0

IT Security Rewind – August 22, 2011

Posted on August 26, 2011 by Josh Arrington

What could 43,000 Yale graduates, the Securities and Exchange Commission, the Maine voter registration system and RSA possibly have in common? Their data has all been tampered with. In this week’s IT security rewind we’ll reveal the email that took down RSA, review this week’s noteworthy data breaches and question the SEC’s involvement in data destruction associated with the  Berni Madoff case. What a week!

Dear RSA, “I forward this file to you for review. Please open and view it.” – It’s been a rough week for RSA, as researchers at F-Secure believe that this email carrying an infected Excel sheet may be the sole cause of the major phishing breach that tainted the company’s reputation. According to IDG, “The e-mail was sent on March 3 and uploaded to VirusTotal, a free service used to scan suspicious messages, on March 19, two days after RSA went public with the news that it had been hacked in one of the worst security breaches ever.”

Mainers and Yale Grads Beware! Since the beginning of the “IT Security Rewind,” we have yet to go a week without some sort of publicized data breach, and this week is no different. This Tuesday, Yale University notified about 43,000 faculty, staff, students and alumni that their names and Social Security numbers were publicly available via Google search for about 10 months. What’s interesting about this breach is that a File Transfer Protocol (FTP) server on which the data was stored became searchable via Google as the result of a change the search engine giant made last September.

The very next day, voters in the state of Maine were notified that a CVS-linked computer in one of the town offices was infected with data-stealing malware.

The Berni Saga won’t end – and this week data surrounding the case takes center stage as the Securities and Exchange Commission (SEC) has been accused of destroying thousands of data files on high profile inquiries including an early-stage investigation into Berni Madoff. Whether or not privileged access played a role in this possible tampering is unclear, however according to CSO Online, “Senator Chuck Grassley, the senior Republican on the Senate Judiciary committee, said the data that the SEC is alleged to have destroyed – between 1993 and 2010 – also concerned investigations into alleged insider trading at Deutsche Bank, SAC Capital and collapsed bank Lehman Brothers; as well as into corporate practices during Goldman Sachs’ trading of complex products with insurer AIG.”

Can you handle the security drama? Let us know your thoughts on this week’s events below…

0

IT Security Rewind – Week of August 15, 2011

Posted on August 22, 2011 by Josh Arrington

Limitations of technologies that are supposed to be protecting against emerging security vulnerabilities, deeper examinations of mainstream breaches and more painful insider attacks—they’re all a part of the next installment of our IT Security Rewind Series. Let’s take a look, shall we?

  • You Live, You Learn: Few attacks generated as much media coverage and buzz as the attack against RSA that occurred earlier this year. This video interview from ThreatPost with Uri Rivner of RSA breaks down the different aspects of the attack including the elevation of privileges that were used to the advantage of the hackers.  As Rivner explains, this breach directly exposes the limitations associated with a security strategy focused on perimeter protection, and not on the accessibility of the sensitive information and controls that can easily be manipulated from the inside of a system.
  • DAMn—Is this technology working?: A feature from Ericka Chickowski of Dark Reading finds that financial institutions are still struggling with insider threats and other security vulnerabilities despite investments in database activity monitoring tools. While DAM technology plays a critical role in protecting against SQL injections and exploits in database protocols and commands, its inherent limitation in providing for privileged user monitoring may play a key role in its apparent ineffectiveness.
  • Fast Food Diner on Network Crime: As IDG reported, a former IT worker at the U.S. subsidiary of Japanese drug-maker Shionogi, has pleaded guilty to effectively using his privileged access and controls to “create virtual chaos” by wiping out the VMWare host services that ran the company’s corporate email systems. Apparently, after laying off the employee, Jason Cornish,  Shionogi did a poor job of revoking passwords to the company’s network.  Using a Shionogi account, Cornish logged on from a public McDonald’s Internet connection to access a vSphere VMware management console that he’d secretly installed on the company’s network a few weeks earlier. He then proceeded to delete 88 company servers from the VMware host systems—further highlighting the need to control privileged users in both physical AND virtual environments.

That’s a wrap for this week—let us know what other stories you think should be added to the rewind.

