|
To
view this update as a Web page, copy this link into your
browser: www.qtsnet.com/stayinformed/quiknews/quiknews_september2003.htm.
To
subscribe or unsubscribe, please follow instructions at
the bottom of this page.
Welcome to the September edition of QTS QuikNews, our
monthly e-mail newsletter. In this monthly e-mail, you
will receive an update of what's new at QTS - new products
we support, new patches and upgrades, solution ideas and
promotions to save you money, and information about our
company and our clients.
In
this issue:
QTS
NEWS
QTS
IS HIRING!
QTS is recruiting for senior level technical personnel, as
well as entry and senior level sales staff. If you know
anyone who might be a good fit, please have them submit
their resume to Liz Meechan, our Office Manager. Liz can
be reached at lmeechan@QTSnet.com,
or (973)984-7600 x223.
Welcome
Aboard, and Congrats!
There has been a lot of activity at QTS over the last
month. Please join us in congratulating:
·
Darren
Winkler, on joining the QTS new business development team
as a Solutions Consultant covering Bergen, Hudson, Passaic
and Sussex counties;
·
Ernest
Forsyth, on moving from the technical team over to the new
business development team as a Solutions Consultant
covering Essex, Morris, Union and Warren counties;
·
Ken
McGowan, on his promotion to Lead Systems Engineer; and
·
Scott
Messick and Frank Velasco, on joining the QTS technical
team.
Congrats
to AKA Enterprise Solutions!
QTS’ partner for accounting, ERP and CRM solutions, AKA
Enterprise Solutions of New York, NY, was recently
selected by Microsoft as its Medium Business Partner of
the Year for Microsoft Business Solutions, for the NY/NJ
District. For more information, visit www.akaes.com/news/akapress.htm#sept08.
PRESS
RELEASES
QTS
LAUNCHES “SYSTEMS STRATEGY CHECK-UP” PILOT CAMPAIGN
WITH MICROSOFT
9/29/2003:
QTS last week launched a new customer campaign, as part of
a joint pilot test with Microsoft. The campaign
offers to qualifying Northern New Jersey Medium Business
customers a "Systems Strategy Check-Up" - a
consultation with a QTS engineer and a Microsoft
representative to review how the customer is using
Microsoft software, and how the customer can maximize the
value from their Microsoft investment in using Microsoft
solutions to support their business. Read
more
PRESIDENT'S
CORNER
One
would think we IT professionals have a handle on this by
now. We’ve been through Code Red, NIMDA and plenty of
other viruses and worms over the past few years. There has
been plenty of time to learn the lessons, sometimes
painfully. And yet, over the course of this year, I’ve
lost track of the number of IT managers and businesspeople
I’ve spoken with who were affected by Blaster, Sobig and
Slammer. And they were lucky – security analysts are
genuinely surprised it wasn’t worse – imagine a worm
like Blaster, exploiting a recent vulnerability, but with
a destructive payload such as wiping hard disks, or
insidiously corrupting data files. Professionals are
surprised we actually haven’t seen this yet, and believe
it is coming.
And
yet we all have antivirus software and firewalls. Why are
we still having these problems, after the major
investments we’ve made in security technology?
Unfortunately, it’s not just about the technology. The
people and process elements of security drive how the
technology is used, or not used, and a strategic approach
to security is necessary.
It
seems like every major topic boils down to “ten
points,” and in fact I’ve come up with these ten key
steps to truly securing a small/medium business network.
It is possible not all steps apply to all people, as
different people are comfortable with different levels of
risk. However, I would say that they represent ten “best
practices” that should generally be applicable across
the spectrum.
If
you do all ten of these, congratulations. Make sure your
boss knows you’re doing things right. More important,
you’ll be able to sleep better at night, as you’re
protecting the assets of your business. But for those who
need some help, here goes…
1.
Begin at the Beginning – Or, as Steven Covey
would say, begin with the end in mind. Develop a Security
Policy, whether it is a comprehensive, detailed document
(preferably) or a basic acceptable use policy for email
and web surfing. If you have not defined what you are
protecting, and how you want to protect it, then how can
you intelligently go about doing so? Security
professionals agree that all actions ultimately should
flow from policy, at a business level, to support business
goals and objectives. Security Policies also help protect
against legal liabilities, and provide a framework for
discipline against unauthorized behaviors. However, many
folks still don’t have policies, in spite of their
importance.
2.
Manage Patches – in spite of free tools like
Microsoft’s Software Update Service and Windows update,
most folks still don’t have a comprehensive or
bullet-proof way of distributing and managing patches.
Blaster spread from unpatched system to system, exploiting
a vulnerability that was easily closed. SUS works (for
Windows 2000 and XP clients). It is important to test
patches against your key applications before broadly
distributing them, so set up a sample/test group first to
do so. For most small/medium businesses, server patches
are still best done manually since servers tend to be more
sensitive, but this is still critically important, and
don’t let it slip. Many of our customers now have us
review security bulletins for them, and manage this
process since they don’t have time and know it needs to
be done.
3.
