Since we have approximately 4 more months until the Sarbanes-Oxley Act (SOX) will be applied to all publicly traded businesses, I’d like to give everyone a little refresher course. Although it won’t apply to most of our clients, the act proves to be a solid compliance guideline for any company. Due to the trickling effects of larger businesses and the tightening of requirements from lenders and such, it’s not a bad thing to follow.
SOX Compliance Summary
Designed to:
– protect investors and creditors of public companies
Applies to:
– Publicly traded corporations with larger than $75 Million in Public Equity (expires Dec 2009)
– Documents and files pertaining to financial statement generation (atleast 5 years)
Provisions:
Section 404 – Requires management to report on the effectiveness of their internal financial controls and for outside auditors to attest to the management reports.
Section 802 – Makes it a criminal violation to alter, destroy, mutilate, conceal or make a false entry in a record, document or tangible object with the intent to impede, obstruct or influence any investigation or bankruptcy matter.
Section 1107 – Provides criminal penalties for retaliation related to an employee’s whistle blowing activities.
Section 301 – Requires the independence of audit committees.
Section 302 – Mandates that CEOs and financial officers certify financial statements.
Section 406 – Requires public companies to disclose whether they have adopted a code of ethics governing the behavior of senior financial officers.
General Business Process recommendations:
– Segregation of duties
– Establish a policy of archival and backup (onsite and offsite)
– Have independent party review books on a regular basis (CPA)
– Have good documented procedures
Quickbooks recommendations:
– Review Financial data using reports
– Setup user accounts with only necessary priviledges
– Implement audit trails
– Backup regularly (minimum retention time of 3 periods)
General Info:
Sarbanes-Oxley regulations require that an audit trail of log files and all pertinent documentation must be retained for five years. SOX defines which records are to be stored and for how long, focusing specifically on retention of audit and accounting records that relate to the generation of financial statement that will be submitted to shareholders and the SEC. Both paper and electronic versions of this documentation must be retained. SOX does not, however, specify how they are to be stored — best practices for data protection, disaster recovery and storage management pertain. That means the impact of Sarbanes-Oxley can be felt by nearly every component of IT operations, including messaging, storage, virtualization and even networking, so long as financial data or activity occurs on them. In turn, IT must be able to produce electronic records of these audit trails for compliance audits.
The IT departments of all public companies must be aware of the key requirements of SOX, including log management, backups and all relevant electronic communications. New platforms for communication enabled by Web 2.0 technologies like blogs, wikis and social networking are introducing all-new compliance headaches, as gigabytes of data are generated through messaging and sharing. If it pertains to finance and accounting, enterprise IT professionals must track and archive it for the inevitable visit by a compliance auditor looking for log files. Increasingly, compliance officers are using event log management software to track key moments where data enters or exits an enterprise, like email systems or the addition or departure of employees with access to sensitive financial data.
Windows Server 2008 SSL VPN (SSTP)
Now-a-days, every business is mobile, which means a VPN connection is most likely needed. The problem is when clients travel to hotels or other countries, where firewall compatiblity and configuration can cause connectivity issues. Fortunately, there is an answer for this: SSL VPNs. Since an SSL VPN connection is secure and allowed on almost all firewalls, remote users will have a much more reliable connection mechanism; no matter where they are. To top it off, SSL VPN (SSTP) is a feature natively bundled with Windows Server 2008. How cool is that?
How does SSL VPNs help?
Clients supported: Vista SP1+, Windows 7, Windows Server 2008
What are the high level steps involved to setting up Windows Server 2008 SSL VPN connections (SSTP)?