2

Our Q&A with SysAdmin Appreciation Day Twitter Contest Winner: Thomas Deliduka of the Columbus Museum of Art (Ohio)

Posted on August 11, 2011 by Josh Arrington

As readers of our blog know, we recently crowned Thomas Deliduka as this year’s winner of Cyber-Ark’s SysAdmin Appreciation Day Twitter contest. Thomas beat out several other participants in a competitive contest by impressing the judges with his efficient and error-free Microsoft Exchange rollout for 100+ users. But since there’s only so much you can learn in 140 characters (or less) we thought it would be valuable to learn more about his “winning” achievement. Without further ado, here’s our Q&A with Thomas—we hope this not only shines some more light on the merits of his winning submission, but also provides some great insight for other SysAdmins out there who just may find themselves in a similar situation!

Cyber-Ark: Thomas, in addition to your new title as “SysAdmin Appreciation Day Twitter Contest Winner,” could you tell us a bit about your day job?

Thomas: I am the Director of Information Technology at the Columbus Museum of Art in Columbus, Ohio. It is probably the best job I have ever had, I get all the hands-on experience but also the responsibility of a department head.

Cyber-Ark: Although there were many great submissions and it was a tough decision for the judges, your Tweet/achievement immediately resonated with the judges and they were unanimously impressed. Can you tell us a little bit more about how you first approached the rollout?

Thomas: Once I was assigned the project in late 2010, I began researching what I actually needed to do to upgrade Exchange. At first, I just bookmarked some posts and then left it alone—it wasn’t until February when I purchased two new servers and realized I needed to start getting to work. Another resource that was helpful was this amazing blog post, which I’m not sure I could find anymore, that outlined how to run Exchange in legacy mode and then slowly move people over.

Cyber-Ark: And then the fun began?

Thomas: I got the first server OS installed and named it “xxxxxxx-01″ because it was going to be the first server. However, then I read further and find out I needed to install the CAS server first. In my mind, the CAS server should be server 2, so before I went too much further, I renamed the server and started installing the operating system on server 1.

I got the CAS server online the first day and it immediately integrated it with my 2003 environment—including allowing for the ActiveSync calls to come first to the Exchange 2010 server and then get routed to the 2003 server through the “legacy” DNS entry.

That was almost seamless, I was so surprised. None of my phone users noticed any changes at all.

On the second day, I finished the Mailbox server—I couldn’t wait to convert my own mailbox because I always experiment on myself.  So, I finished that, and again, ActiveSync connected just fine on my Android device and kept on humming.

Cyber-Ark: Once you had tested the migration on your own accounts, how did you approach the other users?

­­­­Thomas: Right away I started moving people who I knew were on vacation and out of the office—just about 10 mailboxes or so. I found that by bringing up Outlook after the migration of the mailbox, the system automatically updated to the new Exchange Server. That was surprising, but welcome, since I knew I wouldn’t have to visit every single user!

After that, it was smooth sailing. I told people to expect a mailbox migration over the new few days and that they shouldn’t notice any changes. I connected via VPN at night over the next few days and converted about 20 or 30 mailboxes at a time. The final group to convert was the Mac Users—we were using Microsoft Entourage 2008 on about five computers. When we needed to migrate their mailboxes, Entourage would no longer work so I had to install the updated Office 2011 before migrating their mailboxes, then immediately convert and connect so they would see no downtime.

That was fine for four of the users, but there was one who decided he simply couldn’t have me messing with his computer for at least another four days. So, I migrated his mailbox and taught him how to use the new Webmail with Exchange 2010.

The day I migrated the last mailbox, I went ahead and separated the 2003 server and shut it down!  From start to finish it was a little less than two weeks but it’s easier to say two weeks.

Cyber-Ark: Any additional information you learned from all this?

Thomas: One issue you could say I had was that Microsoft doesn’t allow Domain Admins to sync e-mail through ActiveSync. There is an inherent value within Active Directory that when it is not set–ActiveSync doesn’t work. As a Domain Admin, it’s automatically turned off. This experience forced me to do the proper “best practice” of removing myself as a domain admin and using another account for super-user operations. I don’t really count this as a problem because it only affected me.  I hope that doesn’t disqualify me!

Cyber-Ark: Absolutely not. Congrats again on a smooth and successful migration! Any parting words?

Thomas: I have to hand it to Microsoft, they really did make it easy. We haven’t had any routing issues, in fact mail-flow is much better. Smart phones work just fine, everything is amazing.

