Loading ...

Category: Updates

Zero Trust – Software Patching

This is the seventh in a series about the concept of Zero Trust, which means in the IT sense that you trust nothing and always verify everything surrounding and connected to your network. Today’s discussion will be on software patching. 

Software Patching

Software patching is a neccesity because no person who writes code is perfect and hackers are actively looking for these mistakes. The hackers find the mistakes and then develop ways of using these to exploit the software, computer, or whatever else they can gain access to. The only way to combat both the mistakes and the exploits is to discover them before the hackers do and patch the hole in the software. This patch can however lead to unforseen consequences to the software, so a plan for testing and deployment of patches is needed to avoid unexpected downtime to businesses.Here are some questions to ask:

  • Do you know all of the hardware and software on your network?
  • Do you check for hardware, operating system, and other software regularly?
  • How do you check for updates, patches, or upgrades to software?
  • How do you install these patches? Is it automated?
  • Are these patches tested before installation?
  • What happens if a patch causes problems?
  • Do you have a log of all installed updates?
  • Are any systems or software on your network no longer supported for updates?

If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

Using an Old Teamviewer Makes You Vulnerable

Looks like the trusted remote access / remote support tool has an exploit that could allow an attacker to figure out your network password.

Please take the time to update your Teamviewer software to the latest version or contact us to setup our free remote access software on your systems. 

A newly discovered serious vulnerability – dubbed “BootHole”

There has been information released by a security research firm called Eclypsium that there is a vulnerability dubbed Boothole in Unified Extensible Firmware Interface (UEFI) Secure Boot that would allow an attacker to completely take over a workstation, laptop, or server and be nearly undetectable. All hardware vendors will have to send out updates in the near future to patch the UEFI code to secure it against this “BootHole” vulnerability. Due to the difficulty in designing and testing these types of updates it will be some time before they are released. We will keep you posted as to the release of these updates as they become available. 

If your company is concerned about security, then contact us for assistance.

Windows 10 Version 1803 Removes HomeGroup

According to the following Microsoft Support Post published in October 2018, the HomeGroup feature has now been removed from Windows 10. Most people won’t need to worry about this, but recently ran across a business that had relied on this feature to run their network. With HomeGroup removed from Windows 10 they were left without the ability to share properly with a new computer on the network. So here is how to fix the issue:

How to fix Windows Networking after HomeGroup Removal

  1. Turn off all sharing:
    1. Open Network & Sharing Center
    2. Click on Advanced Sharing Settings
    3. Turn off network discovery (Private & Public)
    4. Turn off file and print sharing (Private & Public)
    5. Turn off Public folder sharing (All Networks)
    6. Turn off Password Protected Sharing (All Networks)
    7. Save Changes
  2. Remove old password:
    1. Open Credentials Manager
    2. Change to Windows Credentials
    3. Remove all $HomeGroup users credentials from networked computers on all computers formerly in HomeGroup
  3. AutoStart Services
    1. Open Services
    2.  Find Function Discovery Provider Host and set to Automatic Startup then Start service
    3. Find Function Discovery Resource Publication and set to Automatic Startup then Start service
    4. Find SSDP Discovery and set to Automatic Startup then Start service
    5. Find UPnP Device Host and set to Automatic Startup then Start service
  4. Add Users
    1. Get username and password for all computers on network
    2. On each computer on the network, open command prompt
    3. For each username, use the command –  net user [username] [password] /add
  5. Turn on all sharing:
    1. Open Network & Sharing Center
    2. Click on Advanced Sharing Settings
    3. Turn on network discovery (Private)
    4. Turn on file and print sharing (Private)
    5. Turn on Public folder sharing (All Networks)
    6. Use 128-bit encryption (All Networks)
    7. Turn on Password Protected Sharing (All Networks)
    8. Save Changes
  6. Recreate Shares (if needed)
    1. Right-click on folder and choose Properties
    2. Click on Sharing tab
    3. Click on Advanced Sharing
    4. Check Share This Folder
    5. Name the share
    6. Click Permissions
    7. Click on Add
    8. Select username and add Full Control then click OK
    9. Repeat for each username
    10. Click OK to return to Properties window
    11. Click on Security Tab
    12. Click on Advanced
    13. Click on Add
    14. Select username and add Full Permissions (or appropriate level) then click OK
    15. Repeat for each username
    16. Check Replace Child Permisssions and click OK
    17. Click OK on all previous windows

Hope this post helps some other techs save the time in fixing Windows 10 networking when HomeGroup is removed.

If your company is still using HomeGroup or needs any help with advanced networking, then contact us for assistance.