How-To configure Windows 2008 for SSTP VPN
1. Install IIS on VPN server with all security settings marked for installation
2. Create a Certificate Request in IIS console
a. Make sure common name is actual Internet Hostname clients will connect to (e.g. vpn.company.com)
3. Cut and Paste the certificate request into your SSL provider’s website
4. Install any Intermediary certificates and your SSL certificate per your SSL provider’s instructions (DO NOT bind the certificate to a website in IIS)
5. Install Routing and Remote Access
6. Load the Routing and Remote Access MMC and run the wizard to enable it (Select Custom -> VPN if you are using only 1 NIC)
8. Enable Dial-In access for the remote user’s AD account
9. Enabled SSL connection (port 443) from the outside
10. Update DNS for the domain with the common name of the certificate
11. Test the SSL VPN connection by choosing SSTP in the vpn network connection properties
If the connection doesn’t work, make sure the proper certificate is bound following:
1. Make sure the right certificate hash is bound (netsh http show ssl)
a. If necessary, delete and readd the correct certificate binding…
1. Remove binding from IPv4 (netsh http delete ssl 0.0.0.0:443)
2. Remove binding from IPv6 (netsh http delete ssl [::]:443)
3. Delete registry entry for the hash (reg delete hklmsystemcurrentcontrolsetservicessstpsvcparameters /v sha256certificatehash /f)
4. Add binding from IPv4 (netsh http add sslcert ipport=0.0.0.0:443 certhash=<replace with your cert hash> appid={ba195980-cd49-458b-9e23-c84ee0adcd75} certstorename=MY)
5. Add binding from IPv6 (netsh http add sslcert ipport=[::]:443 certhash=<replace with your cert hash> appid={ba195980-cd49-458b-9e23-c84ee0adcd75} certstorename=MY)
Helpful links to configuring SSTP VPN:
The case of Windows 7 not wanting to install on your hard drive partition
As an IT Consultant, I often find myself mucking with the latest and greatest things before I would even consider recommending them to clients. The down side to this is the time spent during a Saturday afternoon trying to install Windows 7 Professional 64-bit on my home desktop. I was so impressed with the RC1 version, that I wanted to deploy it to my single desktop (can’t be worse than Vista… heheh)
Apparently, Windows 7 is very picky about the hardware/harddrive/partition/MBR it’s installed on. When I ran the installation, my hard drive and the system partition would be displayed, but I could not get it to actually start the installation..
I tried the following, but to no avail:
Looking at the setup logs (Shift-F10 -> notepad windowspanthersetupact.log), I saw a bunch of “not system disk”, “not primary partition”, “not enough space”, “not good enough” errors…
Finally, I tried to think outside of the box. I decided to repair my MBR and Boot record the old fashion way. I booted off a Windows XP SP2 CD and ran the recovery console. Once in, I ran “fixmbr” and “fixboot”. I then rebooted into Windows 7 setup and was able to click Next to continue with the Windows 7 Professional installation.
Hopefully, this technique would work for most of you. If it still doesn’t work for you, try making sure there’s no USB keys or any other storage device connected when you install.
Sarbanes-Oxley Act update…
Since we have approximately 4 more months until the Sarbanes-Oxley Act (SOX) will be applied to all publicly traded businesses, I’d like to give everyone a little refresher course. Although it won’t apply to most of our clients, the act proves to be a solid compliance guideline for any company. Due to the trickling effects of larger businesses and the tightening of requirements from lenders and such, it’s not a bad thing to follow.
SOX Compliance Summary
Designed to:
– protect investors and creditors of public companies
Applies to:
– Publicly traded corporations with larger than $75 Million in Public Equity (expires Dec 2009)
– Documents and files pertaining to financial statement generation (atleast 5 years)
Provisions:
Section 404 – Requires management to report on the effectiveness of their internal financial controls and for outside auditors to attest to the management reports.
Section 802 – Makes it a criminal violation to alter, destroy, mutilate, conceal or make a false entry in a record, document or tangible object with the intent to impede, obstruct or influence any investigation or bankruptcy matter.
Section 1107 – Provides criminal penalties for retaliation related to an employee’s whistle blowing activities.
Section 301 – Requires the independence of audit committees.
Section 302 – Mandates that CEOs and financial officers certify financial statements.
Section 406 – Requires public companies to disclose whether they have adopted a code of ethics governing the behavior of senior financial officers.
General Business Process recommendations:
– Segregation of duties
– Establish a policy of archival and backup (onsite and offsite)
– Have independent party review books on a regular basis (CPA)
– Have good documented procedures
Quickbooks recommendations:
– Review Financial data using reports
– Setup user accounts with only necessary priviledges
– Implement audit trails
– Backup regularly (minimum retention time of 3 periods)
General Info:
Sarbanes-Oxley regulations require that an audit trail of log files and all pertinent documentation must be retained for five years. SOX defines which records are to be stored and for how long, focusing specifically on retention of audit and accounting records that relate to the generation of financial statement that will be submitted to shareholders and the SEC. Both paper and electronic versions of this documentation must be retained. SOX does not, however, specify how they are to be stored — best practices for data protection, disaster recovery and storage management pertain. That means the impact of Sarbanes-Oxley can be felt by nearly every component of IT operations, including messaging, storage, virtualization and even networking, so long as financial data or activity occurs on them. In turn, IT must be able to produce electronic records of these audit trails for compliance audits.
The IT departments of all public companies must be aware of the key requirements of SOX, including log management, backups and all relevant electronic communications. New platforms for communication enabled by Web 2.0 technologies like blogs, wikis and social networking are introducing all-new compliance headaches, as gigabytes of data are generated through messaging and sharing. If it pertains to finance and accounting, enterprise IT professionals must track and archive it for the inevitable visit by a compliance auditor looking for log files. Increasingly, compliance officers are using event log management software to track key moments where data enters or exits an enterprise, like email systems or the addition or departure of employees with access to sensitive financial data.
