0

IT Event Rewind: ArcSight Protect ‘11

Posted on October 3, 2011 by Richard Weeks

A couple of weeks ago I had the pleasure of attending HP ArcSight Protect ’11, hosted by HP Enterprise Security: ArcSight, Fortify and TippingPoint. This wasn’t my first time attending this show, and as usual, I was very impressed by the global customer conference.  For those of you who didn’t get to attend, I have finally sat down and pulled together some thoughts to share.

The Big news from the show was that HP’s Enterprise Security Products (ESP) division will formally launchon Nov 1st, 2011. This division will include products from ArcSight, TippingPoint, Fortify and Viistorm (the UK-based security company that will act as the global security services arm). ArcSight

I also really enjoyed HP EVP Tom Reilly’s visionary keynote message as it was right on target with the ID Intelligence theme that I dedicate a lot of focus to on a regular basis. The keynote emphasized ArcSight’s new acronym Security Information Risk Management (“SIRM”) (remember ETRM?) and also touched on major industry news and trends such as:

  • The APT & Stuxnet Reality:  Assume that you’ve already been hacked; adopt a prioritized, Risk-based InfoSec approach
  • “Well-Funded Adversaries” =  Nation States and Organized Crime are highly sophisticated
  • “We all struggle with ‘BYOD’ (Bring Your Own Device) to Work” = Mobility Security Challenges
  • The Cloud,  Virtual Environments and Mobility provide new ‘attack surfaces’

If you’d like to learn more about Reilly’s keynote click here to see his video interview:

http://www.youtube.com/user/HPSecure?feature=mhsn#p/u/0/uhb6u_LB7To

In other ArcSight news, their technology ecosystem partners are being strongly encouraged to implement “closed loop response actions” that will allow real-time remediation activity from directly within the SOC & the ArcSight ESM™ platform to complementary third party security solutions.

Finally, based on Cyber-Ark’s alliance with HP ArcSight, we were privileged to have had the opportunity to present a customer case study at the event. To top that, we were also invited to be the subjects of a video interview by SC Magazine on the topic of, you guessed it, ‘Privileged Identity Intelligence.’ Check out the link to the video and let us know what you think. You can expect to hear more from us on this topic moving forward.

Have any ArcSight highlights of your own? Share them here!

A couple of weeks ago I had the pleasure of attending HP ArcSight Protect ’11, hosted by HP Enterprise Security: ArcSight, Fortify and TippingPoint. This wasn’t my first time attending this show, and as usual, I was very impressed by the global customer conference.  For those of you who didn’t get to attend, I have finally sat down and pulled together some thoughts to share.

Description: Description: Description: ArcSight Cyber-Ark Integration Diagram.jpgThe Big news from the show was that HP’s Enterprise Security Products (ESP) division will formally launchon Nov 1st, 2011. This division will include products from ArcSight, TippingPoint, Fortify and Viistorm (the UK-based security company that will act as the global security services arm).

I also really enjoyed HP EVP Tom Reilly’s visionary keynote message as it was right on target with the ID Intelligence theme that I dedicate a lot of focus to on a regular basis. The keynote emphasized ArcSight’s new acronym Security Information Risk Management (“SIRM”) (remember ETRM?) and also touched on major industry news and trends such as:

· The APT & Stuxnet Reality:  Assume that you’ve already been hacked; adopt a prioritized, Risk-based InfoSec approach

· “Well-Funded Adversaries” =  Nation States and Organized Crime are highly sophisticated

· “We all struggle with ‘BYOD’ (Bring Your Own Device) to Work” = Mobility Security Challenges

· The Cloud,  Virtual Environments and Mobility provide new ‘attack surfaces’

If you’d like to learn more about Reilly’s keynote click here to see his video interview:

http://www.youtube.com/user/HPSecure?feature=mhs

A couple of weeks ago I had the pleasure of attending HP ArcSight Protect ’11, hosted by HP Enterprise Security: ArcSight, Fortify and TippingPoint. This wasn’t my first time attending this show, and as usual, I was very impressed by the global customer conference.  For those of you who didn’t get to attend, I have finally sat down and pulled together some thoughts to share.

The Big news from the show was that HP’s Enterprise Security Products (ESP) division will formally launchon Nov 1st, 2011. This division will include products from ArcSight, TippingPoint, Fortify and Viistorm (the UK-based security company that will act as the global security services arm).

I also really enjoyed HP EVP Tom Reilly’s visionary keynote message as it was right on target with the ID Intelligence theme that I dedicate a lot of focus to on a regular basis. The keynote emphasized ArcSight’s new acronym Security Information Risk Management (“SIRM”) (remember ETRM?) and also touched on major industry news and trends such as:

  • The APT & Stuxnet Reality:  Assume that you’ve already been hacked; adopt a prioritized, Risk-based InfoSec approach
  • “Well-Funded Adversaries” =  Nation States and Organized Crime are highly sophisticated
  • “We all struggle with ‘BYOD’ (Bring Your Own Device) to Work” = Mobility Security Challenges
  • The Cloud,  Virtual Environments and Mobility provide new ‘attack surfaces’

If you’d like to learn more about Reilly’s keynote click here to see his video interview:

http://www.youtube.com/user/HPSecure?feature=mhsn#p/u/0/uhb6u_LB7To

In other ArcSight news, their technology ecosystem partners are being strongly encouraged to implement “closed loop response actions” that will allow real-time remediation activity from directly within the SOC & the ArcSight ESM™ platform to complementary third party security solutions.

