Exchange

Jul 27 2009   11:26AM GMT

Cisco 2009 Midyear Security Report is out

Posted by: Yasir Irfan
Cisco Systems, webcast, Cisco 2009 Midyear Security Report, Security report, Security, Cisco Security, Security events, Cisco TV, Cisco Web Cast, Mid year security report, Cisco Security experts, Conficker worm, Cybercriminals, spammers, President Barack Obama, Center for Strategic and International Studies, John N. Stewart, Botnets, SPAM, Worms, Spamdexing, Text message scams, Insiders, cybersecurity

According to the Cisco 2009 Midyear Security Report , the Conficker worm is still active and affecting thousands of Systems daily.  Just to recap the Conficker worm began infecting the Systems in late 2008 and still an active worm.

Pic Courtesy:Cisco Systems

 

 Cisco Systems released the Cisco 2009 Midyear Security Report on 14^th of July 2009 and the report highlights some of the most common technical and business strategies that Internet  criminals used to breach corporate networks compromise Web sites and steal personnel information.

The highlights of the Cisco 2009 Midyear Security Report is as follows

• The Conficker worm, which began infecting computer systems late last year by exploiting a Windows operating system vulnerability, continues to spread. Several million computer systems were under Conficker’s control as of June 2009.
• Online criminals are up on current events and making the most of them. After the outbreak of H1N1 influenza (”swine flu”) in April, cybercriminals quickly blanketed the Web with spam that advertised preventive drugs and linked to fake pharmacies. Cybercriminals will often seize on major news events to launch this type of attack.  While many spammers continue to operate with extremely high volumes, some are opting for lower-volume but more frequent attacks in an effort to remain under the radar.
• President Barack Obama has made strengthening U.S. cybersecurity a high priority for his administration and looks to work with the international community and the private sector to leverage technology innovations to reduce cybercrime. This focus is expected to have a significant positive impact for the industry in the coming months. John N. Stewart, Cisco’s chief security officer and a contributor to the Center for Strategic and International Studies (CSIS) report for the Obama administration, provided additional insight in a recent blog and video blog post.

Continued »

Mar 29 2009   5:14AM GMT

Cisco brings security to life with animated characters -Watch Second Eposide

Posted by: Yasir Irfan
Cisco, comics, Terminator, The Realm, online comic, Botnets, Malware, SPAM, intruders, Cisco animation, Cisco Comics, cisco engineers

Dear friends in my post on March 9^th I was talking about the ‘The Realm.”, now the second episode is available you can watch this and just relax watching the latest security threats in the animated format.

Mar 9 2009   6:31AM GMT

Cisco brings security to life with animated characters

Posted by: Yasir Irfan
Cisco, comics, Terminator, The Realm, online comic, Botnets, Malware, SPAM, intruders, Cisco animation, Cisco Comics, cisco engineers

Cisco has appointed a select group of Cisco Engineers to develop a state-of-the-art security force. ‘The Realm.” growing beyond the systems in which they were created into a group of powerful defenders. Forming a unified league of security, the defenders battle Botnets, Malware, Spam and Intruders in the Realm, assuring the safety and security of every citizen on the human network.

‘The Realm.”is an online comic that animates the pane flow and adds voice narration. Creatively it’s an engaging experience, not as complete as a full scale animation but more alive that just a flat 2D image.

Visit http://www.cisco.com/go/realm to learn more.

Dec 24 2008   12:07PM GMT

90% of email is spam according to Cisco Annual Security report 2008

Posted by: Yasir Irfan
SPAM, Cisco News, Cisco Annual Security Report 2008, ITP Middle East

According to the Cisco Annual Security Report 2008, Spam accounts nearly 200 billion messages per day or approximately 90% of all email worldwide. 

The report highlights the security threats and trends; the most disturbing fact is more online criminals are using real email accounts with legitimate web mail providers to bombard the emails with spam. This method, known as ‘reputation hijacking’, makes spam harder to detect and block.

