ESXi, Google Chrome, and Exchange 2010 STIGs released

I happened to be browsing DISA's site when I saw that the following STIGs have been released:

• ESXi 5 (Draft)
• Google Chrome (both a benchmark and a STIG)
• Exchange 2010

This is great news in regards to ESXi, as many times we run across ESXi in the field.  While the guidance is to use ESX, most entities migrate to ESXi for cost.  And the guidance does not translate to ESXi, it's just a different animal.  So, I'm glad DISA has released ESXi guidance.  Further, adding a benchmark for Google Chrome will make auditing those systems with Chrome installed much easier.

Incident response and insider threats

I mentioned yesterday that I was sorting out what I wanted to accomplish and where I would like to focus my activities in the coming year.  Heck knows, I am nowhere near ready to make a break and start something new or in a different direction.  However, during some of my free time (walking the pooch or driving to work) I've had a chance to mull over additional areas of this niche in computer security. 

One area that fascinates me to no end is the management of the insider threat to the organization.  And I think, to some degree, I want to move into an area where I have the ability to help mitigate and protect from that threat.  By doing so, I'll get to leverage my passion for incident response and to some extent, digital forensics.  At least, it is something to look forward to.

I noticed a post go through my blog reader today that the CERT Insider Threat team released another great resource.  I've just downloaded it:  The Common Sense Guide to Mitigating Insider Threats, 4th edition.  I haven't read it yet (I think I saw it is 144 pages.)  I'll get on it shortly.  But, if it is like their book, The Cert Guide to Insider Threats, then I'm sure it will be great.

Something else that is somewhat nagging at me is that I know my technical skills are starting to slip.  (Heck, many many years ago, my first coding forays were in COBOL, I don't know how much I could write in that language.)  I know that the DFIR community works a lot in Perl and Python.  I had started to teach myself Python early last year, but without having an active project to work on, I find that I can't keep the skills sharp.  So, I plan to remove rust, and get myself as technical as practical.

Finally, one of the tools I really want to get better aquainted with is the Security Onion, a tool that I think has plenty of value for incident responders, and network defenders in general.  I just saw today in a post that version 12.04 has been released.

A new year

Happy New year!

I wanted to call out the top posts of the years, and maybe throw in some other cool stats.  But I can't figure out how to see my stats for just the calendar year.  I see week, month, and all-time options.  I just want year.  If you know how to get those stats, leave it in the comments.

I'm sure it is going to be a busy year in the IA world.  The DoD is always changing, and we seem to be picking up new clients and ACA offices to work with.  So, I'm sure that there will be new DoD/IA posts in the future.

My passion still lays in the IR/Forensics realm, and I hope to get into that realm full-time in the future.  How that will happen remains to be seen.  And, in the DFIR realm, I'm looking to focus more on one aspect.  The DFIR space has been expanding over the last couple of years, there is so much more to do than there used to...so I'm looking for something to get more specialized.  I like timeline analysis, I log log analysis; but there are other areas that while I'm not the most proficient in them, it's something I'd like to try.  So, as the new year progresses I'll try to update where I'm going.

May you realize your hopes and dreams in the new year....and you're not spending all of your time fighting the bad guys.

Latest e-zines released

Two of my favorite e-zines have just released new issues:

I use Ubuntu a lot, though not as much as I would like to.  Full disclosure, I'm using an older distro, 10-something.  I have never been big on Unity, and my next full upgrade may not be pure Ubuntu, but a derivative.  Anyway, I read the Full Circle e-zine, and they just recently released a new issue.

Grab Issue 67 here.

I've been reading (In)Secure Magazine (e-zine) for many years now.  Yes, some of the articles are not the most current, though it would be very tough to put out a "zine" that was "that" timely.  But, I enjoy many of the articles and have learned a lot from reading the magazine.  It's one of those magazines I take with me on flights.

Grab issue 36 here.

I'm always open to reading new ezines.  Feel free to leave a comment on a zine you would recommend.

Searching for malware with Sysinternals tools

This is mostly a placeholder post so I know where to find this great video lecture.

Those of you that are constantly fighting malware may want to take a gander at this lecture as Mark's awesome tools are featured.