Celebrating 3 Years of Serving Grants Pass

3 years in business

It is official – the month of September marks three years in business for Farmhouse Networking. We have been truly blessed by God to have been able to serve the Grants Pass and surrounding business communities by providing exceptional IT managed services. We look forward to many more years of giving you the highest level of support possible so that you can focus on getting business done. With this anniversary we plan on rolling out some enhancements to our monthly service offerings:

Enhanced Monthly Maintenance


Standard Maintenance: For those who are not current managed clients, these basics have always been a part of our service offering:

  • 5-year Technology Plan & Budget
  • Full Network Inventory
  • Hard Disk Checkups (Bi-Monthly)
  • Hard Disk Defragmentation (Monthly)
  • Temporary File Cleaning (Weekly)
  • Anti-Virus Software (Constant Monitoring)
  • Operating System Updates (Weekly)
  • Error Log Monitoring (Constant Monitoring)
  • Power Settings Management (Constant Monitoring)
  • Windows Services (Constant Monitoring)

Continued Improvements: Over the past 3 years we have also added the following features to our service at no additional costs:

  • Ticketing System Portal
  • Email Support to Create Tickets
  • Security Incident Response Plan
  • Vendor Information Tracking
  • Third-Party Software Updates (Monthly on Firefox, Chrome, Acrobat Reader, ….)
  • Email Blacklist Checking (Daily)
  • Warranty Checking (Monthly on All Major Brands)
  • Operating System Intrusion Detection (Constant Monitoring)
  • Support for MacOS & Linux (Constant Monitoring)
  • Server Applications (Constant Monitoring)
  • Hardware Events (Constant Monitoring)

Enhancements to Come: In September, we will be adding these new exciting features to our service:

  • DNS filtering – this will further protect your network from external threats by stopping accidental surfing to malicious sites. It also can increase productivity and network speeds by limiting wasteful frivolous surfing during company time.
  • Dark Web Scan – Each monthly client will have the “Dark Web” scanned to see if any email addresses connected to the company have been involved in a previous password breach.
  • Weekly Security Newsletter – Farmhouse Networking is partnering with a national security non-profit to deliver up-to-date news and information about how to stay safe online. These weekly newsletters will be packed with valuable information and delivered to everyone in your organization.

As our service offering has expanded, we have deepened our ability to monitor our customers networks to proactively respond to alerts before they become problems. We have continued to add levels of protection to make sure that our clients systems are safe from the ever-expanding list of threats. All this has been done at no additional cost, despite inflation, up to this point. To continue offering this high level of service, Farmhouse Networking is making a couple small changes to its prices that will be effective September 1st, 2018.

  • Monthly Maintenance Clients – our services are based on a per device basis and the cost per workstation will be $25 per month for remote maintenance and $50 per month for full service maintenance. All other prices will remain the same for every other device on the network. This will only effect clients whose contracts are renewing after September 1st, 2018 – any renewed before that will keep their prices the same for the next 12-month term.
  • Small Business Clients – those who do not have a server and have less than 5 workstations, our hourly rate will be $80 per hour for on-site service and $40 per hour for remote service (billed in 15-minute increments). That is only $10 more for on-site support and $5 more for remote support.
  • Standard to Medium Clients – those with a server or more than 5 workstations, our hourly rate will be $120 per hour for on-site service and $60 per hour for remote service (billed in 15-minute increments). That is only $10 more for on-site support and $5 more for remote support.
  • Tier-3 Clients – those technology companies that utilize our advanced expertise to better serve their clients, our hourly rate will be $40 per hour for remote service (billed in 15-minute increments). That is only $5 more for remote support.
  • Charity Clients – those non-profits that pay for support, our hourly rate will remain at $70 per hour for on-site service and $35 per hour for remote service (billed in 15-minute increments).

For all our monthly maintenance clients, we will be calling to schedule our semi-annual meeting to check-in with you during the month of September. At that time we will be performing another network inventory to insure that all network assets are covered properly under your current contract. We cannot thank all our clients enough for your continued use of our IT services. We look forward to continuing to serve you.

Know the state of your flocks,
and put your heart into caring for your herds,
for riches don’t last forever,
and the crown might not be passed to the next generation.
After the hay is harvested and the new crop appears
and the mountain grasses are gathered in,
your sheep will provide wool for clothing,
and your goats will provide the price of a field.
And you will have enough goats’ milk for yourself,
your family, and your servant girls.
Proverbs 27:23-27

Now Featuring: third-party software updates

third-party software update

In a continuing effort to offer the best remote monitoring & maintenance available and to enhance the security of our clients even more, we are now offering updates to several of the most popular third-party software packages. This is in addition to the Windows patching, system health checks, system maintenance, managed antivirus (included for free), and website blacklist monitoring that now come standard with our remote monitoring & maintenance service. Here is a summation:

Third-Party Software Updates

Google Chrome: web browser made by Google.

