2014 Security Year in Review

Jan 02POSTED BY Derek Melber | Active Directory

Whew! Thank goodness 2014 is over! Well, at least if you are considering the year’s security issues, attacks, leaks, and password ​issues. As a security and Windows Active Directory professional, ​I feel like I have earned the right and it is the appropriate time to say, “I told you so.”

​Let me put this into perspective, to prove my point:

• 2014 financial services firms – $20.8 million lost to breaches
• 2014 tech companies – $14.5 million lost to breaches
• 2014 communication providers – $12.7 million lost to breaches
• Ebay – 150 million user accounts compromised due to phishing attacks, users asked to change password immediately
• Home Depot – 56 million credit cards compromised
• US Post Office – 800,000 employees’ confidential data breached

Unfortunately, there are many​, many more that could be listed. ​Looking at these numbers hopefully makes you wonder how much we are really putting effort into security of our corporate networks. ​We might be spending money, time, and resources trying to secure our environments at a very technical level, but it seems to be ​failing.

​What I have found is that some of the most basic security controls and configurations are not being done properly, so it is ​no surprise​ to me that all of these attacks are succeeding. As we move into 2015, I am going to give you ​some basic security concepts to consider with regard to your Active Directory environment. These concepts are basic and easy to address.

1. Allow your help desk to do more productive work and solve deeper issues by implementing a self-service password solution into Active Directory. This will also remove the help desk from the password reset process, which will eliminate ​one more person from knowing other users’ passwords.
2. Ensure the core of Active Directory access is secured. ​​I find that over 50% (a recent survey  I conducted indicated this) of administrators find delegations in Active Directory that they did not know existed.Removing Active Directory delegation in lieu of a tool that provides the delegation via a “proxy” is a much more secure.
3. Start to track, in real-time, the changes that occur to key security controls in Active Directory. I find that most organizations don’t track when groups like Domain Admins, Enterprise Admins, and Administrators change membership. In the end, issues arise or the audit finds the misconfiguration. Instead, have an email show up in your inbox every time a key security control changes, so you can take immediate action.
4. Ensure your domain users password policy is correct. This is a simple, easy, and necessary task. Knowing that your users’ passwords meet desired criteria is key to ensuring that all users are using some level of secure password controls. Investigating and verifying password policies can help you ensure that network resources are protected.

ManageEngine provides solutions around all of these concepts. We even provide a fully functional trial, so you can see firsthand how our tools can help solve these issues. Just visithttp://www.manageengine.com/windows-active-directory-tools.html to download the tools to tackle these issue in your Active Directory environment.

No one knows what 2015 has in store; however, taking action to help you secure your environment willpotentially keep your company out ​of the news headlines. Security is performed in layers. You need to ensure your Active Directory environment is correctly layered with many security features and options.

Active Directory in 2015!

Jan 08POSTED BY Derek Melber | Active Directory

Welcome to 2015! I want to thank all of my followers, loyal ​readers of my articles and posts, andManageEngine customers who care about Active Directory and quality products!

I​ want to start off the new year with a guide to Active Directory in 2015. Of course, this will be my personal view of 2015 and where I see things going with Active Directory.

First off, my focus will be mostly on Active Directory and not Group Policy, as it has in the past.

Second, as an Active Directory MVP for ​2015, I will be able to gather input from all of you and take that directly to the Active Directory team at Microsoft during my MVP summits. I will also have regular calls with the AD team and will have a direct connection to the AD team, just as I ​had with the GP team in 2014 and prior ​years when I was a Group Policy MVP.

Third, I don’t see Active Directory changing much technically, except for what you might want to move to the cloud with Azure. However, that does not mean there is little to nothing going on with Active Directory in 2015!

Finally, what I do see as action items for Active Directory in 2015 include:

• Securing domain controllers
• Securing authentications
• Securing password resets and changes
• Cleaning up security configuration in Active Directory
• Optimizing common Active Directory management tasks
• Automating common, yet complex, tasks for users, groups, and computers
• Optimizing the creation of new users and groups
• Cleaning up stale and security risk-related users, computers, and groups

This list might not sound like much, but when you consider the full list and the breadth of the list, it is close to a year’s worth of work. Also, you will, I am sure, have other work along the way, too!

I do want to offer up one more thing. If you have any AD, Windows security, Group Policy, desktop, or related questions, please email me. I have a huge pool of resources and knowledge and most importantly, colleagues that know a ton about AD and Windows. I know I can get you answers!

