations constantly change they are usually not configured correctly. In case of an event, the organization can say, well it is not our fault. We had antivirus, next generation firewalls, web application firewalls,  IDS/IPS, ... you recognize this pattern?

The question actually is did you spend all that money on those things to sleep better at night (aka a nice sales girl or smooth talking guy convinced you when presenting that product)?

If you are the man in charge and reading this, I am not telling you not to buy anything just because you want to sleep better at night. Security starts with small things that you can implement without spending huge amounts of money.

An example for the skeptics: Do you thing everybody should be able to access the payroll data and change it or should there be a procedure in place to log who accesses it, when, why, ... . You might think this is a bogus example but recently there have been cases around the world were fake employees where created and money stolen from companies.

Another example if you are still not convinced. We live nowadays in a world where every event leaves a log trace.  Most logs are just kept for compliancy reasons but actually not for mining them to see what value they can give you. If one of your employees is on a abroad mission and there is a login event from one IP and the next login there is a login event from the other side of the globe, and in the time span between the two logins is not possible to be at the other place, you know you have a problem. You see this costs almost nothing, as an employer you know where your employee is and with some GeoIP and timetables you should be able to do the math quite easily.

My advise is to spend your money wisely, it is a scare resource. Look at the easy stuff first, the things you already have so that you have your basics covered instead of having a good feeling because you got things other people want and so they will try to get it from you.

Ow and just one more thing, what works today is not necessarily working tomorrow, bad guys adapt too. Review what you do, its success rate and share the information with your competitors and CSIRTs because they will give you there information so you can use that to build better defenses.

Nitro

It has been more than 2 months at the cert. My first task was making a report about what was by Symantec called the Nitro case.

Usually I will not blog about this but I learned a couple of valuable lessons.

The first thing about this case was that social engineering was used and this is a real life proof that it is used out there. Awareness training is a hard but necessary thing. I admit I have no easy solution but I guess that starting with explaining to people what it is might be a good thing. I listen to the SE podcast and one of the items they had on the show is actually ITsec setting up a fake website and sending out email with a link and see how many people can be tricked. It is something worth considering I think.

The next thing I learned is that the modus operandi was that all data was gathered and staged on internal servers. It made me think of a DBA problem. A lot a the customers were not monitoring their servers and network. When you know your hard disk space changed over a couple of nights from x% to z% when you were expecting y% a series of bells should go off. The same thing on the network, the traffic on systems should be predictable. Although we have this technology it is not easy to implement and it will not stop the attack, you will only discover it.

Finally I think the most important lesson is that it can happen to everyone.

Kids vs Adults 1-0

Since a while now we have these subway access gates. The main idea is that everybody would pay for their ride. Pretty soon you saw people piggy backing with people that did pay.

Not so long ago I saw a couple of 8 year olds outsmart the adults :). Instead of all, one by one, forcing themselves through the little gate only one did it. He went to the exit gate that opens without any verification. The kid let his friends in and off they were to discover the world.

I personally think it is wrong not to pay for public transport but I must say that I liked the fact that adults got outsmarted by 8 year olds.

IPv6 talk at BNC 2011

A couple of weeks ago I was at the Belnet Network Conference 2011 and there were a couple of interesting talks but I want to write in particular about some advise that was given during the talk of Andy Davidson about implementing IPv6.

This was his advise:

1. Buy only IPv6 enabled hardware and software. Since quite a number of people had to do this a kind of template called the Ripe501 template http://www.ripe.net/ripe/docs/ripe-501
came into existence.

I personally think that the remark of paying attention to software too is quite correct. Thinking about hardware is very normal, but one has too take into account you have to manage the hardware.

2. Make sure you have connectivity.
This is pretty obvious, if you want to have a connection to the Internet, you need connectivity.

3. Make sure you train your staff.
It seems normal to the outside world that IT people have knowledge about IT stuff so you have to train them.

4. Do trails
Ok, it seems dumb to put a car on the market before doing crash tests but the same thing applies to you IT infrastructure. If you don't make sure you have done your tests you will regret it.

5. Take it to the users
Once you've done your tests, take it to your users. Some trouble might come up but it should be minimal.

6. Dual stack some of your services.

7. Dual stack all of your services.

Privacy is not an option

Yesterday there was an ISSA-BE event about IT and privacy. Marc Vael gave a very good presentation on what privacy is and what laws do apply.

The first thing to know is that the European directive, 1995/46/EC, is according to Marc one of the better ones on this planet. Each European country made it part of its law but some countries like Germany and Italy are more severe than others. Another interesting fact is that the directive applies to the EEA, the European Economic Area.

I asked Marc the question how to handle these differences as an organization. The best way to handle this is creating a baseline valid for all members of the EEA and make sure that you add the specific requirements for the more severe states.

An interesting fact is that if you for instance visit a website in South-Africa, it is the South-African law that applies to the personal data. The reasoning is that the law applies where the company owning the website is located. This creates very interesting situations, Google is a global company with sites all over the EEA but if you log in over their web servers in the USA, it would be the American law that applies.

One of the nice remarks that the presentor made was that personal information and sensitive data are not the same thing.

Since we were talking about dealing with international privacy we discussed the US safe harbor frameworks.

Mounting XFS

Somebody I know recently had troubles with his NAS and needed to turn in the NAS device but wanted to recover his data. According to the information he was able to gather it was an XFS file system.

He had little to no linux knowledge but to recover he made a Ubuntu machine and asked my help to mount his drive. I didn't have any previous experience with XFS so here is how we did it:

The device showed up in the system as sdb3.

1. sudo mkdir /media/nadisk
2. sudo mount -o inode64 -t xfs /dev/sdb3 /media/nadisk

After this he was able to get his data back and bring his NAS device back to the store :)

Symantec Endpoint Protection 11.0.6 MR2 and the internal database

I had the case where I did an implementation of SEP 11.0.6 MR2 and the internal database grew too big. Thanks to my pervious life as a DBA I was able to interprete the logs and discovered a couple of problems:



1. The cache size for the database was set to 65536K as well for the lower as upper limit.

The cache size for a database varies on the size, but there is no direct parameter where you can influence this.



2. No unique index or primary key for table "a_table_in_the_database" in database "sem5".



3. Performance warning: Database file "...\Program Files\Symantec\Symantec Endpoint Protection Manager\db\sem5.db" consists of 9468 disk fragments.



Just for info, the internal database of Symantec is a Sybase database, so it is very similar to MS SQL 2000.


I openend a case at Symantec Support and after the classic "gather the logs" round we finally concentrated on the database.


Step zero was of course run dbvalidator.cmd ("...\Program Files\Symantec\Symantec Endpoint Protection Manager\Tools") and this showed that the database was still ok to use.


The first step was making a backup with the "Backup and Restore" tool that comes with the installation. The next step was to open "services.msc" and stop the Symantec Endpoint protection Manager services and stop/start the Symantec database service. The database backup was written as a zip file to "...\Program Files\Symantec\Symantec Endpoint Protection Manager\data\backup\"


To shrink the database I needed to execute the following command:

'...\Program Files\Symantec\Symantec Endpoint Protection Manager\ASA\Win32\dbunload -c "uid=dba;pwd=your_install_db_pwd" -ar '. The -c specifies the connection parameters and the -ar means rebuild and replace.


I asked the engineer if the shrink tool is possible to use on the MS SQL database but according to the engineer this was not the case.

The database was back to a normal size and the server disk was happy again.