Finally, based on Cyber-Ark’s alliance with HP ArcSight, we were privileged to have had the opportunity to present a customer case study at the event. To top that, we were also invited to be the subjects of a video interview by SC Magazine on the topic of, you guessed it, ‘Privileged Identity Intelligence.’ Check out the link to the video and let us know what you think. You can expect to hear more from us on this topic moving forward.

Have any ArcSight highlights of your own? Share them here!

n#p/u/0/uhb6u_LB7To

In other ArcSight news, their technology ecosystem partners are being strongly encouraged to implement “closed loop response actions” that will allow real-time remediation activity from directly within the SOC & the ArcSight ESM™ platform to complementary third party security solutions.

Finally, based on Cyber-Ark’s alliance with HP ArcSight, we were privileged to have had the opportunity to present a customer case study at the event. To top that, we were also invited to be the subjects of a video interview by SC Magazine on the topic of, you guessed it, ‘Privileged Identity Intelligence.’ Check out the link to the video and let us know what you think. You can expect to hear more from us on this topic moving forward.

Have any ArcSight highlights of your own? Share them here!

0

IT Security Rewind – Week of September 19

Posted on September 23, 2011 by Josh Arrington

It was another interesting week for IT security professionals, with numerous developments, breaking stories and breaches to follow. But before we dig in to this week’s Rewind—we wanted to wish a warm farewell to Dave Kearns, who wrote one of final pieces for the penultimate edition of the Network World Identity Management newsletter. We wish Dave well with his analyst role at Kuppinger-Cole—where he’ll continue to provide us with keen security insights!

APT: In Review – It’s never easy to put together a “lessons learned” type of piece when it involves a sensitive and well-documented security attack, but Pacific Northwest National Laboratory CIO Jerry Johnson did a great job at the recent InformationWeek 500 conference. Johnson developed a presentation that described the APT attack against his company with such details as “when the intruders tried to recreate and elevate account privileges, this action triggered an alarm, alerting the lab’s cybersecurity team…”  It’s information like this that can help all security professionals better prepare themselves and anticipate vulnerabilities.

Is “SIEM dead as claimed?”—To no surprise, questions like these usually provoke responses of all types. As Computerworld reported, a recent survey “conducted with senior security professionals at Global 5000 and federal organizations” found that “SIEM has joined signature-based technologies on the ash heap of IT history.” However, advocates for SIEM, like Dr. Anton Chuvakin of Gartner disagree—stating that while SIEM is not a tool that should be used primarily to prevent attacks, it’s still an important monitoring technology.

Access Rules –InfoSecurity provided more background on the $2.3 billion UBS fraud case this week. While details are still swirling, it’s clear that this is another example of a trader acting beyond authorization in a highly regulated market. While the article delves deeper, calling for tighter monitoring and controls, the question remains:  If access and risk management controls and processes were in place, how were the traders able to circumvent them?

Anything we missed? What stories have you been following? Let us know!

0

IT Security Rewind – Week of September 12

Posted on September 19, 2011 by Josh Arrington

It was a week of déjà vu and doppelgangers in the world of IT security, with another rogue financial trader scandal and doppelganger domains stealing data. Here is this week’s IT Security Rewind with all the gory details:

“I need a miracle” – This Facebook status update couldn’t be more appropriate for Kweku Adoboli, the 31-year old City trader at UBS suspected of carrying out Britain’s biggest banking fraud. This week has to feel like déjà vu for the financial industry, as Mr. Adoboli was arrested at his desk yesterday for allegedly losing £1.3 billion through his rogue trades. This case is eerily familiar to the case of Jérôme Kerviel, the Paris-based Société Générale worker who lost £4 billion in rogue trades back in 2008.What’s worse is that UBS only became aware of the unauthorized trading when Mr. Adoboli told them, the bank’s monitoring systems had not picked up the loss. Could this be another situation where privilege identity management could have signaled an early warning? Stay tuned…

“When it absolutely, positively has to be there overnight.” – This week our own Oded Valin shared his thoughts on move file transfers processes to the cloud with Infosecurity Magazine. Boiling his advice down to seven steps, Oded outlined how organizations can safely exchange sensitive files in the cloud while maintaining security and compliance requirements.

Big Data = Big Problems – Dark Reading’s Ericka Chickowski put the spotlight on data warehouses and emphasized that the quicker and easier it is to access these “big data” stores, the greater security risk there is to all of that sensitive information. We have to agree with Ericka on this one, when you put more eggs into the basket (i.e. instead of separate databases you consolidate many databases into a single “big data”) security needs to become a higher priority.

Doppelgangers Stealing Data! –Two researchers who set up doppelganger domains to mimic legitimate domains belonging to Fortune 500 companies say they managed to vacuum up 20 gigabytes of misaddressed e-mail over six months. Of the data collected in the e-mails, Wired reported, were configuration details and passwords for an IT consulting firm’s routers and virtual private network access information for a company that manages toll roads. They also collected a lot of personal information on employees, including credit card statements and bank account records.