Next week, we will be getting dirty with some solutions with Active Directory. This week, you need to check in on your missed emails and get all of those answered, so you can ​make the most of 2015.

User Creation Templates on Steroids!

Jan 15POSTED BY Derek Melber | Active Directory

​I will be honest. When I tell most people about what I do, Active Directory evangelism, they yawn at me and lose interest quickly. However, I​ love what I do and find it very enjoyable.

​When I say “user creation templates,” does that make you jump for joy? No?

These words used to bore me, but now, they make me jump for joy! ​Here’s why:

​In ADManager Plus, you have new features that are built around the Drag-n-Drop feature. ​One of the features makes a user property “mandatory” during user creation phase. This means that the property that you have in the template – Description, for example – must be filled out during the creation of the user, or the system will not allow the user to be created.

​Figure 1 illustrates how easy it is to make a user property mandatory.

Figure 1. Making a user property mandatory in the user creation template.

Figure 2 shows you what the error message looks like if you fail to fill out the property when creating a user.

Figure 2. Error message indicating a mandatory user property has not been filled out.

Tell me that is not awesome! ​Now, when I say​, “user creation template with mandatory properties,” does that make you jump for joy? YES!

Monitoring perubahan di aplikasi dengan EventLog Analyzer

Salah satu isu yang menarik dalam audit aplikasi adalah apakah kita mengetahui adanya perubahan / penambahan  bahkan penghapusan di dalam aplikasi dan database. Tool Event Log Analyzer akan membantu kita menemukannya.

