IT security 'Best Practise' in Australia, or better titled "Security through Avoidance"

Reading this article (http://www.theregister.co.uk/2014/05/15/aisa_finding_infosec_bores_board_execs/)  today was a reminder to me of the customers I talk to on a daily basis. Having worked in many countries previous to coming to Australia, it was very apparent that security was very topical for Northern Hemisphere companies, with standards such as HiPAA, SOX, J SOX, Basel II, PCI.

Not to mention best practise IT through ISO and ITIL where automation and processes are critical.

Northern companies understood that improvements to security were critical to protecting sensitive customer data and therefore the organisations own Intellectual Property and value. It didn't hurt that governments required companies to comply with the aforementioned standards.

Admittedly, it is still an evolving practise but companies knew they needed to do something to protect their value.

Working with customers in Australia though has really brought home the old adage 'She'll be right', thankfully this is slowly starting to change but its taking significant time. Geography is not a protection from hackers and fraud, and even though IT in Australia moves more slowly than its equivalent in the north, the potential for significant cost and pain to companies here is exactly the same as anywhere else in the world. The Internet and frequent vulnerabilities in software has enabled an attack to occur anywhere without care over the location. Australian businesses have been very lucky upto now to not have suffered attacks like Target (USA), eBay, Sony etc.

I can only surmise that:

• Companies are too small to warrant hacking in Australia
• Companies have been hacked but kept it quiet
• Companies are not online sufficiently to be able to be attacked yet

Its probably a combination of all three.

Office 365 to take over the world? or at least business....

Interesting commentary on Office 365, I can see both sides of the debate and I believe everyone is somewhat correct in their assertions, many customers will migrate to Office 365, some will remain on the platform they have until support ends due to cost of migrating to a new platform when it doesn't offer anything above what they are using today.

Anyway it started here with Scott Cameron (Microsoft) who unfortunately made some incorrect assertions in his factoids:
http://blog.quitecloudy.com/2014/05/office-365-end-of-exchange.html

The response from Tony Redmond:
http://thoughtsofanidlemind.com/2014/05/05/not-the-end-of-exchange/

And it ended here with JRosen (Microsoft)
http://blogs.technet.com/b/jrosen/archive/2014/05/11/the-end-of-exchange-probably.aspx

I work for a Software vendor who provides migration software and this is what my customers are thinking, for a new business why wouldn't they choose a platform with no capital outlay and almost no cost of support, but, if a business is already using Exchange 2010/2013 the reasons to move to Office 365 now are not compelling because of the cost of change or disruption to users.

Apple Tablet and PC sales exceed Dell/HP combined, largest PC company by volume?

Tablets contribute around 50% of all PC sales and why Apple now make up the biggest part of the current PC market having a significant lead over number two (Lenovo).

http://appleinsider.com/articles/14/02/05/apples-195-percent-share-of-global-pc-tablet-sales-now-larger-than-dell-hp-together

Combining Tablets with the traditional Desktop and Laptop makes sense, iPads were referred to as consumption devices for a long period after being released in 2007, the reality of tablet devices (iOS, Android, Windows etc) though is that they are mostly suitable for the purposes of a traditional PC with a decent AppStore ecosystem behind them.

Personally I don't own an iPad, I do understand why though the device is coveted over others: Design, Consistency and Apps make the Apple device punch well above all other vendors.

Market positions like this don't 'just' remain though and Apple have a lot of competition from devices that are good enough for the majority. 

IT's dirty secrets?

Came across this article today, which though a little sensationalistic was not far from the mark regarding your IT department. 

http://m.itworld.com/it-management/402124/6-dirty-secrets-it-industry?source=ITWNLE_nlt_today_2014-02-02

Thinking about Active Directory Recovery

Probably the most utilised and under considered software component in your organisation. Microsoft Active Directory underpins almost every authentication activity.

•           Workstation login
•           Printer
•           Email Access
•           Federation to external resources
•           File access
•           Delegated access to resources
•           SharePoint
•           Office Communications server/Lync
•           SQL server
•           IIS websites

When Active Directory fails the fallout will be enormous and most likely its not currently in scope for your Business Continuity Plans for major application failure or when it is, it is poorly considered.