Log collection

A timely post by the Internet Storm Center.

I'm working on collecting logs at home and for the church.  Ultimately, at the church I want to set up something like Security Onion, but I need to start somewhere with incident response.  To that end, I want to aggregate logs.

The ISC post has great ideas and potential tools for capturing logs.

Beware of Sandy Spam and Scams

It did not take long for the spam capitalizing on "relief efforts" for hurricane Sandy to start hitting my inbox.  Further, in my area, actual scams have been taking place.  For example, FEMA has only entered the area.  Yet, some residents report being contacted by FEMA representatives.  Also, we have "tree companies" casing the area ostensibly looking for work - and in reality, looking for empty houses.

Be careful on what you click.

Make sure who you are dealing with is who they actually represent.

Leaving phones/laptops unattended while charging

Like many places, we got hit hard by the hurricane.  We're without power, heat, and hot water.  We don't have a generator, so charging the myriad of gadgets has been problematic at best.  Some neighbors and friends who have power have been great.  And a couple of the local businesses and the local library have set up temporary "charging stations."  It has been a huge blessing.

However, some people haven't taken the security of the phones or laptops very seriously.  While in Walgreens charging my phone, I watched people hook their phones up to charge, then go shop; leaving the phones unattended.  While it would be hugely crass to take advantage of people in this situation, the security side of me can't help but cringe.  With so much of our lives tied into our phones (and laptops) it seems extremely foreign to me that I would leave my device unattended.

So please, take care of your phones and laptops...make sure that they are secure.

Putting a disaster recovery plan into practice

As a DoD auditor, I hammer DoD sites and entities for not having or not having adequate disaster recovery plans.  I got to put words to practice in my own life with the impact of hurricane Sandy directly impacting me.  In light of what happened, we are revamping our procedures and amending the plans that we already had.

For example, we had planned for wind damage, and the possibility of a power outage.  We didn't plan on evacuating...data from previous storms didn't indicate that we might have to worry about rising water.  However, with the storm picking up steam, hitting us three hours earlier than anticipated and during a high tide; the stream around us was 13' above normal.  Water poured all around the house, which led to a prompt evacuation.

So, with a new threat to add to the threat model, we are revamping our plan.  We are including many of the lessons learned from this event so that we are not caught off guard in the future.  Further, we're keeping the plan in a central location so that everyone can benefit from seeing it and putting it into place.

It would figure that we would not get a hurricane until the very end of hurricane season.  And we know that Winter is just beginning....we're bound to have a snow/ice event.

October 2012 DISA updates

It's been a while since I last posted....I've had a lot of irons in the fire lately.  And, it doesn't help that we have gotten really busy, or were.  Now, there are artifacts and documentation to create.

So, in doing some research for a particular client, I surfed over to DISA's site and found that they had released a whole bunch of STIGs for the quarter.  Here's the list that I found for October:

Network Infrastructure Router L3 Switch - Version 8, Release 12 - Updated October 26, 2012
Network Perimeter Router L3 Switch - Version 8, Release 12 - Updated October 26, 2012
Network L2 Switch STIG Version 8 Release 12 - Updated October 26, 2012
Network Policy - Version 8, Release 12 - Updated October 26, 2012
Network Other Devices - Version 8, Release 12 - Updated October 26, 2012
IPSEC VPN Gateway STIG, Version 1, Release 3 - Updated October 26, 2012
Network Firewall - Version 8, Release 12 - Updated October 26, 2012
Network IDS/IPS - Version 8, Release 12 - Updated October 26, 2012
Oracle 9 Database STIG, Version 8 Release 1.8 - Updated October 26, 2012
Oracle 10 Database STIG, Version 8 Release 1.9 - Updated October 26, 2012
Oracle 11 Database STIG, Version 8 Release 1.9 - Updated October 26, 2012
McAfee Antivirus Security Guidance - Version 4, Release 7 - Updated October 26, 2012
General Desktop Application STIG Version 4, Release 3 - Updated October 26, 2012
Microsoft Office 2010 STIG Version 1, Release 5 - Updated October 26, 2012
Microsoft Office 2007 STIG - Version 4, Release 9 - Updated October 26, 2012
Microsoft SharePoint 2010 STIG Version 1, Release 2 - Updated October 26, 2012
BlackBerry STIG - Version 2, Release 2 - Updated October 26, 2012
DoD Host Based Security System (HBSS) STIG - Version 4, Release 3 - Updated October 26, 2012
SPAN Keyboard Video Switch (KVM) STIG, Version 2, Release 2 - Updated October 26, 2012
SPAN Multi-Function Device (MFD) and Printer STIG, Version 2, Release 2 - Updated October 26, 2012
SPAN Storage Area Network (SAN) STIG - Version 2, Release 2 - Updated October 26, 2012
REL LAN STIG - Version 1, Release 3 - Updated October 26, 2012
Internet Explorer 6 STIG - Version 4, Release 7 - Updated October 26, 2012
Internet Explorer 7 STIG - Version 4, Release 8 - Updated October 26, 2012
Internet Explorer 8 STIG - Version 1, Release 8 - Updated October 26, 2012
Internet Explorer 8 STIG Benchmark - Version 1, Release 8 - Updated October 26, 2012
Internet Explorer 9 STIG Version 1, Release 3 - Updated October 26, 2012
Mozilla Firefox STIG - Version 4, Release 5 - Updated October 26, 2012
z/OS ACF2 STIG - Version 6, Release 13 - Updated October 26, 2012
z/OS RACF STIG - Version 6, Release 13 - Updated October 26, 2012
z/OS TSS STIG - Version 6, Release 13 - Updated October 26, 2012
zOS SRR Scripts Version 6, Release 13 - Updated October 26, 2012
Windows Vista STIG, Version 6, Release 1.27 - Updated October 26, 2012
Windows Vista STIG Benchmark Version 6, Release 1.27 - Updated October 26, 2012
Windows XP STIG, Version 6, Release 1.27 - Updated October 26, 2012
Windows XP STIG Benchmark Version 6, Release 1.27 - Updated October 26, 2012
Windows 2003 STIG - Version 6, Release 1.27 - Updated October 26, 2012
Windows 2003 DC STIG Benchmark Version 6, Release 1.27 - Updated October 26, 2012
Windows 2003 MS STIG Benchmark Version 6, Release 1.27 - Updated October 26, 2012
Windows 2008 STIG - Version 6, Release 1.20 - Updated October 26, 2012
Windows 2008 DC STIG Benchmark Version 6, Release 1.20 - Updated October 26, 2012
Windows 2008 MS STIG Benchmark Version 6, Release 1.20 - Updated October 26, 2012
Windows 2008 R2 STIG - Version 1, Release 6 - Updated October 26, 2012
Windows 2008 R2 DC STIG Benchmark Version 1, Release 6 - Updated October 26, 2012
Windows 2008 R2 MS STIG Benchmark Version 1, Release 6 - Updated October 26, 2012
Windows 7 STIG - Version 1, Release 10 - Updated October 26, 2012
Windows 7 STIG Benchmark Version 1, Release 14 - Updated October 26, 2012
Gold Disk (*PKI) - Updated October 26, 2012
IAVM to CVE Mapping Spreadsheet - Updated October 26, 2012
Draft Internet Explorer 10 STIG Version 1 - Updated October 24, 2012
2012 STIG TIM and DSAWG Schedule - Updated October 24, 2012
Draft Mobile Policy SRG, Version 1, Release 0.2 - October 19, 2012
STIG Viewer - Version 1.1.2 - October 19, 2012
IAVM 2012 - Benchmark (HBSS Only) (*PKI) - Updated October 15, 2012
Draft Traditional Security STIG - Updated October 15, 2012
Draft Application Server SRG, Version 1, Release 0.2 - Updated October 11, 2012
Mobile OS SRG, Version 1, Release 1 - Updated October 10, 2012

The STIGs with (*PKI) after the name need special credentials.

I noticed that Gold Disk was updated.  I thought I read that this is the last update for Gold Disk.  I have not used it in quite a while, as we have been transitioning to the SCAP Compliance Checker (SCC) for all of our SCAP content.  I do miss the MS Office checks and browser checks that were bundled in Gold Disk.  But, we're finding that scripting out SCC has been meeting our needs.