Home » Event Reports » Application Log Reports Application Log Reports The Application Reports provide different reports available for each application. To view the reports use the following menu options: Home tab > Applications > Host Name: <host name of the machine associated with application> Reports tab > Detailed Application Reports section > View Report: <Application Name> Logs The Detailed Application Reports section lists the Log Type, Report Description and View Report columns of the reports of each application log. View Report column contains links to open the various reports of the selected application log. The supported application log types are: MS IIS W3C Web Server Logs MS IIS W3C FTP Server Logs DHCP Windows Server Logs DHCP Linux Server Logs MS SQL Server Logs Oracle Audit Logs Print Server Logs Apache Web Server Logs IBM Maximo Server Logs Reports for MS IIS W3C Web Server Logs Clicking the View Report link opens the Reports for MS IIS W3C Web Server Logs page. The Overview section on top of the page displays the event count in the Event Count table. In the table event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table. Below the Event Count table, the page displays the event count for each host under Hosts sub section. In the Hosts table, the host names are listed under Name column and event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table against each host. The Report section at bottom of the page displays the various reports generated in the Report column of the table. The total events and top events of each report are listed in the Total Events and Top Events columns. There are delete icon links against each report to delete the report. The Report section header contains Edit Report List link to edit list of reports for the application. A report can be removed or added to the list from the link menu option. EventLog Analyzer generates the following pre-defined reports for web server application logs: Hosts Report - the details covered in this report are: Client IP Address, Hits, Page Views, Bytes Sent, and Events Users Report - the details covered in this report are: Username, Hits, Page Views, Bytes Sent, and Events File Type Report - the details covered in this report are: File Type, Hits, Percentage, Bytes Sent, and Events Page URLs Report - the details covered in this report are: URI Stem, Hits, Page Views, Bytes Sent, and Events Browser Usage Report - the details covered in this report are: Browser, Hits, Percentage, and Events OS Usage Report - the details covered in this report are: OS, Hits, Percentage, and Events HTTP Error Status Code Report - the details covered in this report are: HTTP Status, Hits, Percentage, and Events Malicious URL Report - the details covered in this report are: URI Stem, Hits, Percentage, and Events Cross Site Scripting Attempts Report - the details covered in this report are: Client IP Address, User Name, and Events SQL Injection Attempts Report - the details covered in this report are: Client IP Address, User Name, and Events Reports for MS IIS W3C FTP Server Logs  Clicking the View Report link opens the Reports for MS IIS W3C FTP Server Logs page. The Overview section on top of the page displays the event count in the Event Count table. In the table event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table. Below the Event Count table, the page displays the event count for each host under Hosts sub section. In the Hosts table, the host names are listed under Name column and event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table against each host. The Report section at bottom of the page displays the various reports generated in the Report column of the table. The total events and top events of each report are listed in the Total Events and Top Events columns. There are delete icon links against each report to delete the report. The Report section header contains Edit Report List link to edit list of reports for the application. A report can be removed or added to the list from the link menu option. EventLog Analyzer generates the following pre-defined reports for FTP server application logs: Hosts Report - the details covered in this report are: Client IP Address, Bytes Sent, Bytes Received, and Events Users Report - the details covered in this report are: Username, Bytes Sent, Bytes Received, and Events File Type Report - the details covered in this report are: File Type, File Transfers, Bytes Sent, Bytes Received, and Events Server Services Report - the details covered in this report are: Server Service, File Transfers, Bytes Sent, Bytes Received, and Events Server IPs Report - the details covered in this report are: Server IP Address, File Transfers, Bytes Sent, Bytes Received, and Events Source Port Report - the details covered in this report are: Server Port, File Transfers, Bytes Sent, Bytes Received, and Events Reports for DHCP Windows Server Logs Clicking the View Report link opens the Reports for DHCP Windows Server Logs page. The Overview section on top of the page displays the event count in the Event Count table. In the table event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table. Below the Event Count table, the page displays the event count for each host under Hosts sub section. In the Hosts table, the host names are listed under Name column and event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table against each host. The Report section at bottom of the page displays the various reports generated in the Report column of the table. The total events and top events of each report are listed in the Total Events and Top Events columns. There are delete icon links against each report to delete the report. The Report section header contains Edit Report List link to edit list of reports for the application. A report can be removed or added to the list from the link menu option. EventLog Analyzer generates the following pre-defined reports for DHCP windows server application logs: Lease Report - the details covered in this report are: Lease Report and Events BOOTP lease report - the details covered in this report are: Events DNS dynamic update report - the details covered in this report are: DNS update details and Events. The DNS update details are, DNS dynamic update request and DNS dynamic update successful Rogue server detection report - the details covered in this report are: Events IP-Event report - the details covered in this report are: IP Address and Events MAC-Event report - the details covered in this report are: MAC Address and Events Reports for DHCP Linux Server Logs  Clicking the View Report link opens the Reports for DHCP Linux Server Logs page. The Overview section on top of the page displays the event count in the Event Count table. In the table event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table. Below the Event Count table, the page displays the event count for each host under Hosts sub section. In the Hosts table, the host names are listed under Name column and event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table against each host. The Report section at bottom of the page displays the various reports generated in the Report column of the table. The total events and top events of each report are listed in the Total Events and Top Events columns. There are delete icon links against each report to delete the report. The Report section header contains Edit Report List link to edit list of reports for the application. A report can be removed or added to the list from the link menu option. EventLog Analyzer generates the following pre-defined reports for DHCP Linux server application logs: Operations Report - the details covered in this report are: Operation and Events. The operations are: DHCPREQUEST, DHCPNAK, DHCPDISCOVER, DHCPOFFER, DHCPACK, DHCPINFORM, if IN, delete, Wrote, DHCPRELEASE, and Abandoning IP MAC-Event report - the details covered in this report are: MAC Address and Events Client Gateway Report - the details covered in this report are: Gateway and Events IP-Event report - the details covered in this report are: IP Address and Events Single Page Summary Report - the details covered in this report are: Logging device, Operation, IP Address, MAC Address, Gateway, and Events Reports for MS SQL Server Logs For MS SQL, you will have two reports - MSSQL Error logs report and MSSQL Audit logs report. To get the MS SQL error logs report, you'll have to