Firefox: web browser made by the Mozilla Foundation.

CCleaner: system cleaning utility (now owned by AVG).

Adobe Acrobat Reader: PDF viewer made by Adobe.

Adobe Flash Player: website animation plugin made by Adobe.

Java Runtime: website programming plugin made by Oracle.

There is a long list of other software that we can update for you automatically, but have chosen these in particular to update as they are the most likely to be exploited and least likely to be updated regularly.

If your company has software that needs to be automatically updated or would like to sign-up for remote monitoring and maintenance, then contact us for assistance.

WannaCry Ransomware Spread Halted by Webroot

Webroot & WannaCry Ransomware

WannaCry Ransomware: Webroot protects you.

Ransomware attacks continue to spread around the world this weekend, after the initial damage inflicted on healthcare organizations in Europe on Friday.

The criminals responsible for exploiting the Eternal Blue flaw haven’t yet been identified, but up to 100 countries have hit with WannaCry ransomware, with Russia, Ukraine and Taiwan among the top targets.

The ransomware first appeared in March, and is using the NSA 0-day Eternal Blue and Double Pulsar exploits first made available earlier this year by a group called the Shadow Brokers.  The initial spread of the malware was through email, including fake invoices, job offers and other lures with a .zip file that initiates the WannaCry infection.  The worm-like Eternal Blue can exploit a flaw in the Server Message Block (SMB) in Microsoft Windows, which can allow remote code execution.  This flaw was patched in Microsoft’s March 2017 update cycle, but many organizations had not run the patch or were using unsupported legacy technology like XP.

What’s New

Today, Microsoft has released emergency security patches to defend against the malware for unsupported versions of Windows, including XP and Server 2003.

Overnight and today, it has become clear that a  kill switch was included in the code.  When it detects a specific web domain exists—created earlier today—it halts the spread of malware.  You can learn more at The Register.

As a Webroot customer, are you protected?  YES.

Webroot SecureAnywhere  does currently protect you from WannaCry ransomware.

In simple terms, although this ransomware is currently causing havoc across the globe, the ransomware itself is similar to what we have seen before.  It’s the advanced delivery mechanism that has unfortunately caught many organizations off guard.

In addition to deploying Webroot SecureAnywhere as part of a strong endpoint control strategy, it is essential you continue to keep your systems up-to-date on the latest software versions, and invest in user education on the dangers of phishing, ransomware, social engineering and other common attack vectors.

If you have any questions about your Webroot deployment, reach out to our Support Team now.

And, if you are not a Webroot customer, we encourage you to trial Webroot SecureAnywhere now.

Cisco Meraki Ticking Time Bomb

A series of recent security bulletins from Cisco, on February 2nd, detail an issue that has been discovered in several of their devices. Here is a summation:

Cisco ASA Security Appliances

FN-64228 : ASA 5506, ASA 5506W, ASA 5506H, ASA 5508, and ASA 5516 – these models all use the same clock signal part from the same vendor which has been found to degrade over time. After 18 months of continued operation this component will fail and cause the device to stop functioning, no longer boot, and will not be recoverable.

“Customers with affected products that are under warranty or covered by any valid service contract as of November 16, 2016 should go to the Clock Signal Component Issue page and follow the instructions in order to request replacements.” These replacements will be prioritized based on time in operation.

Meraki Router & Wireless APs

Meraki Notification – MX 84 & MS350 Series – these models all use the same clock signal part from the same vendor which has been found to degrade over time. After 18 months of continued operation this component will fail and cause the device to stop functioning, no longer boot, and will not be recoverable.

” Meraki will reach out to customers via email and on the dashboard to arrange replacement and the return of affected units.”

If your company is currently using one of the affected devices and have not heard from your current IT services provider about the replacement schedule, then contact us for assistance.

Oregon Cyber Task Force – Cyber Attack Mitigation

During a recent briefing from the FBI’s Oregon Cyber Task Force in Medford, OR they detailed best practices and industry standards for cyber attack mitigation. FBI special agents started with information and statistics about the most recent threats giving specifics of how the attacks were executed. Security Architect from the State of Oregon then outlined the specifics of how to mitigate these threats properly. Here is a summation:

Current Threat Landscape

Business Email Compromise (CEO Fraud): Involves cyber criminals posing as business executives at companies that regularly perform wire transfers. After compromising the executive’s email, the criminal requests employees to perform wire transfers to the criminal’s bank account. FBI Internet Crime Complaint Center (IC3) has reported over $3 billion of losses worldwide due to this threat.