In my experience with customers even if it is in scope Active Directory recovery will be a restore from tape and follow the Microsoft recovery guide here:  

http://technet.microsoft.com/en-us/library/cc757662(v=ws.10).aspx  

Unfortunately the steps contained in that document are not a recovery process at all but rather a set of steps that you will need to undertake when the problem occurs.  

Recovery is also not a simple Backup and restore system state process when there are multiple DC’s and worse when there are constraints on expertise and/or WAN.

Two types of constraint come to mind when a significant Active Directory issue occurs that might require a full recovery of AD.

1. Political/People/Management

a.       ‘War room’ committee will require invocation and plans for recovery process commence

b.      People need to be mobilised

c.       The right skills need to be available to perform the recovery, as it’s a complex task

d.      The recovery process needs to be current and valid

e.      Every 60 minutes management will want an update on progress

2   

2   2. Technical

a.       If running multiple Domain controllers, each domain controller needs to be isolated from all others to ensure bad data doesn’t replicate

b.      Recovery may require multiple backup versions to ensure the recovery doesn’t recover a previous ‘bad’ backup.

c.       AD health needs to checked and confirmed to ensure all services are back up and operational.

d.       Recovery process might have to pause recovery of various servers to ensure the correct restore process occurs

e.      Rolling the RID forward needs to occur to ensure there isn’t an issue with old corrupt data becoming authoritative and overwriting good recovered data.

My experience with business disasters has been that as a problem becomes larger more people are involved and the process of recovering the failed system slows down due to people becoming involved and without a good rollback position, people are more reluctant to attempt the recovery without more time and additional people becoming involved. This becomes a nightmare of epic proportions.

Recently we were invited to prove a recovery of Active Directory against Microsoft Professional Services for a customer of ours to highlight the difference in TTTR (Total Time To Recover).

Microsoft PSO and their recovery process required 17 hours to restore AD

Our Software approach was 1 hour and 5 minutes and we proved this 3 times. 

In addition to the recovery our software creates the recovery process and automates it. It also allows the business to test full AD recovery without risk.

Whether your organisation needs to be able to recover quickly is down to the business leaders but in many cases the business doesn’t understand the implications of a full forest outage and just how much business may be affected and inoperable.

Configuring 'Fusion IO' without a specialised 'Hybrid Hard Drive'

My main PC hard drive recently failed leaving me data less and with no PC to run Steam games from. Luckily most of my data was already replicated to a central NAS and other critical data shared between "Google Drive" and "Microsoft SkyDrive" so the loss was restricted to save games .... noooooooo ...... Skyrim and many many hours of playtime all gone.

Anyway, I have purchased a 2 TB hard Drive to replace the failed drive and I happened to also have a 120 GB SSD which was a OEM replacement for another SSD that failed on me last year. 

Reading further about Fusion IO, I pondered whether I could actually use this SSD and the 2 TB hard disk together as a Hybrid drive and it seems as though I can. Intel provide a configuration with the recent 6 and 7 series chipsets for a RAID configuration that supports a Hybrid setup. I will update my experiences after I have installed Windows again.

http://www.pcworld.com/article/248828/how_to_setup_intel_smart_response_ssd_caching_technology.html

Update:

It seems that the Motherboard I'm using doesn't support the Hybrid drive :-(

Interesting Vulnerability in Office 365

Stumbled across this interesting link today regarding Microsoft Office 365, http://adallom.com/blog/severe-office-365-token-disclosure-vulnerability-research-and-analysis/

Its expected that all software has inherent flaws as its impossible to code for every possibility without many iterations. The scary aspect of this problem though is that as organisations move towards Cloud based solutions for storing business critical and sensitive data, the likelihood of data being stolen increases dramatically. 

The 'Old World' corporation stored data within their own organisational boundaries, this in itself added a 'castle wall' where a hacker had to get past the corporate firewall before security could be breached. even exploiting a credential did not necessarily mean a hacker had access to any data.

Vulnerabilities will continue to be found and exploited of many years to come (just look at patches for the software and OS versions we all use everyday) and possibly there is a case for storing sensitive intellectual property within the companies walls.