Feel like you’ve finally got all the drama figured out? Let us know your thoughts in our comments section!

It was a week of déjà vu and doppelgangers in the world of IT security, with another rogue financial trader scandal and doppelganger domains stealing data. Here is this week’s IT Security Rewind with all the gory details:

“I need a miracle” – This Facebook status update couldn’t be more appropriate for Kweku Adoboli, the 31-year old City trader at UBS suspected of carrying out Britain’s biggest banking fraud. This week has to feel like déjà vu for the financial industry, as Mr. Adoboli was arrested at his desk yesterday for allegedly losing £1.3 billion through his rogue trades. This case is eerily familiar to the case of Jérôme Kerviel, the Paris-based Société Générale worker who lost £4 billion in rogue trades back in 2008.What’s worse is that UBS only became aware of the unauthorized trading when Mr. Adoboli told them, the bank’s monitoring systems had not picked up the loss. Could this be another situation where privilege identity management could have signaled an early warning? Stay tuned…

“When it absolutely, positively has to be there overnight.” – This week our own Oded Valin shared his thoughts on move file transfers processes to the cloud with Infosecurity Magazine. Boiling his advice down to seven steps, Oded outlined how organizations can safely exchange sensitive files in the cloud while maintaining security and compliance requirements.

Big Data = Big Problems – Dark Reading’s Ericka Chickowski put the spotlight on data warehouses and emphasized that the quicker and easier it is to access these “big data” stores, the greater security risk there is to all of that sensitive information. We have to agree with Ericka on this one, when you put more eggs into the basket (i.e. instead of separate databases you consolidate many databases into a single “big data”) security needs to become a higher priority.

Doppelga

It was a week of déjà vu and doppelgangers in the world of IT security, with another rogue financial trader scandal and doppelganger domains stealing data. Here is this week’s IT Security Rewind with all the gory details:

“I need a miracle” – This Facebook status update couldn’t be more appropriate for Kweku Adoboli, the 31-year old City trader at UBS suspected of carrying out Britain’s biggest banking fraud. This week has to feel like déjà vu for the financial industry, as Mr. Adoboli was arrested at his desk yesterday for allegedly losing £1.3 billion through his rogue trades. This case is eerily familiar to the case of Jérôme Kerviel, the Paris-based Société Générale worker who lost £4 billion in rogue trades back in 2008.What’s worse is that UBS only became aware of the unauthorized trading when Mr. Adoboli told them, the bank’s monitoring systems had not picked up the loss. Could this be another situation where privilege identity management could have signaled an early warning? Stay tuned…

“When it absolutely, positively has to be there overnight.” – This week our own Oded Valin shared his thoughts on move file transfers processes to the cloud with Infosecurity Magazine. Boiling his advice down to seven steps, Oded outlined how organizations can safely exchange sensitive files in the cloud while maintaining security and compliance requirements.

Big Data = Big Problems – Dark Reading’s Ericka Chickowski put the spotlight on data warehouses and emphasized that the quicker and easier it is to access these “big data” stores, the greater security risk there is to all of that sensitive information. We have to agree with Ericka on this one, when you put more eggs into the basket (i.e. instead of separate databases you consolidate many databases into a single “big data”) security needs to become a higher priority.

Doppelgangers Stealing Data! –Two researchers who set up doppelganger domains to mimic legitimate domains belonging to Fortune 500 companies say they managed to vacuum up 20 gigabytes of misaddressed e-mail over six months. Of the data collected in the e-mails, Wired reported, were configuration details and passwords for an IT consulting firm’s routers and virtual private network access information for a company that manages toll roads. They also collected a lot of personal information on employees, including credit card statements and bank account records.

Feel like you’ve finally got all the drama figured out? Let us know your thoughts in our comments section!

ngers Stealing Data! –Two researchers who set up doppelganger domains to mimic legitimate domains belonging to Fortune 500 companies say they managed to vacuum up 20 gigabytes of misaddressed e-mail over six months. Of the data collected in the e-mails, Wired reported, were configuration details and passwords for an IT consulting firm’s routers and virtual private network access information for a company that manages toll roads. They also collected a lot of personal information on employees, including credit card statements and bank account records.

Feel like you’ve finally got all the drama figured out? Let us know your thoughts in our comments section!

0

IT Security Rewind – Week of Sept. 5

Posted on September 9, 2011 by Josh Arrington

As we work to shake off the post-Labor Day blues, consider this week’s top security stories to get you re-acclimated to the risks around you….from Britons having to look over their shoulder (online!) and cyber crime at a Bikini Bar, to a new market for the The Cyber Club….let’s get schooled!

Britons Safer on the Street than Online: Results from the Norton Cyber Crime Report found that Britons are three times more likely to suffer online crime than they are street crime. The global survey of approximately 20,000 people found that more than half of the UK population (51 per cent) has been affected by some kind of cyber crime. Additionally, the survey found the top three online threats were viruses (38 per cent), credit card scams (10 per cent) and social networking fraud (six per cent). Check your anti-virus software people!