According to Cisco estimates, spam resulting from email reputation hijacking of the top three web mail providers accounted for less than 1% of all spam worldwide, but made up 7.6% of the providers’ mail traffic.

Additionally, researchers have seen a 90% growth in threats originating from legitimate domains, doubling 2007 figures. For rest of the story please check the article published by ITP Middle East.

Jul 13 2008   6:03AM GMT

Sample I.T. Security Policy - Internet Security

Posted by: Yasir Irfan
Networking, Security, Servers, Microsoft Windows, Linux, Switches, Cisco, Routers, Policies, Mobile, Internet Security, Network Documentation, Exchange, Network Documentation Policy, Network Policies

Finally we are completing this series; here we go with the last topic. It’s Internet Security Policy which is very important to have for any organization. I would welcome your comments which may encourage me to come up with more interesting stuff.

 

 

INTERNET POLICY

 

“IS” CONSIDERED THE FOLLOWING:

1. Dedicate a firewall device. Don’t run other services on it, and disable all unnecessary service features that may be included in the firewall package.

2. Disallow all connection attempts to hosts inside the network. Allowing any inbound connections provides a mechanism hackers might be able to exploit to establish connections to Trojan horses or by exploiting bugs in service software.

3. Divide provided services using Internet tools into public services and private (organizational) services. Place the public services on an Internet site (or sites) external to the Internet firewall and provide the private services on an intranet site (or sites) on the protected LAN.

4. Do not rely upon packet filtering alone to protect the network.

5. Do not rely upon Windows ISA Server built-in filtering alone to protect the network.

6. Do not use simple packet filtering or packet-filtering services from the Internet service provider as a replacement for application-layer firewalls. They are not as secure.

7. Don’t rely solely on packet filters for security protection from the Internet. Drop all external routing protocol (EIGRP) updates bound for internal routers. No one outside the network should be transmitting RIP updates to internal routers.

8. Filter out and do not respond to ICMP redirect and echo (ping) messages.

9. Limit the number of external hosts allowed to connect through the firewall to the absolute minimum possible. Take measures to make sure the IP addresses of those hosts are difficult to determine using proxy servers, Firewall or IP masquerades.

10. Make sure there’s no way for a hacker to tell which firewall product is in use.

11. Never publish a list of user or employee names on the Web site. Publish job titles instead.

12. Reduce the number of connections to the Internet to the minimum number possible: one per campus. Many large organizations allow only a single link to the Internet at headquarters and then route all remote offices to that point using the same frame relay lines used to connect internal networks. Respond immediately to intrusion attempts when they are detected. Collect as much information about the attacker as possible. Use their IP domains to determine who the higher-level service providers are.

13. Set up the firewall to discard ICMP echo and to redirect messages to interior hosts.

14. Unbind NetBIOS from all servers outside the firewall. Set the TCP/IP stacks on those machines to accept connection only on ports for services that machine specifically provides.

15. If there is only one connection to the Internet, hard code that connection in the router connected to the service provider’s network. Use RIP, EIGR, OSPF or other automated routing protocols to manage routing inside the network.

16. Do not allow SNMP to travel into or out of the network.

17. Use operating system software on Internet accessible machines that are not susceptible to the Ping of Death.

18. Configure the gateway not to pass Ping packets.

19. Install the latest version of the operating system software.

20. Log network activity and to have the log software signal an alert when a SYN attack or and ICMP flood is in progress. Deny access to the computer or network that originates the attack, and take measures (such as calling or sending an Email message to the administrator of the offending network) to stop the malicious behavior.

21. Un-bind NetBIOS from Internet-accessible network adapters. Allow only authorized hosts outside the network to connect to the DNS servers.

22. Configure the gateway or packet filter to discard all IP packets that use the source routing feature.

23. Disallow services for which there are no proxy servers.

24. Do not allow clear text-password authentication.

25. Do not use RIP or other automated routing protocols. Statically assign the routing tables and disable RIP updates unless the network is too large to manage manually. This makes them impervious to RIP -based denial-of service or spoofing attacks.