import the MS SQL error logs. To get MS SQL Audit logs, you need to enable auditing in MS SQL Server. Reports for MS SQL Error Logs  Clicking the View Report link of the application type MSSQL Error logs,opens the Reports for MS SQL Database Server Logs page. The Overview section on top of the page displays the event count in the Event Count table. In the table event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table. Below the Event Count table, the page displays the event count for each host under Hosts sub section. In the Hosts table, the host names are listed under Name column and event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table against each host. The Report section at bottom of the page displays the various reports generated in the Report column of the table. The total events and top events of each report are listed in the Total Events and Top Events columns. There are delete icon links against each report to delete the report. The Report section header contains Edit Report List link to edit list of reports for the application. A report can be removed or added to the list from the link menu option. EventLog Analyzer generates the following pre-defined reports for MS SQL database server application logs: Successful Trusted Logins - the details covered in this report are: Username and Events Successful Non-Trusted Logins - the details covered in this report are: Username and Events Failed User Logins - the details covered in this report are: Username and Events Insufficient Resources Events - the details covered in this report are: Events Report for MS SQL Audit Logs MS SQL Audit Logging is supported for MS SQL Enterprise and Datacenter Editions alone Click on View Reports link of MSSQL audit logs application type, to open its report page The host table section of the Reports Page displays the name of the host (from which the MSSQL audit logs are being collected) and their corresponding audit log event counts classified based on the  Critical, Error, Information and Warning severity. This table also displays the total audit log event counts.By clicking on the event count, you can drill down to the raw log level The reports section displays various predefined reports generated along with their event counts. Here is the list of predefined reports generated by EventLog Analyzer for MSSQL Audit logs Server Startup Server Shutdown Create Table Alter Table Drop Table Create Login Drop Login Create User Alter User Drop User Successful Login Failure Login Alter login Login Password Change Reports for Oracle Audit Logs  Clicking the View Report link opens the Reports for Oracle Database Server Logs page. The Overview section on top of the page displays the event count in the Event Count table. In the table event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table. Below the Event Count table, the page displays the event count for each host under Hosts sub section. In the Hosts table, the host names are listed under Name column and event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table against each host. The Report section at bottom of the page displays the various reports generated in the Report column of the table. The total events and top events of each report are listed in the Total Events and Top Events columns. There are delete icon links against each report to delete the report. The Report section header contains Edit Report List link to edit list of reports for the application. A report can be removed or added to the list from the link menu option. EventLog Analyzer generates the following pre-defined reports for Oracle database server application logs: Create Table - the details covered in this report are: SESSIONID, ENTRYID, USERID, USERHOST, TERMINAL, RETURNCODE, OBJ$CREATOR, OBJ$NAME, and Time Drop Table - the details covered in this report are: SESSIONID, ENTRYID, USERID, USERHOST, TERMINAL, RETURNCODE, OBJ$CREATOR, OBJ$NAME, and Time Alter Table - the details covered in this report are: SESSIONID, ENTRYID, USERID, USERHOST, TERMINAL, RETURNCODE, OBJ$CREATOR, OBJ$NAME, and Time Alter User - the details covered in this report are: SESSIONID, ENTRYID, USERID, USERHOST, TERMINAL, RETURNCODE, OBJ$NAME, and Time Alter System - the details covered in this report are: SESSIONID, ENTRYID, USERID, USERHOST, TERMINAL, RETURNCODE, and Time Create User - the details covered in this report are: SESSIONID, ENTRYID, USERID, USERHOST, TERMINAL, RETURNCODE, OBJ$NAME, and Time Drop User - the details covered in this report are: SESSIONID, ENTRYID, USERID, USERHOST, TERMINAL, RETURNCODE, OBJ$NAME, and Time Logon - the details covered in this report are: SESSIONID, ENTRYID, USERID, USERHOST, TERMINAL, RETURNCODE, and Time Logoff - the details covered in this report are: SESSIONID, ENTRYID, USERID, USERHOST, TERMINAL, RETURNCODE, and Time Connect - the details covered in this report are: DATABASE USER, PRIVILEGE, CLIENT USER, CLIENT TERMINAL, Status, and Time Shutdown - the details covered in this report are: DATABASE USER, PRIVILEGE, CLIENT USER, CLIENT TERMINAL, Status, and Time Startup - the details covered in this report are: DATABASE USER, PRIVILEGE, CLIENT USER, CLIENT TERMINAL, Status, and Time All Logs - This is created only as a custom report and is not available as a pre-built report Reports for Print Server Logs  Clicking the View Report link opens the Reports for Print Server Logs page. The Overview section on top of the page displays the event count in the Event Count table. In the table event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table. Below the Event Count table, the page displays the event count for each host under Hosts sub section. In the Hosts table, the host names are listed under Name column and event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table against each host. The Report section at bottom of the page displays the various reports generated in the Report column of the table. The total events and top events of each report are listed in the Total Events and Top Events columns. There are delete icon links against each report to delete the report. The Report section header contains Edit Report List link to edit list of reports for the application. A report can be removed or added to the list from the link menu option. EventLog Analyzer generates the following pre-defined reports for Print server application logs: Print Server Hosts Overview - the details covered in this report are: Print Servers and Job Count Print Server Usage Overview - the details covered in this report are: Print Server, Printed Pages, and Jobs Printer Usage Overview - the details covered in this report are: Printer, Printed Pages, and Jobs Printer Usage based on User Name - the details covered in this report are: User Name, Printed Pages, and Jobs Print Job Reports - the details covered in this report are: Reports and Total Counts and the Reports are, Print Usage, Paused Document, Resumed Document, Deleted Documen, Moved Document, Timed Out Document, Corrupted Document, Priority Changed Document, and Insufficient Privilege Document Reports for Apache Web Server Logs  Clicking the View Report link opens the Reports for Apache Web Server Logs page. The Overview section on top of the page displays the event count in the Event Count table. In the table event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table. Below the Event Count table, the page displays the event count for each host under Hosts sub section. In the Hosts table, the host names are listed under Name column and event count is classified based on the severity Critical, Error, Warning, Information, and Total and displayed in the columns of the table against each host. The Report section at bottom of the page displays the various reports generated in the Report column of the table. The total events and top events of each report are listed in the Total Events and Top Events columns. There are delete icon links against each report to delete the report. The Report section header contains Edit Report List link to edit list of reports for the application. A report can be removed or added to the list from the link menu option. EventLog Analyzer generates the following pre-defined reports for Apache web server application logs: Client Error Report Information Report Redirection Report Server Error Report Successful The details covered in the above reports are: Address, Status Code, Referrers, User Agents, and Event