Grab Your Cover-Up: Bikinis Sports Bar & Grill is an unlikely spot for a cyber security shake-down.  So, we suppose you have to give David Palmer (no, not the idealistic president from 24) some credit for selecting a, um, “colorful” backdrop for his crime. Among the charges he was convicted on, the disgruntled IT administrator decided to strike back at his former employer by breaking into the company’s systems and deleting payroll files for one of its customers. Palmer will be sentenced in November.

This Isn’t a Job for The Club: If you still think a steering wheel lock can protect your car, think again. With a new report from McAfee showing that carhacking will replace carjacking as criminals’ attack method of choice, maybe there’s a market for The Cyber Club?  As demonstrated at Black Hat this year, it IS possible to gain remote access to a car by hacking its electronics system. This report shares interesting data about the link between the increasing lines of code necessary to run advanced car features, and the exponential attack vectors that this creates.  Those bells and whistles may soon carry a very large price tag—and one that’s not on the sticker: theft insurance.

That’s our “back to school” recap for this week.  What else would you add to the list?

0

Morto A, Brute-Force and the Perpetual Problem of Insecure Privileged Accounts

Posted on September 1, 2011 by Roy Adar

By Roy Adar, Vice President of Product Management, Cyber-Ark Software

Consider these keyboard combinations: *1234, 123, 369, abc123, abcd1234, admin, admin123, letmein, pass, password, test and user.

Not exactly what you’d call strong administrative passwords, but they are some of the combinations the Morto A worm carries in its brute-force library to attack target machines.  According to an article in NetworkWorld, the Morto A worm continues to spread “despite its reliance on a list of lame passwords to take over victim machines.”  Those machines, and all the information on them, are now vulnerable and at the mercy of the virus to delete, corrupt or quietly steal.

We believe that with a few tweaks, this simple brute-force approach can quickly resurface in more targeted attacks. Of course the most obvious response to better protecting organizations against this sort of attack is to limit reliance on “human selected passwords,” particularly related to passwords for privileged accounts.  Ideally, fully random, long passwords can take years to brute-force or may never be cracked.  And, when you consider an organization with thousands of sensitive servers, applications and systems, and hundreds of privileged accounts, automating the generation and management of strong passwords becomes all that more important to making the organization resistant to brute-force attacks.

This attack reminds me of the SQLsnake worm (aka SQLspida) that in 2001-2002 “brute-forced” its way into SQL Servers that had a blank “sa” password (the previous default password).  It was extremely successful in spreading across tens of thousands of SQL Server databases where the default privileged password for “sa” was never changed from manufacturer defaults. While the SQLsnake only tried a single password, the Morto A tries 37 password values. How long before we see viruses that take this to the next level by using internal random generators to try larger scale brute-force attacks?  It may not be long given that the virus does not need to contain a hard-to-disguise dictionary and can leverage the local Microsoft Word dictionary files, for example.

So, improving privileged password management isn’t just a good idea and a security best practice, it’s a business necessity.  Consider the number of cyber attacks in the past year that used a common pathway for entering an organization, via privileged accounts.  While the initial infiltration can use common and rather hard to prevent techniques such as phishing or social engineering, once inside, hackers can fairly easily take advantage of the lack of proper privilege controls.  If hackers can easily brute-force your privileged passwords there is nothing to stop them from jumping from desktop, to applications, to your network core.

It’s been said before, but we subscribe to the notion that organizations need to assume that hackers have already breached the perimeter.  Therefore a proactive approach to implementing internal controls and protecting privileged accounts is a critical building block in your defense strategy.

What are your organization’s best practices for privileged password management?

0

IT Security Rewind – August 22, 2011

Posted on August 26, 2011 by Josh Arrington

What could 43,000 Yale graduates, the Securities and Exchange Commission, the Maine voter registration system and RSA possibly have in common? Their data has all been tampered with. In this week’s IT security rewind we’ll reveal the email that took down RSA, review this week’s noteworthy data breaches and question the SEC’s involvement in data destruction associated with the  Berni Madoff case. What a week!

Dear RSA, “I forward this file to you for review. Please open and view it.” – It’s been a rough week for RSA, as researchers at F-Secure believe that this email carrying an infected Excel sheet may be the sole cause of the major phishing breach that tainted the company’s reputation. According to IDG, “The e-mail was sent on March 3 and uploaded to VirusTotal, a free service used to scan suspicious messages, on March 19, two days after RSA went public with the news that it had been hacked in one of the worst security breaches ever.”

Mainers and Yale Grads Beware! Since the beginning of the “IT Security Rewind,” we have yet to go a week without some sort of publicized data breach, and this week is no different. This Tuesday, Yale University notified about 43,000 faculty, staff, students and alumni that their names and Social Security numbers were publicly available via Google search for about 10 months. What’s interesting about this breach is that a File Transfer Protocol (FTP) server on which the data was stored became searchable via Google as the result of a change the search engine giant made last September.

The very next day, voters in the state of Maine were notified that a CVS-linked computer in one of the town offices was infected with data-stealing malware.

