Tuesday, January 20, 2015

Securing mobile devices when they are off the corporate network


With the recent surge in high profile security breaches of the last eighteen months, all businesses regardless of size must have security in the forefront of their IT strategic plan.  Security has become more important than ever before.  It has also become more complicated than ever before.  Never before has corporate data been under attack from so many different vectors.  The days of securing the perimeter of your corporate network and calling it a day are over.  With the ever increasing mobile workforce accessing data from anywhere at anytime, how can security keep up?

There are too many touch points to critical data from multiple avenues to continue to apply the principals of old.  In the past, a company would invest its security spend on the best perimeter firewall they could find.  They would then create a rule base that kept the bad guys out, and tried to keep the good guys in.  But now, with more and more access coming in over cellular networks, free wifi hotspots, and employee’s home broadband connections, the old perimeter firewall isn’t enough.  It can’t provide security on networks that it doesn’t exist on. 

Its happened all too often.  An employee accesses critical data on their device.  That data gets cached in the web browser, or in an app, or on the storage.  Later that day, they click a link in an email from a friend, install a game from the app store, or even visit a hacked Facebook account.  With that action, mobile malware is downloaded and installed on the device.  That corporate data is now being sent back to the malware’s creator to be sold on the black market.  There are literally thousands of ways to get malware installed and running on a mobile device.  Without the protection of the company’s enterprise firewall on these networks, the company’s data, as well as the end users personal data, is at extreme risk.

How do we protect these mobile devices, whether they are laptops, tablets, phones, phablets, or even watches?  We need a solution that applies the enterprise security policy on these devices no matter what network they are connected to.  We need a solution that is unobtrusive to the end user and that doesn’t affect that end user’s device experience.  We need a solution that doesn’t create yet another complicated management interface for IT to administer. 

It must be seamless.  It must be secure.  It must be fast. 

Capsule Cloud by Check Point delivers on all three.

How does it work?

Capsule Cloud tunnels all of the mobile device’s traffic through a cloud based enterprise security system.  The system is able to enforce the enterprise security policy on that traffic no matter where the device is on the Internet.  With Check Point Capsule cloud, your end users receive all the industry leading protections available on the Check Point platform including:  Anti-Bot, Anti-Virus, Data Leakage Protection (DLP), Threat Prevention, IPS, as well as URL Filtering and Application Control.

Check Point has multiple data centers all around the globe to ensure the best possible user experience.   If your business utilizes Check Point gateways or management products already, you can utilize those tools to push the same policy that’s on your enterprise gateways to the Capsule Cloud service.

Capsule Cloud is a cloud based security system that is delivered via a SaaS methodology.  Capsule Cloud utilizes a user based licensing model.  This allows Capsule to secure multiple devices per user, all under a single user license.   Today Capsule cloud supports all of the major mobile devices.  There are clients for Mac OSX, Windows, iOS, and Android.

Thursday, September 25, 2014

CVE-2014-6271: Vulnerability in Bash

There is a great diary article at the Internet Storm Center over at SANS on the ShellShock vulnerability.  It's located here. 

This is a code injection hack that affects bash running on all *nix systems.  This allows an attacker to execute code via passing of environment variables into bash.  The largest vector that needs to be secured immediately are web servers utilizing CGI-BIN.  CGI-BIN requires http headers supplied by the webserver be converted into environment variables.

There are a couple of other less likely vectors that involve SSH and DHCP.

There is a patch available from most vendors, however the current patch is only a partial fix.  According to many confirmed tests users are still able to utilize the hack to write empty files to the host's file system. 

If you were utilizing Network Storage's Managed Firewall Service, you would already be protected from this vulnerability.

Wednesday, September 24, 2014

Adding Data Domain Support to vSphere Data Protection Advanced (VDPA)

This post covers the step by step procedure required to add Data Domain to your vSphere Data Protection Advanced (VDPA) installation.  Data Domain Support requires VDP Advanced licensing, and is not available in the free vSphere Data Protection product as of 5.8.

The vSphere Data Protection Advanced 5.8 Admin Guide is here.

Prerequisites
  • vSphere 5.5+
  • vCenter 5.5+
  • VDPA 5 license for the number of sockets in your cluster
  • DataDomain Connection info (DDBoost User, Pass, SNMP community string)
  • DNS Entry with Reverse PTR for the VDPA Appliance


Step 1 - Install vSphere Data Protection Appliance
 
   Go to https://my.vmware.com, and download the vSphere Data Protection 5.8 appliance files.  Its close to 5GB in size, so allot time for the download.  Once you have the OVA file downloaded, go to the vSphere Web Client, and deploy the virtual Appliance.  Be sure to enter in the correct network information as part of the OVF deployment wizard.

Step 2 - Initial Configuration of the VDP Appliance

Access the VDP Appliance at https://<IP of VDP>:5438/vdp-configure
Login in as root, with an initial password of "changeme"
Roll through the initial configuration wizard.  Create a basic VDP appliance, give it space on a data store, and install your VDPA license.  Once the wizard completes, the device will reboot.  This can take up to 30 minutes to come back up as it runs through its post config process.

Step 3 - Create the DD Storage Connection

Access the VDP Appliance again at https://<IP of VDP>:5438/vdp-configure
Login as root, and use the password you specified in the wizard.
Click on "Storage"
Click on the settings gear on the top right
Click on "Add Data Domain"
Then specify your Data Domain connection information.

Be sure that "Enable Checkpoint Copy" is checked.  Click Next
Verify that you enter the correct read only SNMP community for your Data Domain System.
Click Next.
Click Finish.

You have successfully added your Data Domain to your VDPA instance.  Now lets setup a backup job using the DD.

Step 4 - Adding the DD to a backup job.

Log into your VC Web client at https://<your vc ip>:9443/  (9443 is the default port.)
Click on vSphere Data Protection on the left.
Select your appliance and click Connect.
Create your backup job as you normally would, setting targets, schedule, and retention.  On the destinations selection, choose Data Domain.
Run your backups, and you are all set!

Andrew
@indylinux