New SSL server rules go into effect Nov. 1

Rules designed to thwart man-in-the-middle attacks; could mean extra work for IT shops

Public certificate authorities (CAs) are warning that as of Nov. 1 they will reject requests for internal SSL server certificates that don’t conform to new internal domain naming and IP address conventions designed to safeguard networks.

The concern is that SSL server digital certificates issued by CAs at present for internal corporate e-mail servers, Web servers and databases are not unique and can potentially be used in man-in-the-middle attacks involving the setup of rogue servers inside the targeted network, say representatives for the Certification Authority/Browser Forum (CA/B Forum), the industry group that sets security and operational guidelines for digital certificates. Members include the overwhelming bulk of public CAs around the globe, plus browser makers such as Microsoft and Apple.

“Even in an internal network, it’s possible for an employee to stand up a fake server,” says Rick Andrews, senior technical director for trust services at Symantec, explaining the new rules.

The problem today is that network managers often give their servers names like “Server1” and allocate internal IP addresses so that SSL certificates issued for them through the public CAs are not necessarily globally unique, notes Chris Bailey, general manager for Deep Security for Web Apps at Trend Micro.

“People rely on these internal names today,” Bailey says. But “if someone hacks in, they can set up a man-in-the-middle domain.”

The CA/B Forum three years ago reached the conclusion this was a significant security issue and nailed down new certificate-issuance guidelines they have been sharing with their customers. Now that the Nov. 1 deadline is getting closer, they are speaking out about it.

As of Nov. 1, network managers requesting internal SSL certificates from the public CAs will have to following these new guidelines. Network managers will need to ensure SSL server certificate requests are expressed in a way that they are associated with an external domain name, says Andrews. Some enterprises already use names that chain up to the company name, but “these are probably in the minority,” he adds.

MORE WORK FOR YOU?
This change to requirements pertaining to public issuance of internal SSL server certificates means that in some instances, network managers may need to expand their internal DNS infrastructure so the name maps appropriately, Andrews points out. For some, particularly large organizations with sprawling networks, it could be a painful set of changes, even impacting the applications running on these servers, he acknowledges.

For any organization or network manager not wishing to adhere to the new public CA issuance guidelines, there are a few alternatives, though Andrews says many may not find them appealing. Organizations can decide not to obtain publicly-issued SSL certificates for internal servers and instead start privately issuing digital certificates on their own by relying on their own management hierarchy. But Web browsers might not necessarily recognize these private certificates and more changes might need to occur to ensure they do.

One other CA/B Forum deadline to keep an eye on: Oct. 1, 2016. By then, any SSL certificates issued for internal domains that don’t meet the new standards will be revoked. Organizations that determine they must make changes to meet the CA/B Forum guidelines now have about two years to migrate.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

How to protect yourself against privileged user abuse

The typical organization loses 5% of its revenues to fraud by its own employees each year, with most thefts committed by trusted employees in executive management, operations, accounting, sales, customer service or purchasing, according to the Association of Certified Fraud Examiners (ACFE). This type of malicious behavior by “privileged users” who have been given broad access to the company’s computer assets has captured the attention of CIOs across the country.

It’s no mystery why: insider breaches can damage a company’s reputation, market advantage and its bottom line, stretching into billions of dollars. Despite the increased awareness and severity of the risk, a recent Ponemon survey of 693 IT professionals, commissioned by Raytheon revealed only 40% of IT budgets have dedicated funding to fight insider threats.

One reason for lack of funding is IT security budgets are largely targeted to defend against external threats, which are greater in number, but not necessarily as devastating in severity and damage to an organization. The irony of this is highlighted in the same survey: 45% say it’s likely that social engineers from outside the organization will target privileged users to obtain their access rights. This underscores that “insider” does not mean a person has to be physically based in an organization and that privileged users should truly be the focus when we talk about insider threats.
So who is the privileged user?

In any company, the privileged user is an employee with authority to access more than usual company data or make changes to the company network. Companies need privileged users because they have access to source code, file systems and other assets that allow them to upgrade the systems or make other technical changes.

Because they have greater access to the network and are limited by fewer controls, privileged users can access more of their companies’ intellectual property, such as corporate data or confidential product information. They often have the ability to easily get around controls that restrict other non-privileged users and they sometimes abuse what should be temporary access privileges to perform tasks.