What does Server 2008 SP2 and Vista SP2 have to offer?
Below is a quick rundown of all the goodies in the new Service Pack for Windows 2008 and Windows Vista. Of course, SP2 includes all hotfixes and other updates post SP1, but unlike traditional methods, Windows Server 2008 SP2 and Windows Vista SP2 uses the same Service Pack executable, which makes it easier to deploy.
Although this update provides minimal changes, it’s always recommended to do a test rollout before deploying in full.
Warning:
This was taken from Information about Service Pack 2 for Windows Vista and for Windows Server 2008
What it has to offer:
Windows Server 2008 offerings:
Most useful part about SP2:
Service Pack Clean-up Tool (compcln.exe) – Deletes older versions of the RTM and SP1 based files
Requirements:
SP1 has to be installed prior to updating.
Where to get it:
Windows Server 2008 SP2/Vista SP2 (x86, 32bit)
Windows Server 2008 SP2/Vista SP2 (x86, 64bit)
What the buzz is about: Virtualization and Consolidation
I know everyone has been hearing this continuously for the last 3 years or so, but what does it actually mean? How does it help the IT department and how does that help the business? While the two words of Virtualization and Consolidation are separate topics, they often go hand in hand. I believe the reason for this are to take advantage of new hardware capabilities and new virtualization technologies. Lets say you bought a new server and wanted to consolidate and migrate all the data from your file server and your mail server. You’ll essentially end up with a server with more utilization. Sure, you’ll save a little on time and the electric bill, but that isn’t going to give you the “WOW” factor when it comes to analyzing your ROI. You’ll soon realize that consolidation usually will not fully utilize the full capabilities of your new hardware. Unlike oil and water, implementation of Virtualization creates a symbiotic relationship with Consolidation. One could also say it’s the catalyst to a higher ROI.
Why is there a push now?
Summary of benefits of Consolidation and Virtualization:
When will you know it’s “GO TIME”?
Microsoft Office 2007 Service Pack 2 – Briefing
Backgrounder:
Like everything Microsoft, downloading and applying updates and patches are the key to keeping your computer running efficiently. Today, we are focusing on Microsoft Office 2007 Service Pack 2.
It has been more than a year (December 2007) since Microsoft has released a single service pack to keep computers up-to-date without having to download a bunch of little patches. This significantly reduces deployment times for any oganization. Furthermore, while most service packs are just a compilation of previous released patches and fixes (through February 2009), Office 2007 SP2 will also include feature enhancements and performance enhancements. Will the PDF support mean the end of downloading Acrobat Reader? We’ll see…
Release Date:
End of April 2009.
Changes, Fixes, Patches, Enhancements:
Where can you get it?
Direct File Download Link
Downloads page link
Release info link
Conficker (aka Downadup) – FAQ
What kind of damange can this virus do?
What computers are affected?
What are some of the symptoms of being infected by the Conficker worm?
How do I prevent infections?
How does the software spread?
How do I remove the worm from an infected computer?
How do I protect my computer from similar threats?
What can Windows Server 2008 do for you?
I know there are many websites that lists a bunch of features of Microsoft’s latest Windows Server 2008. I also know that these lists sometimes forget the fact that technology in the workplace is only as good as the business value benefited from it. I understand that during these tough economic times, migrating and upgrading your systems to Windows Server 2008 will be an option that is heavily scrutinized. Hopefully, this blog entry will help you create an informed decision for your business.
Below are the features that stand out to me when deploying Windows Server 2008. I will try to explain how these features can translate to a more secure, efficient, and stable network.
Active Directory
Essentially, this increases uptime for a domain controller and it’s installed services. Currently, when security patches must be applied, offline defragmentation or authoritive restores must be performed, the entire server has to be rebooted. This equates to significant downtime for ALL the services provided by the server. If this was a heavily used server, such as a file server, a lot of users would end up calling the IT department.Scenario:
Lets say an Active Directory object needs to be restored from backup. Previous to Windows Server 2008, a server would have to be restarted in Directory Services Restore Mode. During this time, ALL services provided by that server would be offline. Then, once the restore is complete, we must restart the server again. Now, with RADDS, you only need to stop the service, perform the restore, and restart the service. Meanwhile, your other services are still working.
Translated Value:
Increased uptime, Simplified restoration of Active Directory objects.
Business Circumstance:
This is useful for all businesses.