26. Don’t allow dial-up connections to the Internet. Remove modems and all other uncontrolled network access devices. Disable free COM ports in the BIOS settings of client computers and password protect the BIOS to prevent users from overriding the security settings.

27. Drop all packets that are TCP source routed. Source routing is rarely used for legitimate purposes.

Log all public access to servers, and check the logs often. Use alerting software to detect hacking attempts against the exposed machines.

28. Set up monitoring software that can alert on flood attacks against the network. Record the IP addresses of the source computers (assuming they look valid) and try to determine the source of the attacks so legal measures can be taken to stop the problem.

29. Set up the own firewall. Place Web and FTP servers outside it and mail servers on the inside. Pass only SMTP and POP3 traffic from external sources. Run no other services or software on mail, Web, FTP, or firewall servers.

30. Use a port scanner periodically (about once a month) from outside the network to check the status of the firewall, packet filter, and NetBIOS bindings. This is especially important when servers are maintained by more than one person or when retaining outsourced security services.

31. Use high-level proxies capable of stripping executable content like ActiveX and Java from Web pages.

32. Use IP masquerades to hide the identity of hosts inside the network.

33. Whenever possible, use proxy servers for all application protocols.

34. Use IP address assignment, in combination with an internal firewall and IP selection on servers, to further control and partition the access allowed to remote users.

35. Use a Web and FTP hosting service rather than computers on the own network to provide the customers with information about the Organization. This puts the Web hosting agency at risk rather than the own network, and allows the provision of no public services from internal servers.

36. As a part of security training, make sure users know to report all instances of denial of service whether they seem important or not. If a specific denial of service can’t be correlate to known downtime or heavy usage, or if a large number of service denials occur in a short time, a siege may be in progress.

37. Great care must be taken when downloading information and files from the internet to safeguard against both malicious code and also inappropriate material.

38. Avoid using one of the smaller Internet service providers. Hackers frequently target them as potential employers because they often have less security awareness and may use UNIX computers, rather than dedicated machines, as gateways and firewalls-making spoof attacks easy to perpetrate. Ask the service provider if they perform background checks on technical service personnel, and reject those that say they do not.

39. Consider using the disconnected Internet security model if the services required by the users can be made available from a single machine.

40. Manually assigning IP addresses if the Organization is a potential espionage target.

41. Apply the anti-spoofing filter.

42. Plans are to be prepared maintained and regularly tested to ensure that damage done by possible external cyber crime attacks can be minimized and that restoration takes place as quickly as possible.

43. In order to reduce the incidence and possibility of internal attacks, access control standards and data classification standards are to be periodically reviewed whilst maintained at all times.

44. Contingency plans for a denial service attack are to be maintained and periodically tested to ensure adequacy

45. Procedures to deal with hoax virus warnings are to be implemented and maintained.

46. Antivirus software is to be deployed across all PCs with regular virus defining updates and scanning across servers, PCs and laptop computers.

47. E-commerce processing systems including the e-commerce Web site(s) are to be designed with protection from malicious attack given the highest priority.

48. E-commerce related Web Site(s) and their associated systems are to be secured using a combination of technology to prevent and detect intrusion together with robust procedures using dual control, where manual interaction is required.

49. Personnel should understand the rights granted to them by the Organization in respect of privacy in personal e-mail transmitted across the Organization systems and networks. Human Resources Department should incorporate a suitable wording into employee contracts to ensure that this privacy issue is fully understood.

50. Confidential and sensitive information should not be transmitted by-mail unless it is secured through encryption or other secure means.

51. E-mail should be considered as an insecure communications medium for the purposes of legal retention for record purposes. With the usage of digital signatures and encryption, reliance upon e-mail may soon be available; however, if in any doubt, treat e-mail as transient.

52. External e-mail messages should have appropriate signature footers and disclaimers appended (E-mail Signature File). A disclaimer is particularly important where, through a miss-key, the email is sent to an inappropriate person. The disclaimer should confirm the confidential nature of the email and request its deletion if the addressee is not, in fact, the intended recipient.