If you’d like to reach Thomas to congratulate him—or to learn more about his story—feel free to contact him on your preferred social network:

Twitter: @Tomnibus

LinkedIn: http://www.linkedin.com/in/deliduka

Google+: https://plus.google.com/107360993311566660432/posts

As readers of our blog know, we recently crowned Thomas Deliduka as this year’s winner of Cyber-Ark’s SysAdmin Appreciation Day Twitter contest. Thomas beat out several other participants in a competitive contest by impressing the judges with his efficient and error-free Microsoft Exchange rollout for 100+ users. But since there’s only so much you can learn in 140 characters (or less) we thought it would be valuable to learn more about his “winning” achievement. Without further ado, here’s our Q&A with Thomas—we hope this not only shines some more light on the merits of his winning submission, but also provides some great insight for other SysAdmins out there who just may find themselves in a similar situation!

Cyber-Ark: Thomas, in addition to your new title as “SysAdmin Appreciation Day Twitter Contest Winner,” could you tell us a bit about your day job?

Thomas: I am the Director of Information Technology at the Columbus Museum of Art in Columbus, Ohio. It is probably the best job I have ever had, I get all the hands-on experience but also the responsibility of a department head.

Cyber-Ark: Although there were many great submissions and it was a tough decision for the judges, your Tweet/achievement immediately resonated with the judges and they were unanimously impressed. Can you tell us a little bit more about how you first approached the rollout?

Thomas: Once I was assigned the project in late 2010, I began researching what I actually needed to do to upgrade Exchange. At first, I just bookmarked some posts and then left it alone—it wasn’t until February when I purchased two new servers and realized I needed to start getting to work. Another resource that was helpful was this amazing blog post, which I’m not sure I could find anymore, that outlined how to run Exchange in legacy mode and then slowly move people over.

Cyber-Ark: And then the fun began?

Thomas: I got the first server OS installed and named it “xxxxxxx-01″ because it was going to be the first server. However, then I read further and find out I needed to install the CAS server first. In my mind, the CAS server should be server 2, so before I went too much further, I renamed the server and started installing the operating system on server 1.

I got the CAS server online the first day and it immediately integrated it with my 2003 environment—including allowing for the ActiveSync calls to come first to the Exchange 2010 server and then get routed to the 2003 server through the “legacy” DNS entry.

That was almost seamless, I was so surprised. None of my phone users noticed any changes at all.

­­

On the second day, I finished the Mailbox server—I couldn’t wait to convert my own mailbox because I always experiment on myself.  So, I finished that, and again, ActiveSync connected just fine on my Android device and kept on humming.

Cyber-Ark: Once you had tested the migration on your own accounts, how did you approach the other users?

­­­­Thomas: Right away I started moving people who I knew were on vacation and out of the office—just about 10 mailboxes or so. I found that by bringing up Outlook after the migration of the mailbox, the system automatically updated to the new Exchange Server. That was surprising, but welcome, since I knew I wouldn’t have to visit every single user!

After that, it was smooth sailing. I told people to expect a mailbox migration over the new few days and that they shouldn’t notice any changes. I connected via VPN at night over the next few days and converted about 20 or 30 mailboxes at a time. The final group to convert was the Mac Users—we were using Microsoft Entourage 2008 on about five computers. When we needed to migrate their mailboxes, Entourage would no longer work so I had to install the updated Office 2011 before migrating their mailboxes, then immediately convert and connect so they would see no downtime.

That was fine for four of the users, but there was one who decided he simply couldn’t have me messing with his computer for at least another four days. So, I migrated his mailbox and taught him how to use the new Webmail with Exchange 2010.

The day I migrated the last mailbox, I went ahead and separated the 2003 server and shut it down!  From start to finish it was a little less than two weeks but it’s easier to say two weeks.

Cyber-Ark: Any additional information you learned from all this?

Thomas: One issue you could say I had was that Microsoft doesn’t allow Domain Admins to sync e-mail through ActiveSync. There is an inherent value within Active Directory that when it is not set–ActiveSync doesn’t work. As a Domain Admin, it’s automatically turned off. This experience forced me to do the proper “best practice” of removing myself as a domain admin and using another account for super-user operatio

As readers of our blog know, we recently crowned Thomas Deliduka as this year’s winner of Cyber-Ark’s SysAdmin Appreciation Day Twitter contest. Thomas beat out several other participants in a competitive contest by impressing the judges with his efficient and error-free Microsoft Exchange rollout for 100+ users. But since there’s only so much you can learn in 140 characters (or less) we thought it would be valuable to learn more about his “winning” achievement. Without further ado, here’s our Q&A with Thomas—we hope this not only shines some more light on the merits of his winning submission, but also provides some great insight for other SysAdmins out there who just may find themselves in a similar situation!