The Berni Saga won’t end – and this week data surrounding the case takes center stage as the Securities and Exchange Commission (SEC) has been accused of destroying thousands of data files on high profile inquiries including an early-stage investigation into Berni Madoff. Whether or not privileged access played a role in this possible tampering is unclear, however according to CSO Online, “Senator Chuck Grassley, the senior Republican on the Senate Judiciary committee, said the data that the SEC is alleged to have destroyed – between 1993 and 2010 – also concerned investigations into alleged insider trading at Deutsche Bank, SAC Capital and collapsed bank Lehman Brothers; as well as into corporate practices during Goldman Sachs’ trading of complex products with insurer AIG.”

Can you handle the security drama? Let us know your thoughts on this week’s events below…

0

IT Security Rewind – Week of August 15, 2011

Posted on August 22, 2011 by Josh Arrington

Limitations of technologies that are supposed to be protecting against emerging security vulnerabilities, deeper examinations of mainstream breaches and more painful insider attacks—they’re all a part of the next installment of our IT Security Rewind Series. Let’s take a look, shall we?

  • You Live, You Learn: Few attacks generated as much media coverage and buzz as the attack against RSA that occurred earlier this year. This video interview from ThreatPost with Uri Rivner of RSA breaks down the different aspects of the attack including the elevation of privileges that were used to the advantage of the hackers.  As Rivner explains, this breach directly exposes the limitations associated with a security strategy focused on perimeter protection, and not on the accessibility of the sensitive information and controls that can easily be manipulated from the inside of a system.
  • DAMn—Is this technology working?: A feature from Ericka Chickowski of Dark Reading finds that financial institutions are still struggling with insider threats and other security vulnerabilities despite investments in database activity monitoring tools. While DAM technology plays a critical role in protecting against SQL injections and exploits in database protocols and commands, its inherent limitation in providing for privileged user monitoring may play a key role in its apparent ineffectiveness.
  • Fast Food Diner on Network Crime: As IDG reported, a former IT worker at the U.S. subsidiary of Japanese drug-maker Shionogi, has pleaded guilty to effectively using his privileged access and controls to “create virtual chaos” by wiping out the VMWare host services that ran the company’s corporate email systems. Apparently, after laying off the employee, Jason Cornish,  Shionogi did a poor job of revoking passwords to the company’s network.  Using a Shionogi account, Cornish logged on from a public McDonald’s Internet connection to access a vSphere VMware management console that he’d secretly installed on the company’s network a few weeks earlier. He then proceeded to delete 88 company servers from the VMware host systems—further highlighting the need to control privileged users in both physical AND virtual environments.

That’s a wrap for this week—let us know what other stories you think should be added to the rewind.

2

Our Q&A with SysAdmin Appreciation Day Twitter Contest Winner: Thomas Deliduka of the Columbus Museum of Art (Ohio)

Posted on August 11, 2011 by Josh Arrington

As readers of our blog know, we recently crowned Thomas Deliduka as this year’s winner of Cyber-Ark’s SysAdmin Appreciation Day Twitter contest. Thomas beat out several other participants in a competitive contest by impressing the judges with his efficient and error-free Microsoft Exchange rollout for 100+ users. But since there’s only so much you can learn in 140 characters (or less) we thought it would be valuable to learn more about his “winning” achievement. Without further ado, here’s our Q&A with Thomas—we hope this not only shines some more light on the merits of his winning submission, but also provides some great insight for other SysAdmins out there who just may find themselves in a similar situation!

Cyber-Ark: Thomas, in addition to your new title as “SysAdmin Appreciation Day Twitter Contest Winner,” could you tell us a bit about your day job?

Thomas: I am the Director of Information Technology at the Columbus Museum of Art in Columbus, Ohio. It is probably the best job I have ever had, I get all the hands-on experience but also the responsibility of a department head.

Cyber-Ark: Although there were many great submissions and it was a tough decision for the judges, your Tweet/achievement immediately resonated with the judges and they were unanimously impressed. Can you tell us a little bit more about how you first approached the rollout?

Thomas: Once I was assigned the project in late 2010, I began researching what I actually needed to do to upgrade Exchange. At first, I just bookmarked some posts and then left it alone—it wasn’t until February when I purchased two new servers and realized I needed to start getting to work. Another resource that was helpful was this amazing blog post, which I’m not sure I could find anymore, that outlined how to run Exchange in legacy mode and then slowly move people over.

Cyber-Ark: And then the fun began?

Thomas: I got the first server OS installed and named it “xxxxxxx-01″ because it was going to be the first server. However, then I read further and find out I needed to install the CAS server first. In my mind, the CAS server should be server 2, so before I went too much further, I renamed the server and started installing the operating system on server 1.

I got the CAS server online the first day and it immediately integrated it with my 2003 environment—including allowing for the ActiveSync calls to come first to the Exchange 2010 server and then get routed to the 2003 server through the “legacy” DNS entry.

That was almost seamless, I was so surprised. None of my phone users noticed any changes at all.

On the second day, I finished the Mailbox server—I couldn’t wait to convert my own mailbox because I always experiment on myself.  So, I finished that, and again, ActiveSync connected just fine on my Android device and kept on humming.

Cyber-Ark: Once you had tested the migration on your own accounts, how did you approach the other users?

