Threat Level: green Handler on Duty: Chris Mohan

SANS ISC InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

SQL Slammer Clean-up: Switching Viewpoints

Published: 2010-10-25
Last Updated: 2010-10-25 19:39:54 UTC
by Kevin Liston (Version: 1)
0 comment(s)

As you've been going through this exercise (http://isc.sans.edu/diary.html?storyid=9664, http://isc.sans.edu/diary.html?storyid=9712, http://isc.sans.edu/diary.html?storyid=9778) you have certainly run into the issue of bad WHOIS contact information, and have likely had bad/no response from the abuse contacts. Hasn't that been frustrating?

Today we put the shoe on the other foot, and take steps to make sure that others don't suffer from our own WHOIS records and abuse-handling processes.

Look up your own net-block(s). Do you have an abuse contact defined? Are the email addresses AND the phone numbers appropriate? If someone sends an email to your abuse address will it be read by a human? If someone calls the phone number will they be able to reach a security/computer person?

Are you RFC 2142 (http://www.ietf.org/rfc/rfc2142.txt) compliant? Most aren't fully compliant (for example I don't think we use noc@the-day.job.)

I just did a quick audit myself. Though mergers and acquisition we have a hand-full of net-blocks. They all don't point to the same domains, but they all have abuse contact records and the owner block is correct. We also route all abuse@* to the same work-flow. So, I would consider that a pass. On the other hand, the phone numbers all reach the main switchboard. Getting routed to the right security contact was challenging, so I would recommend that we update that number.

Keywords: slammercleanup
0 comment(s)

Cyber Security Awareness Month - Day 25 - Using Home Computers for Work

Published: 2010-10-25
Last Updated: 2010-10-25 16:36:00 UTC
by Kevin Shortt (Version: 1)
6 comment(s)

Today's CSAM topic is Using Home Computers for Work.  I will share with you a simple practice I've been using for quite some time that provides me a couple key protections from myself while keeping me and my employer safe from mingling home equipment with the corporate equipment.

It is common for many people to have company issued laptops, so the mileage may vary on my suggestion.  However, for those who do not use an issued laptop to access the company network and are left to using home equipment to accomplish work for your employer I highly suggest using a some sort of virutal machine software and utilize all access to the corporate network through the inside of that machine.   
 
My home setup for connecting to work consists of our family computer, an iMac (behind a firewall of course) with a VMWare Fusion machine consisting of a basic XP installation that has been fully patched, updated Anti-Virus and any basic software required for connectivity to the company resources. I.e. VPN software, SSH Clients, etc...  Once this VM has been setup, I save a snapshot of it.  When Patch Tuesday rolls by, I update everything and take another snapshot. Most anti-virus can be configured to update when it boots up, and at a minimum I update the image monthly, but sometimes more if I am ambitious.  When I need to use the home computer to connect to work, I fire up my VM and utilize the VM environment for all connectivity to work.  When I have completed my session for work, I power down the VM and rollback to my most recent snapshot.  This practice insures that my computer will not propogate any malware or viruses that my family or I happen to carelessly add to the home computer.  It keeps my risks low and my productivity higher because I always have a fresh installation.
 
I am not a lawyer nor play one on the Internet, but it could also be argued that since a concerted effort is maintained to keep work and home activities separate while using the same the hardware, all legal privacy issues could be bound to only the VM files and not my entire computer. Again, consult your lawyer before believing this to be true.
 
I've only touched upon some of the connectivity risks associated with using home computers for work.  There are many more things to consider.  So please, share with us what you do to reduce or minimize any risks associated with using home computers for work.
 
--
Kevin Shortt
ISC Handler on Duty
 
6 comment(s)
Diary Archives