New issue of (In)Secure Magazine - Issue 31

I just realized that I missed passing along that the new issue of (In)Secure magazine, issue 31, is out.  I really like this magazine as it has a good mix of articles; some technical, and some theory.  (In)Secure has been around for a while and they produce a good product.

For a while, there were a whole bunch of magazines filling this niche, but I see less and less of them as time marches on.

From an IA prospective, I read the article on looking at Domino applications, and already I have learned a couple of new tricks to use when looking at those types of apps.  Fortunately, I just don't see many of those applications.

A question on creating a log management program

At one of the establishments where I donate my services, the need for log management and security incident management has been discussed.  To put it in a nutshell, the establishment wants to open up the wi-fi to "partially" vetted users.  The wi-fi is locked down pretty good.  I think the question that wants to be answered is "who logged into the network, from where?"  Also, should there some kind of incident, they want to know when and where it occurred.

Here's a mini-description of the network.  Broadband comes into the building, and DHCP addresses are given out from this router.  The router is an Actiontec MI424WR.  There is a scope of the first 50 hosts reserved for static IPs and the static IPs are used for the central file server, access points, an internal HVAC computer, and part of the HVAC/solar system to broadcast results (like how much electricity has been generated.)

Down the line, I have plans to add a commercial firewall and a router, in order to create VLANs.  However, as the infrastructure is improved, I want to add log management and incident management into the network.

So, for right now, I'm looking for ideas on how to capture:
firewall logs from the Actiontec
DHCP logs from the Actiontec
Windows logs from the file server (Windows 2000)
maybe wireless access logs

I found a great page here:  http://www.securitywarriorconsulting.com/logtools/ 

My question is:  what's a good recommendation? How to best capture the information?  Open source would be great as I'm sure money is going to be an issue.

As this project progresses, I'll post updates.

Facebook Security (August 2011)

I only use Facebook casually; I'm not a big user.  I think I've blogged before about Facebook security, but Facebook is continuously changing and updating their policies and security/privacy posture.  However, I saw a link today that I had not seen before:

Facebook Security Guide

Some of the points they make are true common sense.  But, I'm sure there is something for everyone in the guide.  My hope is that the guide gets updated as they introduce new features and policies.

August 2011 Unix updates

I just noticed that DISA has updated the Unix STIGs and SRR.

They can be found at DISA's site.

Auditing with MMC's Security Configuration and Analysis Snap-In

Here's an auditing trick I had never used before.  I'm sure I should be able to script this information from the registry.  But, until I find where this information, here's what we did:

Open MMC
File -> Add/Remove Snap-in...
Chose "Security Configuration and Analysis"
Click Ok
In the main window, right-mouse-click on Security Configuration and Analysis
Choose Open Database
We created a temp database.
When asked for the .inf file, we pointed to the .inf files we grabbed from the DISA benchmarks.
Right-mouse-click on Security Configuration and Analysis, again
Choose Analyze Computer Now
DO NOT CHOOSE Configure....
MMC will analyze the computer against the settings in the DISA .inf file.

When it is doen, I double-clicked the individual policys, and exported them to our results directory.

Retina and Auditing File Versions

I have a quick Retina question for anyone that uses Retina with any regularity.  While testing this past week, I came across an issue with Retina. 

After point Retina at its targets, it would launch and run the scan with no problems; until it reached the Auditing File Versions check.  Then, the scan would crawl almost to a halt.  A couple of times, I had to check Task Manager to make sure that Retina was still running.

Has anyone else run into this?

How to see shared drives when you can not map a share

A weird title, I know.  Here is the situation that transpired.  I was auditing a system at a client site where we were given admin-level credentials.  I was able to log in to the server through RDP, but try as I might, I could not map a drive to the share that was created for us on one of the local file servers.  It mapped fine on the testing laptop.  The system admins assured me that my credentials were good and that all servers had the same permissions on the subnet.  And, all servers were on the same domain.  My co-worker gave me this tip:

First, map the drive on the local test laptop.
Next, start an RDP session to the server you are auditing.
Enter the address of the server.  But, before clicking connect, click the options button.
On the Local Resources tab, click the drive that you mapped to the share.
Then, you can click connect. 
When you connect, the server you are auditing will be able to see the share through your laptop.  It is sort of like a proxy.

The trick is pretty cool, and worked like a champ for the rest of our testing.

August 2011 STIG releases

I happened to be checking DISA for something unrelated, and I saw the following STIG releases:

Windows IAVM Benchmarks (HBSS only) - Updated August 15, 2011
Windows 7 STIG Benchmark Version 1, Release 5 - Updated August 15, 2011
Windows 7 STIG - Version 1, Release 5 - Updated August 15, 2011
Windows 7 STIG - Version 1, Release 5 (*PKI) - Updated August 15, 2011
Draft Solaris 9 SPARC STIG - Version 1, Release 0 - Updated August 3, 2011
Draft Solaris 9 x86 STIG - Version 1, Release 0 - Updated August 3, 2011
Draft Solaris 10 SPARC STIG - Version 1, Release 0 - Updated August 3, 2011
Draft Solaris 10 x86 STIG - Version 1, Release 0 - Updated August 3, 2011
Microsoft Office 2007 STIG - Version 4, Release 5 - Updated August 2, 2011
Windows 2008 DC STIG Benchmark Version 6, Release 1.15 - Updated August 2, 2011
Windows 2008 MS STIG Benchmark Version 6, Release 1.15 - Updated August 2, 2011
Windows 2003 DC STIG Benchmark Version 6, Release 1.22 - Updated August 2, 2011
Windows 2003 MS STIG Benchmark Version 6, Release 1.22 - Updated August 2, 2011
Windows Vista STIG Benchmark Version 6, Release 1.22 - Updated August 2, 2011
Windows XP STIG Benchmark Version 6, Release 1.22 - Updated August 2, 2011

I think this is the last of the releases until the next quarter.

Fixing CAC access to a website when certificates seem to be the problem

A co-worker lost CAC access to ONE of the DoD websites we routinely access.  One, of the four or five we use on a regular basis.  We tried switching browsers.  We tried removing certificates.  We tried re-installing (from our install file.)

In the end, it seems like following the instructions in this PDF did the trick.

Ultimately, I think the install-root file for the root certificate was newer than our file, and so I believe newer certificates were added.  Also, the PDF mentioned some specific certificates that had to be removed.

July 2011 STIG updates, part 3

This looks to be the last of the updated STIGs:

RAS Remote Access Server STIG Version 2, Release 5 - Updated July 29, 2011
Remote Access Policy STIG Version 2, Release 5 - Updated July 29, 2011
Remote Access VPN STIG Version 2, Release 5 - Updated July 29, 2011
Remote Endpoint STIG Version 2, Release 5 - Updated July 29, 2011
Remote XenApp ICA Thin Client STIG Version 2, Release 5 - Updated July 29, 2011

I will update if there are any more updates.