Harden your Network – Just because systems are
patched does not mean they are not vulnerable. Next, you
need to focus on other vulnerabilities such as unnecessary
services, software bugs, weak or missing passwords, and
other weaknesses. The best way to go about this is to scan
your systems, from outside your firewall and also from
inside (once you’re hacked or malicious code gets past
it, the firewall does not matter). Microsoft offers a
free, basic scanner called the Baseline Security Analyzer
that is a good start, but you really want to use something
industry strength. QTS uses Symantec’s NetRecon when
performing Vulnerability Assessments for its customers’
networks, to generate a comprehensive report of
vulnerabilities and the affected systems. These systems
can then be locked down to remove the vulnerabilities.
This
is such a critical step. Many people never get to it. And
most firewalls and servers are installed but never truly
hardened. Then, we wonder why we have security problems.
4.
Control Perimeter Traffic – A poorly configured
firewall is worse than none at all, since it gives a false
sense of security. Over the last year, our engineers have
seen firewall after firewall that was put in
half-configured. High ports are open, all outbound traffic
is allowed, unauthenticated traffic is allowed to the
internal network. These are common, but easily fixed,
issues. A basic review of firewall configuration, and
corrective action (always test changes, though!) only
takes a few hours, and is invaluable. Many firewalls are
configured poorly, because most people don’t really
understand how to configure them properly.
It
is also important to have your firewall, or proxy server
if applicable, inspect the traffic. It is no longer
adequate to block traffic based simply on port number, as
most traffic is easily tunneled through HTTP. Perimeter
security needs to look at what the traffic contains and is
doing, not just what port it is using. In some cases, this
may require multiple layers of security – which is
absolutely appropriate as your business size, or business
risk, increases on the scale.
5.
Use Smart Antivirus Software – People wonder
why they still have viruses. Most antivirus packages now
support automated downloads of current signature files,
and furthermore of current scan engines (which process the
signatures – new sig files are useless if the scan
engine is outdated). Make sure you’re auto-updating and
downloading current code across your network. Make sure
all of your systems are covered – rogue systems are
usually the culprit for things like worms. I’ve heard
recently of systems that got infected by a worm within
minutes of being put on the network, before IT could apply
patches. Of course, something else had to be infected to
cause this…
Smart
antivirus software applies behavioral scanning – it
looks at what is being done inside the system, and can
detect malicious code based on behavior as well as
signatures. Whether you call the software antivirus,
personal firewall or host intrusion detection, some form
of workstation protection is important these days, across
the entire network.
Intrusion
Detection can be considered another element of Host
systems defense. Host IDS software monitors what’s going
on inside a server operating system – hot it is using
memory, whether unauthorized access to the file system is
occurring, etc. – and can take action based on
unauthorized behaviors. Because of the more proactive
nature here, and the checkered past of IDS systems of the
past, vendors have moved to calling this Intrusion
Prevention, rather than intrusion detection. Network IDS/IPS
systems monitor the wire – network traffic – from a
similar vantage point.
In
next month’s issue, we’ll finish this column with the
final five steps, and some concluding thoughts.
As
always, feel free to email me your comments or thoughts at
nrosenberg@QTSnet.com.
Thank you.
Neil
Rosenberg
President & CEO
Quality Technology Solutions
PARTNER
SPOTLIGHT: Werthheim, Inc.
This
month QTS is spotlighting its partner for document
management, document imaging and document assembly
solutions, Wertheim Inc. Wertheim Inc. is a premier
provider of document management systems (DMS) and office
automation solutions, and one of the top business partners
in the region for both Hummingbird and iManage. The
company assists clients in all areas of document
management, document imaging, document assembly and
knowledge management (from a document-centric
perspective), from initial planning through final
implementation, and also provides preventive maintenance
and audit services.
The
entire staff at Wertheim Inc. has perfected a style of
interaction which gains accolades up and down the firm's
client list. Put most simply, clients like them.
Their roster of successful engagements includes clients
new to document management, as well as firms who needed to
upgrade to the newest versions of existing document and
knowledge management technologies. Their approach to
customers and technology is very similar to QTS’.
Wertheim's
commitment to document and knowledge management led to the
creation of a strong line of software products.
These software tools work with your document management
system to facilitate the synchronization of key document
data across multi-library environments; simplify the
process of granting security to users; and provide an
array of DMS administrative utilities. These tools
were written to help manage and administer DOCS Open and
iManage environments more easily.
Wertheim
is a leading regional service provider, and clients
benefit from their depth of experience with the product
offerings of Hummingbird (DOCS Open/CyberDOCS/PowerDOCS),
iManage, SoftWise (macros), as well as document assembly
systems such as HotDocs and document imaging systems from
Kofax and Optika. While QTS continues to build,
enhance and support networks, this partnership will
significantly extend our capabilities and the total range
of services that we can offer clients. For more
information on Wertheim Inc., please view their web site
at www.wertheiminc.com,
email them at info@wertheiminc.com,
or call 212-413-8600. Or, contact your QTS Account
Manager.
|