Cyber-Ark: Thomas, in addition to your new title as “SysAdmin Appreciation Day Twitter Contest Winner,” could you tell us a bit about your day job?

Thomas: I am the Director of Information Technology at the Columbus Museum of Art in Columbus, Ohio. It is probably the best job I have ever had, I get all the hands-on experience but also the responsibility of a department head.

Cyber-Ark: Although there were many great submissions and it was a tough decision for the judges, your Tweet/achievement immediately resonated with the judges and they were unanimously impressed. Can you tell us a little bit more about how you first approached the rollout?

Thomas: Once I was assigned the project in late 2010, I began researching what I actually needed to do to upgrade Exchange. At first, I just bookmarked some posts and then left it alone—it wasn’t until February when I purchased two new servers and realized I needed to start getting to work. Another resource that was helpful was this amazing blog post, which I’m not sure I could find anymore, that outlined how to run Exchange in legacy mode and then slowly move people over.

Cyber-Ark: And then the fun began?

Thomas: I got the first server OS installed and named it “xxxxxxx-01″ because it was going to be the first server. However, then I read further and find out I needed to install the CAS server first. In my mind, the CAS server should be server 2, so before I went too much further, I renamed the server and started installing the operating system on server 1.

I got the CAS server online the first day and it immediately integrated it with my 2003 environment—including allowing for the ActiveSync calls to come first to the Exchange 2010 server and then get routed to the 2003 server through the “legacy” DNS entry.

That was almost seamless, I was so surprised. None of my phone users noticed any changes at all.

On the second day, I finished the Mailbox server—I couldn’t wait to convert my own mailbox because I always experiment on myself.  So, I finished that, and again, ActiveSync connected just fine on my Android device and kept on humming.

Cyber-Ark: Once you had tested the migration on your own accounts, how did you approach the other users?

­­­­Thomas: Right away I started moving people who I knew were on vacation and out of the office—just about 10 mailboxes or so. I found that by bringing up Outlook after the migration of the mailbox, the system automatically updated to the new Exchange Server. That was surprising, but welcome, since I knew I wouldn’t have to visit every single user!

After that, it was smooth sailing. I told people to expect a mailbox migration over the new few days and that they shouldn’t notice any changes. I connected via VPN at night over the next few days and converted about 20 or 30 mailboxes at a time. The final group to convert was the Mac Users—we were using Microsoft Entourage 2008 on about five computers. When we needed to migrate their mailboxes, Entourage would no longer work so I had to install the updated Office 2011 before migrating their mailboxes, then immediately convert and connect so they would see no downtime.

That was fine for four of the users, but there was one who decided he simply couldn’t have me messing with his computer for at least another four days. So, I migrated his mailbox and taught him how to use the new Webmail with Exchange 2010.

The day I migrated the last mailbox, I went ahead and separated the 2003 server and shut it down!  From start to finish it was a little less than two weeks but it’s easier to say two weeks.

Cyber-Ark: Any additional information you learned from all this?

Thomas: One issue you could say I had was that Microsoft doesn’t allow Domain Admins to sync e-mail through ActiveSync. There is an inherent value within Active Directory that when it is not set–ActiveSync doesn’t work. As a Domain Admin, it’s automatically turned off. This experience forced me to do the proper “best practice” of removing myself as a domain admin and using another account for super-user operations. I don’t really count this as a problem because it only affected me.  I hope that doesn’t disqualify me!

Cyber-Ark: Absolutely not. Congrats again on a smooth and successful migration! Any parting words?

Thomas: I have to hand it to Microsoft, they really did make it easy. We haven’t had any routing issues, in fact mail-flow is much better. Smart phones work just fine, everything is amazing.

If you’d like to reach Thomas to congratulate him—or to learn more about his story—feel free to contact him on your preferred social network:

Twitter: @Tomnibus

LinkedIn: http://www.linkedin.com/in/deliduka

Google+: https://plus.google.com/107360993311566660432/posts

ns. I don’t really count this as a problem because it only affected me.  I hope that doesn’t disqualify me!

Cyber-Ark: Absolutely not. Congrats again on a smooth and successful migration! Any parting words?

Thomas: I have to hand it to Microsoft, they really did make it easy. We haven’t had any routing issues, in fact mail-flow is much better. Smart phones work just fine, everything is amazing.