­­­­Thomas: Right away I started moving people who I knew were on vacation and out of the office—just about 10 mailboxes or so. I found that by bringing up Outlook after the migration of the mailbox, the system automatically updated to the new Exchange Server. That was surprising, but welcome, since I knew I wouldn’t have to visit every single user!

After that, it was smooth sailing. I told people to expect a mailbox migration over the new few days and that they shouldn’t notice any changes. I connected via VPN at night over the next few days and converted about 20 or 30 mailboxes at a time. The final group to convert was the Mac Users—we were using Microsoft Entourage 2008 on about five computers. When we needed to migrate their mailboxes, Entourage would no longer work so I had to install the updated Office 2011 before migrating their mailboxes, then immediately convert and connect so they would see no downtime.

That was fine for four of the users, but there was one who decided he simply couldn’t have me messing with his computer for at least another four days. So, I migrated his mailbox and taught him how to use the new Webmail with Exchange 2010.

The day I migrated the last mailbox, I went ahead and separated the 2003 server and shut it down!  From start to finish it was a little less than two weeks but it’s easier to say two weeks.

Cyber-Ark: Any additional information you learned from all this?

Thomas: One issue you could say I had was that Microsoft doesn’t allow Domain Admins to sync e-mail through ActiveSync. There is an inherent value within Active Directory that when it is not set–ActiveSync doesn’t work. As a Domain Admin, it’s automatically turned off. This experience forced me to do the proper “best practice” of removing myself as a domain admin and using another account for super-user operations. I don’t really count this as a problem because it only affected me.  I hope that doesn’t disqualify me!

Cyber-Ark: Absolutely not. Congrats again on a smooth and successful migration! Any parting words?

Thomas: I have to hand it to Microsoft, they really did make it easy. We haven’t had any routing issues, in fact mail-flow is much better. Smart phones work just fine, everything is amazing.

If you’d like to reach Thomas to congratulate him—or to learn more about his story—feel free to contact him on your preferred social network:

Twitter: @Tomnibus

LinkedIn: http://www.linkedin.com/in/deliduka

Google+: https://plus.google.com/107360993311566660432/posts

As readers of our blog know, we recently crowned Thomas Deliduka as this year’s winner of Cyber-Ark’s SysAdmin Appreciation Day Twitter contest. Thomas beat out several other participants in a competitive contest by impressing the judges with his efficient and error-free Microsoft Exchange rollout for 100+ users. But since there’s only so much you can learn in 140 characters (or less) we thought it would be valuable to learn more about his “winning” achievement. Without further ado, here’s our Q&A with Thomas—we hope this not only shines some more light on the merits of his winning submission, but also provides some great insight for other SysAdmins out there who just may find themselves in a similar situation!

Cyber-Ark: Thomas, in addition to your new title as “SysAdmin Appreciation Day Twitter Contest Winner,” could you tell us a bit about your day job?

Thomas: I am the Director of Information Technology at the Columbus Museum of Art in Columbus, Ohio. It is probably the best job I have ever had, I get all the hands-on experience but also the responsibility of a department head.

Cyber-Ark: Although there were many great submissions and it was a tough decision for the judges, your Tweet/achievement immediately resonated with the judges and they were unanimously impressed. Can you tell us a little bit more about how you first approached the rollout?

Thomas: Once I was assigned the project in late 2010, I began researching what I actually needed to do to upgrade Exchange. At first, I just bookmarked some posts and then left it alone—it wasn’t until February when I purchased two new servers and realized I needed to start getting to work. Another resource that was helpful was this amazing blog post, which I’m not sure I could find anymore, that outlined how to run Exchange in legacy mode and then slowly move people over.

Cyber-Ark: And then the fun began?

Thomas: I got the first server OS installed and named it “xxxxxxx-01″ because it was going to be the first server. However, then I read further and find out I needed to install the CAS server first. In my mind, the CAS server should be server 2, so before I went too much further, I renamed the server and started installing the operating system on server 1.

I got the CAS server online the first day and it immediately integrated it with my 2003 environment—including allowing for the ActiveSync calls to come first to the Exchange 2010 server and then get routed to the 2003 server through the “legacy” DNS entry.

That was almost seamless, I was so surprised. None of my phone users noticed any changes at all.

­­

On the second day, I finished the Mailbox server—I couldn’t wait to convert my own mailbox because I always experiment on myself.  So, I finished that, and again, ActiveSync connected just fine on my Android device and kept on humming.

Cyber-Ark: Once you had tested the migration on your own accounts, how did you approach the other users?

­­­­Thomas: Right away I started moving people who I knew were on vacation and out of the office—just about 10 mailboxes or so. I found that by bringing up Outlook after the migration of the mailbox, the system automatically updated to the new Exchange Server. That was surprising, but welcome, since I knew I wouldn’t have to visit every single user!

After that, it was smooth sailing. I told people to expect a mailbox migration over the new few days and that they shouldn’t notice any changes. I connected via VPN at night over the next few days and converted about 20 or 30 mailboxes at a time. The final group to convert was the Mac Users—we were using Microsoft Entourage 2008 on about five computers. When we needed to migrate their mailboxes, Entourage would no longer work so I had to install the updated Office 2011 before migrating their mailboxes, then immediately convert and connect so they would see no downtime.