Copyright © 2013, ZOHO Corp. All Rights Reserved.

ManageEngine

Apakah manajemen Anda peduli kondisi network Anda?

Networks are the glue that allow users to function effectively in their daily tasks, yet a recent report by Freeform Dynamics (link to report: XXX) based on a survey of readers of the Register shows many of you are using old equipment that is hard to manage. This begs the question, “does senior management really care about the state of enterprise networks, or are they happy to take it for granted until something breaks”? (Figure 1)

Figure 1

It is evident that a majority of the networks you operate are fragmented and difficult to manage. The odds are that many of the essentials of your networks may have been put in place over the course of the last five, ten, or perhaps fifteen years. There is even a chance that it was never really architected as a whole but has been built in a disorganized fashion to cater for individual application requirements case by case.

When we asked what problems managing the performance, availability and security of the applications on which your organisations depend, your replies were very clear. (Figure 2)

Figure 2

The majority of readers who took part in the survey confirm there are challenges with respect to application performance and availability. The problems are not only about slow response times or systems being unavailable, but include the question of performance consistency. Fifteen years ago most users were annoyed, if unsurprised, when network connectivity was lost or service quality deteriorated.

Today users complain if performance isn’t consistently perfect, regardless of where they are working, how they are connected or the devices and networks they are using. Perhaps more importantly, over half of Reg readers taking part indicated that unplanned outages are causing business disruption.

This takes us on the question of how good are your management capabilities, and do you see any areas where you should be looking to beef things up? (Figure 3)

Figure 3

The answers you gave in the survey show that you have obvious capability shortfalls evident in nearly every area of network performance and availability. The fact that a majority of readers highlight all areas as targets for improvement confirms you see a real need for them. But what might actually trigger changes to your application delivery networks and how you administer them? (Figure 4)

Figure 4

As can be seen in Figure 4, new ways of handling application delivery requirements can be initiated by a range of events. With nearly four out every five Reg readers acknowledging running old technology with functionality gaps (Figure 2), it is no surprise you see existing equipment reaching end of life to be the most likely initiator of change.

Other triggers for over half of you include major business application upgrades, web site development and increased security demands. Even modifications to regulatory requirements and Exchange / SharePoint upgrades are mentioned by two out of five readers.

The danger is that any modifications to the enterprise application access infrastructure resulting from the investment prompts noted above could simply lead to piecemeal implementation of new networking solutions without changing the way networks are managed as a whole. Such an approach perpetuates the fragmentation you already acknowledge to exist in your networks. It is also likely to further exacerbate any operational management difficulties you have.

A new approach is needed, one where the performance, availability and security aspects of application access for every service are assessed individually. A network then needs to be built able to handle the new demands being placed upon it, one with better management characteristics that demand less of time to keep operational and secure.

The first challenge is to convince your budget holders it’s time to invest in redesigning the corporate application access and security networks. The second, equally daunting, challenge involves how do you upgrade your network architecture and management processes without negatively impacting service levels? This is the IT equivalent of changing the tyres on a racing car while it is tearing around the circuit in the middle of a Formula One Grand Prix.

How are you going to get hold of the time and resources to make these changes and how do you plan to make the upgrades? Let us have your thoughts in the comments below. Equally, if you have already changed things, please let know how you made the transition.