If you’d like to reach Thomas to congratulate him—or to learn more about his story—feel free to contact him on your preferred social network:

Twitter: @Tomnibus

LinkedIn: http://www.linkedin.com/in/deliduka

Google+: https://plus.google.com/107360993311566660432/posts

0

Black Hat Conference USA 2011 – According to the Twitterverse

Posted on August 8, 2011 by Josh Arrington

The Black Hat Conference (#Blackhat) has established itself as one of the technology industry’s leading events for the security elite.  More than just a hacker conference, many of this year’s presentations were equally as eye-opening for the C-Suite, especially in terms of raising awareness of lesser-known enterprise vulnerabilities that pose significant risk.

While Cyber-Ark didn’t attend the event, many of our customers and partners did, so we paid close attention to the buzz surrounding the event.  From SCADA systems and exploding batteries to Shady RAT, following are some of our favorite tweets that captured top stories from the event.

@buzzblog: New post: Scariest Black Hat story so far: Power plants at risk networkworld.com/community/blog… #Siemens

@KimZetter: Hardcoded Password and Other Security Holes Found in Siemens Control Systems – http://t.co/39ss0UR

@josphmenn: My reg req’d story based on scary #BlackHat presentations, etc: Utilities warned that many PLCs open to Internet hacks. http://t.co/1k7G1U8

@mathewjschwartz: China Suspected Of Shady RAT Attacks — InformationWeek #li #infosec #blackhat http://t.co/xfdnbhx

@SCMagazine: Black Hat: Insulin pumps can be hacked http://dlvr.it/dvG6c

@zdnetaustralia: A security threat has emerged and it comes from an unexpected source: laptop batteries http://bit.ly/r30tkR

@ryanarine: Microsoft’s BlueHat Prize: A new twist on security research incentives http://zd.net/q84Sf0

@CNNTech: Hacker shuts down Apple MacBook battery — and can do so remotely: http://t.co/QLMnAu7 by @jdsutter at #blackhat

And one of the event wrap-ups worth reading from @SecurityWeek: Black Hat Wrap Up: What Created the Most Buzz? bit.ly/p8qSZI #blackhat #defcon #infosec

What are your picks for top stories coming out of Black Hat?

0

Cyber-Ark Announces This Year’s Big Winner of the SysAdmin Appreciation Day Twitter Contest

Posted on August 1, 2011 by Josh Arrington

Today, July 29, 2011, marked another excellent SysAdmin Appreciation Day and the Cyber-Ark team is thrilled to have played a role in recognizing the efforts of these IT rock stars. As you know, on Monday, we kicked off our 2nd Annual System Administrator Appreciation Day Contest by asking participants to answer this simple question over Twitter: “What is your greatest enterprise IT accomplishment in the past year?”

As the responses rolled in, our esteemed judges, Standalone SysAdmin’s Matt Simmons, Cyber-Ark’s Bill Pesiridis, and the NubbyAdmin’s Wesley David, analyzed their merits and began to formulate their thoughts on who should be crowned the “winner.” While the judges determined that there were some truly exceptional responses, and that all of the achievements deserved recognition (more on that later), one stood out from the pack.

Without further ado, on behalf of our judges, we would like to formally declare Thomas Deliduka, aka @Tomnibus, as this year’s winner! Here’s the winning Tweet:

@tomnibus “@CyberArk Greatest Accomplishment: upgraded Exchange 2003->2010 on my own for 100+ users, two weeks start to finish, no hiccups #SysAdminDay”

The judges agreed that this was a significant achievement. For Wesley, Thomas’s response marked a serious accomplishment. An Exchange 2003-2010 rollout is no easy task, you can read more about that type of migration here, and he was impressed with the speed and efficiency. For Matt—the complexity of this type of project stood out from the pack. Bill concurred—he’s actually tackled the project himself and agrees that it is a daunting task. E-mail is a critical application for the end-user, and it can be very difficult to find the downtime to pull this migration off.

So there you have it once again—congrats Thomas! You’ll be hearing more from @Cyberark as you are soon to be the proud recipient of our grand prize—an Amazon Kindle.

But wait, there’s more. Wesley, Matt and Bill would like to recognize the efforts of the other participants who they deemed “honorable mentions”, as this was a very close competition. Check back next week for a new blog post that details their thought process when selecting the winner and these “finalists”—and stay tuned, especially, if you were a participant. We’ll be reaching out to you to learn more about your achievements. After all, in Matt’s words, while Thomas’ achievement was very impressive, “we could select any of these responses justifiably.” So great job participants—in true recognition of SysAdminDay, you provided us with some excellent insights into the great work you do on a daily basis. You truly deserve even more than just a day of celebration!