Improvements in 10GbE technology, lower pricing, and improved performance make 10GbE for the mid-market

An example illustrates the problem: Bob is logged in with ordinary network access privileges but receives a help desk ticket that requires him to log out and log back in as a system administrator. Once the task is performed, Bob remains logged in as the system administrator with elevated privileges, exposing the network to a much greater security vulnerability if he were to be victimized by a cyberattack.

One way to tackle it is by focusing on Privileged User Monitoring and Access (PUMA), which relies on monitoring human behavior to determine the context of the behavior and people’s intent as well as automated tools such as video replay to keep an eye on privileged user activities. Monitoring human behavior is especially important with privileged users because they often have the know-how to cover their tracks, a feat that becomes much harder with video replay and other technologies that can have a deterrent effect by their presence. If privileged users know you’re monitoring their activity, they’re less likely to behave badly.

At the core of the privileged user problem is this dichotomy: With greater access to a company’s computer assets comes greater security risk. The privileged user can be a company’s security enforcer but also its greatest security risk.

Put another way, if a privileged user wants to do bad things, their elevated access to the company network makes it easier for them. But even a well-intentioned privileged user poses high risks. When a system administrator or network engineer with elevated access clicks on a malicious link, because of their greater access to the network, it’s far more likely to do company-wide damage than if an office manager without elevated access clicks on the same link.

The privileged user threat shows no signs of diminishing, in part because of economic pressures that have forced companies to try and do more with smaller staffs, leading to stressed out employees who are likely to be more careless about their use of elevated access privileges. And in today’s environment companies have a greater responsibility to report data losses of all sizes, so data theft by privileged users on the inside attracts widespread attention with significant negative impacts on the company’s reputation and stock price.

It all adds up to a realization by companies that the biggest cyberthreat to their organization may not be from an external attack. The most serious threat may be from an unknowing “privileged user” colleague right down the hall.

Survey respondents said the two biggest challenges companies face when addressing insider threats are having enough contextual information provided by security tools (69%) and security tools that yield too many false positives (56%). Endpoint monitoring and auditing tools allow visibility and context, alleviating these challenges.

Additionally, the best approach to mitigating privileged user abuse is to develop a comprehensive and layered strategy that implements best practices, involves process and technology, and most importantly, involves a better understanding of human behavior. It is a common myth among IT management staff that auditing privileged user activity is too difficult and complicated.

The truth is that privileged user auditing does not have to be a complicated technical challenge if the auditing and monitoring process is flexible, policy-based, and provides irrefutable attribution to a particular privileged user. The knowledge alone that an organization uses auditing and monitoring technology is a huge deterrent against privileged user abuse. Many studies have been done to help identify best practices for mitigating the risk of privileged user threats.

While there are a variety of tools that address different aspects of privileged user security, there is no single technology that fully mitigates the problem. Gartner identifies solutions used for privileged account management (PAM) as a set of technologies enabling enterprises to address these specific needs:

Control use of (usually privileged) shared accounts — shared-account password management (SAPM) tools.
Allow users granular, context-driven and/or time-limited use of super user privileges —
Superuser Privilege Management (SUPM) tools
Manage privileged sessions (such as control outbound traffic and system-to-system “hops”)
Monitor use of shared accounts and superuser privileges with fine granularity.

Your company needs its privileged users - perhaps the most valuable players in any organization. However, these are the very same people who can also become a super threat if not properly monitored. Organizations can protect themselves from privileged user threats by implementing best practices and implementing a flexible policy-based monitoring solution that ensures enterprise-wide visibility into privileged user activities. The key to mitigating privilege user abuse is the ability to determine context and intent, which can only be accomplished by monitoring human behavior.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Microsoft says new hybrid storage options can cut costs up to 60%

Microsoft Azure StorSimple storage options mix on premises with cloud resources.

Microsoft is coming out with new hardware and cloud management features for its StorSimple hybrid storage offering that promises lower costs and better data protection.

The new products, available Aug. 1, include two models of the new StorSimple 8000 storage array that are tied into a management platform and a virtual storage appliance, both deployed within Microsoft’s Azure cloud. The package is called Microsoft Azure StorSimple.

