A breach of that directory will result in a loss of literally all your infrastructure. There are many organizations that manage firewalls, switches, routers AND servers using the same directory. What happens when that directory is compromised? A hacker can destroy not just your servers, but wipe out your switch configurations and everything else.

A better way to handle this problem is to use separate directories for desktops and for critical infrastructure like servers. A well-designed trust relationship between the domains will ensure that a breach in the desktop Active Directory cannot be used to hack server infrastructure. It will also allow single sign ons for most rank and file users. Domain Administrators will need to maintain multiple credentials but that’s a small price to pay for real security.

Without going into details, I will say that at Chi Networks, we don’t use a single directory but instead use multiple Active Directories for various customer-facing and internal infrastructures. We then create trust relationships among the directories to prevent a compromise on a single directory from triggering a global compromise of just about everything. We also use Linux-based LDAP for certain services as well so as not to put all our eggs in a Windows basket – never a good idea, given the ongoing security issues at Microsoft.

October 12, 2021 / by Sanjiv Bawa

So, here are some tips on how to segregate your networks to prevent attacks:

• You should separate systems into their own networks. Two different systems should never share the same LAN or DMZ networks. Separation keeps a second system from getting penetrated if the first system is breached.
• Don’t allow LAN networks to have ANY internet access whatsoever. You don’t want to give a hacker who has breached the database server anywhere to go with stolen data. With internet access denied, the hacker’s only option now is to find a path backwards from the entry point OR a path through the Web Server. This makes exfiltration of data quite a bit more difficult. This is especially so if you maintain an Administrator Clean Room for all admin activities. Since that room has no Internet access or email, there really is no way for a hacker to exfiltrate the data from that user’s desktop.
• Do not allow any FTP, SFTP or SSH type of traffic on ANY network with your webserver. Segregate that traffic into a separate DMZ network as well. It is amazing how much data exfiltration happens simply because the outbound traffic looks like legitimate FTP transfers. If you don’t even allow FTP or SFTP traffic on those networks, it becomes much harder to get unauthorized data transfers done. Also, if you monitor your network for those protocols you can raise alarms if anyone attempts to make such transfers.
• Don’t allow any UDP or connection protocol traffic out of your DMZ networks. Trigger alarms if you find any. Again, it will make the hacker’s life much more difficult.
• Be sure to monitor the perimeter of the LAN using your Security Information and Event Management (SIEM) system. And be sure to raise alarms whenever you find ANY attempts to get traffic out. You should monitor traffic from the Web Server cluster to see whether traffic going out is not coming from direct responses to web requests. Setting up a SIEM properly so you get real alerts and not a zillion alerts all day is a black alert. If you don’t know how to, find someone who does.
• If you’re unlucky enough to have a Windows Server in your DMZ, be sure to put a Web Application Firewall (WAF) in front of it. Microsoft, in our long experience, is incapable of making a secure product. Simple as that. Leaving your Windows server on the WAN without a WAF is like securing it with a wing and a prayer.

August 31, 2021 / by Sanjiv Bawa

The Clean Room is a single-purpose room. It’s set up for System Administrators to do just one thing: manage production systems securely.

All other tasks performed by Sys Admins – routine ones like non-urgent research, daily communications by phone and email with bosses and clients – are all performed in a separate office. Never in the Clean Room!

This separation takes air gapping to the next level. Air gapping as widely seen today is intended to isolate all devices securing a company’s IT system from all other devices connected to its imperfectly secured local area network. It separates devices. But with the Administrator Clean Room, you create a next-level air gap isolating your company’s security-purposed devices and Sys Admins from any and all other company individuals or devices that might be vulnerable to external attacks such as ransomware, spear phishing and browser hacks.

Without an Administrator Clean Room your company is vulnerable to these outside attacks.

How the Clean Room works

All regular Sys Admin tasks are performed inside the Clean Room. These include patches, software installation and production configuration changes and resolving outages.

Only security-purposed hardware and software are allowed in the Clean Room. Just what’s needed to connect to the production servers on the critical networks that connect all production servers.

With one exception addressed below, the Clean Room has no Internet access. No browsers or email clients, USB Keys, phones or other rubbish software are allowed inside.

No PC’s are allowed inside either, only thin clients that have Terminal Services or SSH clients. You login, you administer, you log out and you exit the room.

Once outside the ACR, you have no access to the production network or System inside. Your Administrative or root passwords won’t work outside the room either.

But what about browsers needed for research purposes?

Here’s the exception. Browsers are often needed inside a Clean Room, as when a serious production problem requires on-the-spot research. The solution? Admit separate thin clients to the Clean Room with browsers set up for use only in the ACR, and using a separate network and having their own non-root passwords.

That’s it for Part I. Part II will discuss securing Windows servers. Part III will discuss Separated Networks and Separated Active Directories.

August 31, 2021 / by Sanjiv Bawa

But repatriation is a huge hassle. Deciding which servers to repatriate and then bringing them home can be a formidable task. It’s “a non-starter” for companies lacking the IT staff to complete server repatriation – including the rewriting of code – as Sarah Wang and Martin Casdado say in a recent, in-depth investigation of repatriation.

True, cost savings are indeed substantial when repatriation is done right. Wang and Casado report that “Several experts we spoke to converged on this “formula”: Repatriation results in one-third to one-half the cost of running equivalent workloads in the cloud.

But for companies not equipped or wanting to deal with the complexities of repatriation, there’s a safe and cost-effective alternative. It is to work with a reliable MSSP whose monthly prices run from 20% to 40% lower than those of AWS and Azure.

They do exist, and Chicago-based Chi Networks is one of them. It keeps IT systems running smoothly and ransomware-free for its 600+ Enterprise and SMB customers worldwide. And its live no-hold, no-wait 24/7 expert tech phone support creates a company/MSSP relationship that the duopolies can’t come close to matching.

August 3, 2021 / by admin