That was fine for four of the users, but there was one who decided he simply couldn’t have me messing with his computer for at least another four days. So, I migrated his mailbox and taught him how to use the new Webmail with Exchange 2010.

The day I migrated the last mailbox, I went ahead and separated the 2003 server and shut it down!  From start to finish it was a little less than two weeks but it’s easier to say two weeks.

Cyber-Ark: Any additional information you learned from all this?

Thomas: One issue you could say I had was that Microsoft doesn’t allow Domain Admins to sync e-mail through ActiveSync. There is an inherent value within Active Directory that when it is not set–ActiveSync doesn’t work. As a Domain Admin, it’s automatically turned off. This experience forced me to do the proper “best practice” of removing myself as a domain admin and using another account for super-user operatio

As readers of our blog know, we recently crowned Thomas Deliduka as this year’s winner of Cyber-Ark’s SysAdmin Appreciation Day Twitter contest. Thomas beat out several other participants in a competitive contest by impressing the judges with his efficient and error-free Microsoft Exchange rollout for 100+ users. But since there’s only so much you can learn in 140 characters (or less) we thought it would be valuable to learn more about his “winning” achievement. Without further ado, here’s our Q&A with Thomas—we hope this not only shines some more light on the merits of his winning submission, but also provides some great insight for other SysAdmins out there who just may find themselves in a similar situation!

Cyber-Ark: Thomas, in addition to your new title as “SysAdmin Appreciation Day Twitter Contest Winner,” could you tell us a bit about your day job?

Thomas: I am the Director of Information Technology at the Columbus Museum of Art in Columbus, Ohio. It is probably the best job I have ever had, I get all the hands-on experience but also the responsibility of a department head.

Cyber-Ark: Although there were many great submissions and it was a tough decision for the judges, your Tweet/achievement immediately resonated with the judges and they were unanimously impressed. Can you tell us a little bit more about how you first approached the rollout?

Thomas: Once I was assigned the project in late 2010, I began researching what I actually needed to do to upgrade Exchange. At first, I just bookmarked some posts and then left it alone—it wasn’t until February when I purchased two new servers and realized I needed to start getting to work. Another resource that was helpful was this amazing blog post, which I’m not sure I could find anymore, that outlined how to run Exchange in legacy mode and then slowly move people over.

Cyber-Ark: And then the fun began?

Thomas: I got the first server OS installed and named it “xxxxxxx-01″ because it was going to be the first server. However, then I read further and find out I needed to install the CAS server first. In my mind, the CAS server should be server 2, so before I went too much further, I renamed the server and started installing the operating system on server 1.

I got the CAS server online the first day and it immediately integrated it with my 2003 environment—including allowing for the ActiveSync calls to come first to the Exchange 2010 server and then get routed to the 2003 server through the “legacy” DNS entry.

That was almost seamless, I was so surprised. None of my phone users noticed any changes at all.

On the second day, I finished the Mailbox server—I couldn’t wait to convert my own mailbox because I always experiment on myself.  So, I finished that, and again, ActiveSync connected just fine on my Android device and kept on humming.

Cyber-Ark: Once you had tested the migration on your own accounts, how did you approach the other users?

­­­­Thomas: Right away I started moving people who I knew were on vacation and out of the office—just about 10 mailboxes or so. I found that by bringing up Outlook after the migration of the mailbox, the system automatically updated to the new Exchange Server. That was surprising, but welcome, since I knew I wouldn’t have to visit every single user!

After that, it was smooth sailing. I told people to expect a mailbox migration over the new few days and that they shouldn’t notice any changes. I connected via VPN at night over the next few days and converted about 20 or 30 mailboxes at a time. The final group to convert was the Mac Users—we were using Microsoft Entourage 2008 on about five computers. When we needed to migrate their mailboxes, Entourage would no longer work so I had to install the updated Office 2011 before migrating their mailboxes, then immediately convert and connect so they would see no downtime.

That was fine for four of the users, but there was one who decided he simply couldn’t have me messing with his computer for at least another four days. So, I migrated his mailbox and taught him how to use the new Webmail with Exchange 2010.

The day I migrated the last mailbox, I went ahead and separated the 2003 server and shut it down!  From start to finish it was a little less than two weeks but it’s easier to say two weeks.

Cyber-Ark: Any additional information you learned from all this?

Thomas: One issue you could say I had was that Microsoft doesn’t allow Domain Admins to sync e-mail through ActiveSync. There is an inherent value within Active Directory that when it is not set–ActiveSync doesn’t work. As a Domain Admin, it’s automatically turned off. This experience forced me to do the proper “best practice” of removing myself as a domain admin and using another account for super-user operations. I don’t really count this as a problem because it only affected me.  I hope that doesn’t disqualify me!

Cyber-Ark: Absolutely not. Congrats again on a smooth and successful migration! Any parting words?

Thomas: I have to hand it to Microsoft, they really did make it easy. We haven’t had any routing issues, in fact mail-flow is much better. Smart phones work just fine, everything is amazing.