With it, customers can cut storage costs 40% to 60%, receive faster disaster recovery and access tools that provide detailed views of storage status and trends, Microsoft says in a blog.

The hardware – StorSimple 8100 and 8600 – tier data between SSD and HHD drives, but also with storage within the Azure cloud. This hybrid architecture gives customers the ability to readily expand overall storage capacity in the cloud and add disaster protections, the company says.
ms azure diagram

StorSimple Virtual Appliance supports the functionality of the on-premises StorSimple hardware except that it is deployed on virtual machines within the Azure cloud. Paired with StorSimple hardware at customer sites, the virtual appliance can run applications in the Azure cloud by accessing virtual volumes uploaded to the cloud from the on-site storage arrays.

This arrangement enables running new applications in Azure that use cloud-based snapshots of historical data without having to access it in the corporate data center, thus avoiding disruption of existing data-center workloads, the company says. The data used in this way must be from Windows Server, Hyper-V, Linux or VMware servers, according to Microsoft.

The Virtual Appliance can play a role in disaster recovery in Azure as well. Applications that have been virtualized in an Azure StorSimple array on-prem can be restarted on virtual machines within Azure using data that has been uploaded there beforehand. Once the on-site customer data center has been restored, any changes to the data in the cloud that were made during the restoration process are downloaded from the cloud, Microsoft says.

On-premises data is up loaded to Azure as cloud snapshots, which are like traditional storage snapshots only these are stored in Azure’s cloud. The cloud data deduplicated so it takes up less space and is synched with on-site data. Once in the cloud it can be used not only for disaster recovery but also for development and testing applications, search and application migration, Microsoft says.

The cloud-based management platform gives a central console for all the StorSimple storage arrays throughout an enterprise as well as the storage within the Azure cloud. This enables applying central policies and controls and gives access to all arrays automatically, says Mike Schutz, the general manager of product marketing for Microsoft’s Server and Tools Division. The manager also supports real-time status reports.

Detroit-based construction firm Walbridge has used StorSimple 7000s for three years and has saved 40% of its storage costs vs. what it would have spent over that time if it had continued buying on-prem servers, says Cynthia Weaver, the firm’s assistant vice president for IT.

She’s not certain the company will upgrade to Azure StorSimple but is intrigued by its ability to support disaster recovery to the cloud. Currently restoration requires a second StorSimple array to recover to. She says she’ll consider Azure StorSimple the next time she replaces some of the company’s remaining on-site storage.

Walbridge’s strategy is to move storage to the cloud as it retires outdated gear, Weaver says. Between StorSimple and Office 365, the company now stores more data in the cloud than it does on-site and has actually reduced the size of its data center and reallocated the space to create two offices, she says.

Microsoft bought the independent startup StorSimple in November 2012, and the introduction of Azure StorSimple is the first new generation of its product since then. The Store Simple hardware capacity ranges from 15T to 40T Byte on premises with support for 200T Byte in the cloud. The previous hardware family StorSimple 7000 ranged from 4T to 20T Byte.

The virtual appliance and cloud-based management are not available for StorSimple 7000 devices.

Microsoft’s StorSimple products compete against products from TwinStrata, now owned by EMC, Nasuni and Panzura, which act as storage gateways to public cloud services. Microsoft has the advantage of creating unique enhancements that come from controlling both the on-prem hardware and the cloud service.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Microsoft Certifications 2014 can you a JOB

With the new technologies coming in the market every other day, life has become advanced these days. In this modern era, you have to be on your toes all the time especially if your career in related to the field of IT: one has to stay updated with all the latest programs and their features in order to stay ahead of his peers. For instance, there was a time when Gramophone was the invention of the century but then it was replaced with mobile phones. Similarly, the invention of television and radio created quite a heap in the early 20th century but later on, the thunder was stolen by computers in the late 20th century.

In this day and age, computers and internet have become the center of attention. Consequently, IT has become the most popular field. IT experts are quite in demand these days; but with the emergence of new programs every other day, they have to keep up with the latest technology in order to stay ahead in the race. One way of staying ahead is the certification courses. These courses ensure that the candidate has attained all the latest knowledge and is ready to roll in the world of technology.

This article will discuss some of the most popular certification courses offered by Microsoft.