Ransomware: Ransomware is a form of malware that targets weaknesses in networks to deny the availability of critical data by encrypting it and demanding a ransom for the encryption keys to decrypt the data. Ransomware is frequently delivered through spear phishing emails to end users.

Point of Sale (PoS) Malware: Cyber criminal steals payment card data by remotely infecting PoS systems with malware without the need to physically access the cards or the devices used to process them. This allows criminals to compromise PoS systems on a large scale with larger victim base.

Insider Threat: An insider is a current or former employee who has access to an organization’s network and intentionally misuses that access to negatively affect the company. IC3 has recorded business losses from insider threat to be between $5,000 to $3 million.

Internet Extortion: Victims are threatened by cyber criminal with Distributed Denial of Service (DDoS) attack that will make access to their e-commerce site severely degraded or impossible if they victim does not pay to appease them. These can be real or fake with price tags in the neighborhood of 50 bitcoin or about $30,000.

Cyber Attack Mitigation

Here is a list of items that will need to be addressed to comprise a complete mitigation plan:

  • Create company policy in regards to how wire transfers are handled that require verbal or in-person authorization from multiple company executives
  • Create company policy restricting details that can be shared  about job duties and company hierarchy on social media
  • Review National Institute of Standards and Technology (NIST) Cybersecurity Framework and  adopt risk management processes
  • Create, implement and keep up-to-date an incident response plan
  • Create company policy and implement lawful network monitoring
  • Have proactive relationships with law enforcement agencies – silence is letting cyber criminals win

Practical Security Best Practices

  • Network Segmentation – keep the guest wireless separate from the local network, keep payment processing in its own network and keep web servers in the Demilitarized Zone (DMZ) of the network.
  • Use firewall access rules, Active Directory Group Policy and physical security measures to limit unsecure access to every segment of your network.
  • Restrict usage of administrator level access by creating alternative accounts for these purposes that are not used for local login. Keep these accounts monitored.
  • Implement automated patching and managed virus scanning on all systems. Remove any unsupported / non-updateable software or sytems on the network.
  • Restrict remote access to the network to specific users and use only secure protocols like RDP through VPN
  • Conduct periodic testing of all security measures to identify weakness or failing procedures and adjust systems accordingly

Advanced Mitigation Processes

  • Use multi-factor authentication wherever possible
  • Establish baseline of applications used then implement application whitelisting
  • Standardize encryption for data both at-rest and in-transit
  • Conduct perimeter filtering via Intrusion Detection System (IDS)
  • Regularly backup system logs in a segregated portion of the network to prevent tampering

If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

ADPREP Windows 2008 R2 Server into 2003 Domain

After finishing the migration of a client to their new cloud-based Line of Business SaaS application, it was time to finally get rid of the last Windows 2003 Small Business Server that we manage. The client had a Windows Server 2008 R2 Standard server that used to be the database server for the on-premise application which was being re-purposed as the new Primary Domain Controller (PDC) for the domain. After installing the Active Directory Domain Services (ADDS) role on the new server, I went to run DCPROMO on the new server and found that it asked me to run ADPREP /FORESTPREP on the domain. Took me a little bit of searching to find the Windows 2003 Server media and ran the command successfully, but this did not do the trick – turns out I needed the Windows 2008 R2 Server media and run the ADPREP32 command several times to complete the domain preparation for the new server to be DCPROMO successfully. Extracted the support directory from the media ISO to a folder on the root of the old Windows 2003 Small Business Server and then ran the following commands in order:

ADPREP32 /FORESTPREP

This one took a long time as the server was going from Schema 31 to Schema 47.

ADPREP32 /DOMAINPREP

This one stated that I needed to run the next command, so I did.

ADPREP32 /DOMAINPREP /GPPREP

The command actually stated that the update was already applied. So went back to the Windows 2008 R2 Standard server and ran DCPROMO again which told me that I needed to run one more command.

ADPREP32 /RODCPREP

Ran this one even though I had no plans of having a Read-Only Domain Controller (RODC) in the domain. After all these commands the new server was able to be DCPROMO into the domain controller role. Now all that is left is FSMO roles, DNS, DHCP, printers and file shares.

If your company is going to use full disk encryption or has compliance requirements that you need consulting for, then contact us for assistance.

Archives

Categories

Plant a Seed @ 541-761-9549
233 Rogue River Hwy #873 Grants Pass, OR 97527
Mon-Fri: 9:00am-5:00pm
support@farmhousenetworking.com
© 2016-2023- Farmhouse Networking. All rights reserved
Terms and Conditions Privacy Policy

Evaluation Signup

[contact-form-7 id="452" title="Free Network Evaluation"]