If you’d like to reach Thomas to congratulate him—or to learn more about his story—feel free to contact him on your preferred social network:

Twitter: @Tomnibus

LinkedIn: http://www.linkedin.com/in/deliduka

Google+: https://plus.google.com/107360993311566660432/posts

ns. I don’t really count this as a problem because it only affected me.  I hope that doesn’t disqualify me!

Cyber-Ark: Absolutely not. Congrats again on a smooth and successful migration! Any parting words?

Thomas: I have to hand it to Microsoft, they really did make it easy. We haven’t had any routing issues, in fact mail-flow is much better. Smart phones work just fine, everything is amazing.

If you’d like to reach Thomas to congratulate him—or to learn more about his story—feel free to contact him on your preferred social network:

Twitter: @Tomnibus

LinkedIn: http://www.linkedin.com/in/deliduka

Google+: https://plus.google.com/107360993311566660432/posts

0

Black Hat Conference USA 2011 – According to the Twitterverse

Posted on August 8, 2011 by Josh Arrington

The Black Hat Conference (#Blackhat) has established itself as one of the technology industry’s leading events for the security elite.  More than just a hacker conference, many of this year’s presentations were equally as eye-opening for the C-Suite, especially in terms of raising awareness of lesser-known enterprise vulnerabilities that pose significant risk.

While Cyber-Ark didn’t attend the event, many of our customers and partners did, so we paid close attention to the buzz surrounding the event.  From SCADA systems and exploding batteries to Shady RAT, following are some of our favorite tweets that captured top stories from the event.

@buzzblog: New post: Scariest Black Hat story so far: Power plants at risk networkworld.com/community/blog… #Siemens

@KimZetter: Hardcoded Password and Other Security Holes Found in Siemens Control Systems – http://t.co/39ss0UR

@josphmenn: My reg req’d story based on scary #BlackHat presentations, etc: Utilities warned that many PLCs open to Internet hacks. http://t.co/1k7G1U8

@mathewjschwartz: China Suspected Of Shady RAT Attacks — InformationWeek #li #infosec #blackhat http://t.co/xfdnbhx

@SCMagazine: Black Hat: Insulin pumps can be hacked http://dlvr.it/dvG6c

@zdnetaustralia: A security threat has emerged and it comes from an unexpected source: laptop batteries http://bit.ly/r30tkR

@ryanarine: Microsoft’s BlueHat Prize: A new twist on security research incentives http://zd.net/q84Sf0

@CNNTech: Hacker shuts down Apple MacBook battery — and can do so remotely: http://t.co/QLMnAu7 by @jdsutter at #blackhat

And one of the event wrap-ups worth reading from @SecurityWeek: Black Hat Wrap Up: What Created the Most Buzz? bit.ly/p8qSZI #blackhat #defcon #infosec

What are your picks for top stories coming out of Black Hat?

0

Cyber-Ark Announces This Year’s Big Winner of the SysAdmin Appreciation Day Twitter Contest

Posted on August 1, 2011 by Josh Arrington

Today, July 29, 2011, marked another excellent SysAdmin Appreciation Day and the Cyber-Ark team is thrilled to have played a role in recognizing the efforts of these IT rock stars. As you know, on Monday, we kicked off our 2nd Annual System Administrator Appreciation Day Contest by asking participants to answer this simple question over Twitter: “What is your greatest enterprise IT accomplishment in the past year?”

As the responses rolled in, our esteemed judges, Standalone SysAdmin’s Matt Simmons, Cyber-Ark’s Bill Pesiridis, and the NubbyAdmin’s Wesley David, analyzed their merits and began to formulate their thoughts on who should be crowned the “winner.” While the judges determined that there were some truly exceptional responses, and that all of the achievements deserved recognition (more on that later), one stood out from the pack.

Without further ado, on behalf of our judges, we would like to formally declare Thomas Deliduka, aka @Tomnibus, as this year’s winner! Here’s the winning Tweet:

@tomnibus “@CyberArk Greatest Accomplishment: upgraded Exchange 2003->2010 on my own for 100+ users, two weeks start to finish, no hiccups #SysAdminDay”

The judges agreed that this was a significant achievement. For Wesley, Thomas’s response marked a serious accomplishment. An Exchange 2003-2010 rollout is no easy task, you can read more about that type of migration here, and he was impressed with the speed and efficiency. For Matt—the complexity of this type of project stood out from the pack. Bill concurred—he’s actually tackled the project himself and agrees that it is a daunting task. E-mail is a critical application for the end-user, and it can be very difficult to find the downtime to pull this migration off.

So there you have it once again—congrats Thomas! You’ll be hearing more from @Cyberark as you are soon to be the proud recipient of our grand prize—an Amazon Kindle.

But wait, there’s more. Wesley, Matt and Bill would like to recognize the efforts of the other participants who they deemed “honorable mentions”, as this was a very close competition. Check back next week for a new blog post that details their thought process when selecting the winner and these “finalists”—and stay tuned, especially, if you were a participant. We’ll be reaching out to you to learn more about your achievements. After all, in Matt’s words, while Thomas’ achievement was very impressive, “we could select any of these responses justifiably.” So great job participants—in true recognition of SysAdminDay, you provided us with some excellent insights into the great work you do on a daily basis. You truly deserve even more than just a day of celebration!

Pages ... 1 2 3 4 5 6