Microsoft Technology Associate
This is a certification course designed for the starters: people who want to start their line of business in the field of technology. Accordingly, it tests the fundamentals of IT and validates that the candidates have a basic understanding of the essentials. This course has been divided into three tracks and the candidates can choose any one of the tracks, depending on their preference. The tracks are: IT infrastructure, Database Design and Developer.

Microsoft MCSA- Windows Server 2008
This exam is designed for the IT personnel and it validates their skills in Server Networking management. IT professionals and System Administrators are suggested to take MCSA- Windows Server 2008 exam especially if they are looking forward to earning their MCSE certification.

Microsoft MCSA- Windows Server 2012
This certification exam is an advanced level exam which validates that the candidates have sufficient knowledge of Windows Server 2012 for its proper installation, configuration and working. MCSA- Windows Server 2012 certified can easily get the position of Network Administrator, Computer Systems Administrator or Computer Network Analyst.

Microsoft MCSE- Server Infrastructure
This certification course is designed for IT experts and it will get you the title of ‘Solutions Expert’. It tests individual’s skills in effectively and efficiently running a modern data center with some experience in virtualization storage and networking, identity management and systems management.

Microsoft MCSE- Desktop Infrastructure
This course validates that the individuals can manage desktops and devices, while maintaining their security and integrity, from anywhere around the globe. It also tests individuals’ expertise in application and desktop virtualization together with remote desktop services. With this certification in hand, you can easily qualify for a job of Data and Application Manager or Desktop and Device Support Manager.

Microsoft MCSE- Messaging
This certification is an expert level certification and it validates that the applicant has relevant skills in order to increase user productivity and flexibility. It also validates that the person has sufficient knowledge as to how to improve data security and reduce data loss. After passing this certification exam, candidates can easily qualify for the position of Network and Computer System Administrator.

Microsoft  MCSE- Communication
This certification validates candidates’ expertise in using Lync Server to create an effective communication path that can be accessed from all around the globe. This certification is also an expert level certification and you can easily qualify for the position of Network and Computer System Administrator with it.

Microsoft  MCSE- SharePoint
This Microsoft Certified Solutions Expert certification course verifies that the candidates have the necessary expertise to share, synchronize and organize the data across the organization. SharePoint 2013 is the updated version of Microsoft Office, and passing this certification can get you a job of Systems or Network Analyst.

Microsoft MCSD- SharePoint Application
This Microsoft Certified Solutions Developer certification course is another of expert level certification courses which validates individuals’ expertise in web programming. It also requires the individuals to design and develop applications with Microsoft SharePoint. With this certification, you can easily secure the position of Software Developer or Web Developer.

Microsoft Private Cloud
MCSE- Private Cloud certification course tests candidates’ expertise to manage Private Cloud computer technologies. It also verifies that the candidate can implement these technologies in a way to optimize service delivery. You can easily get the position of Server Administrator and Network Manager with this certification on your resume.

Microsoft System Center Configuration Manager
Microsoft System Center Certification focuses on the skills to manage computer and clients. The candidates should be able to configure, administer and deploy System Center 2012 in order to pass this exam. You can earn the title of Microsoft Certified Technology Specialist through this certification.

Microsoft Server Virtualization
This certification verifies that the candidate is familiar with Server Virtualization, both on Windows Server and System Center. This course expands individual’s expertise and skills in order for him to meet the rapidly modernizing technological business needs, and it can get him the title of Microsoft Specialist in no time.

Microsoft Office Certifications
Microsoft offers many certifications that verify candidates’ skills in handling and using Microsoft Office Applications. These certifications start from beginners level and go up to the master level. Microsoft Office Specialist is a beginner level certification whereas Microsoft Office Specialist Expert is an advanced level certification. Last but not the least; Microsoft Office Specialist Master is a master level certification.

Microsoft MCSA- Office 365
This course focuses on individual’s skills in handling Office 365 together with productivity tools and cloud-based collaboration. This certification can easily get you the position of Cloud Application Administrator or SaaS Administrator.

Microsoft Dynamics
This Microsoft Certified Technology Specialist certification confirms an individual’s expertise in Microsoft dynamics: a specific module can be chosen for this certification. However, this certification will be withdrawn from the market, at the end of this year, and replaced with the new ones.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com