53. Personnel should not open e-mails or attached files without ensuring that the content appears genuine. If you are not expecting to receive the message or are not absolutely certain about its source do not open it.

54. Personnel should be familiar with general e-mail good practice e.g. the need to save, store and file e-mail with business content in a similar manner to the storage of letters and other traditional mail. E -mails of little or no organizational value should on the other hand be regularly purged or deleted from your system.

55. Use standard TEXT (ASCII) messages where possible; these are both smaller (in terms of file size) and are less able to ‘hide’ executable code e.g. HTML based e-mails which can ‘run’ upon opening.

56. The sending of inappropriate messages should be prohibited including those which are sexually harassing or offensive to others on the grounds of race, religion or gender.

Jul 5 2008   6:35AM GMT

Sample I.T Security Policy - Data Security

Posted by: Yasir Irfan
Networking, Security, Microsoft Windows, Linux, Switches, Routers, DataCenter, Data Security, Exchange, Backup, Network Documentation Policy, Network Policies

As we are proceeding ahead, and we have two more topics to be covered to complete this Sample I.T Security Policy, hope fully it will be good and useful to you all. I would like to have some comments which may boost my morale to take up more interesting things in future. Here we are with Data Security.

DATA SECURITY

“IS” CONSIDERED THE FOLLOWING:

1. Create a strong backup & Disaster recovery strategy and test backups regularly.
2. Create separate partitions for the Windows System files and the volume the server will share. Then don’t share the system boot partition, share only the empty volume created for file storage.
3. Implement strong permission-based security for all files stored on the server.
4. Never use the FAT file system on the hard disk of a Windows computer when security is a concern.
5. Remove default assignments to the everyone group.
6. Repair damaged drives in mirror or stripe sets as soon as possible.
7. Store backup tapes in a waterproof, flameproof safe in the server room. If tapes must be moved off site, be certain security measures are in place to prevent their being compromised while off site.
8. Use disk mirroring or duplexing for critical data. Use duplexing when possible.
9. Consider using hardware RAID, which is faster and is independent of the operating system.
10. Consider using SAN for huge amount of data.
11. If the server’s physical security could be compromised in any way, and the data on the disk warrants protection, use file system encryption.
12. Use file system encryption to protect sensitive data when operating system features are not effective (when the hard drive has been removed or the operating system has been replaced).
13. For extreme fault tolerance, consider using a third -party server replication system.
14. Access to information and documents is to be carefully controlled; ensuring that only authorized personnel may have access to sensitive information.
15. With poor or inadequate access control over your documents and files, information may be copied or modified by unauthorized persons, or become corrupted unintentionally or maliciously.
16. High risk systems require more stringent access control safeguards due to the confidentiality of the information that process and / or the purpose of the system e.g. the funds transfer used by banks. Ideally, the operating systems for such systems should be hardened for further enhance security.
17. Properly mark proprietary and confidential documents. The confidential markings can be minimized if they are seen on routine documents. Mark only proprietary documents, not everything.
18. Track printouts from any computer. Have confidential and proprietary markings automatically put on every printed proprietary document.
19. Limit access to source code; limit physical access to documents.
20. Access to data and information is at the heart of every set of Information Security Policies. Inappropriate access to data may contravene Organization policy and infringe legal regulations.
21. The right to access systems and data is based upon identified and approved business needs and should be withdrawn when the need ceases.
22. Denying unauthorized person’s access, both physical and logical, to the Organist ion systems is part of an effective Information Security process. Physical access to the data centre or computer room’ should always be restricted to authorized persons only.
23. However, data access goes beyond access to PCs and servers; it also includes access to written and printed information on the desks of personnel, notes pinned to notice boards etc. Access to such information must also be controlled. Traditionally, door locks and keys ensured security; nowadays, even greater security can be provided by electronic keys, biometrics with the additional benefit that they may also monitor and record access attempts.
24. Where user’s access rights and privileges are not documented, information security may be compromised.

Yasir
Personel Website:www.yasirirfan.com