Back in the good ‘ol NT4 days, Microsoft had primary and backup domain controllers (PDCs and BDCs). The backup domain controllers would be Read-Only. Then, they touted the multi-master capabilities of Active Directory for Windows 2000/2003. What they didn’t tell you was the best solution was “C. All of the Above“. In Windows Server 2008, we can have multi-master domain controllers AND read-only domain controllers. When would you use either of these scenarios? Well, you would want multi-master replication for Fault Tolerance and Management Simplicity. Now, an RODC would allow for increased security since the LDAP database can not be tampered with. Unfortunately, there are limitations that might negate the benefits of this. Essentially, the RODC needs to have access to a writable Domain Controller in order to perform basic functions, such as DNS updates, password changes, and user authentication (if not cached on RODC). There could also be software compatibility issues.Translated Value:
This is a feature that’s great to have, but wouldn’t benefit an existing organization tremendously.
Business Circumstance:
This is most useful for medium/large businesses with multiple locations.
OS Enhancements
As with previous operating systems, when a file on the NTFS filesystem becomes corrupt, there’s no way to know unless you a) run chkdisk b) try to open the file. Of course, if you periodically run chkdsk to detect corruptions or try to open a corrupt file, you would have to reboot your server to fix it. This is not the case with Windows Vista and Windows Server 2008. In 95% of the cases, it will automatically detect a corruption in your filesystem and attempt to fix it at the same time. This eliminate the need to reboot. I’m sure everyone knows the disadvantages of having to reboot a computer by now (read previous sections).Translated Value:
Higher uptime, important data is recovered
Business Circumstance:
This is useful for all businesses.
Everyone can agree that Microsoft has it’s GUI advantages over Linux, while Linux has it’s high stability and security aspects due to it’s lack of “fluff”. Well, as Linux tries to enter the Desktop market, Microsoft is trying to imitate Linux with Server-core. IT provides a minimal (non-GUI) OS environment for running specific server roles, which reduces the attack surface for those server roles. Similar to Linux, in which you would manage your server from an SSH connection, Server Core could be managed from the local command console, Terminal Server connection, or using the MMC console. Once again, Server-core can only provide a subset of the full roles available to a full installation. Server-core can provide the following roles: Active Directory Domain Services (AD DS), Active Directory Lightweight Directory Services (AD LDS), DHCP Server, DNS Server, File Services, Print Services, Streaming Media Services, Internet Information Services (IIS), Windows Virtualization.Translated Value:
Increased security and performance gains, and ease of deployment due to low footprint.
Business Circumstance:
This is most useful for medium/large businesses with multiple locations.
Lets say you had to remotely connect to multiple servers at the Office, yet you are prevented from using a VPN connection. What do you do? Well, there are many ways around this, including the use of 3rd party applications, but Microsoft has blessed us with their solution. A TS Gateway securely proxies applications running the RDP protocol (Remote Desktop, Remote Applications, etc..) through SSL encryption. This negates the typical firewall configurations necessary to allow VPN tunnels to be created.Translated Value:
Mobile Office is even more robust. You can truly access your servers and workstations from anywhere.
Business Circumstance:
This is most useful for businesses running Terminal Services or those with lots of servers.
Aligned with their virtual application technology, TS Remote Application uses the RDP protocol to allow users access to specific applications stored on a server. Instead of using more computing resources than necessary and providing access to an entire Desktop, users can now be limited only to the capabilities of the application. Advance connection policies can be set in place to maintain compliance with security policies set within the company.Scenario:
Accounting staff requires access to the Quickbooks server when they are offsite. Using a VPN connection alone is not an acceptable solution since the data transfer size is too large. The use of Remote Desktop through a VPN connection would work, but that can cause unecessary confusion for users. With TS Remote Application, the Quickbooks application RDP file can be exported on a users’s desktop. When they run the file, either locally or remotely, they will see the Quickbooks applications open on their computer. This application is actually running on the remote computer, but the interface is exactly the same as if they opened it locally on their computer.
Translated Value:
Granular access to applications, secure access to network resources, improved capacity and performance for Terminal Services applications
Business Circumstance:
This is most useful for businesses running Terminal Services or those with lots of servers.
This service allows is the needed replacement for Remote Installation Services (RIS). Windows Deployment Services enables you to deploy Windows operating systems, particularly Windows Vista, using images and PXE booting. I know there are 3rd party applications that provide this capability in a more simplified manner, but they are often too costly. Once setup, WDS is a pretty cool application. It works well and have few heart-stopping limitations.Translated Value:
You can setup new Microsoft workstations quickly and in an automated way.
Business Circumstance:
This is most useful for new businesses or ones that are growing in the near future.
Here’s the deal. The IT industry is realizing that on average, the load on a server is pretty low due to minimal resource usage and advancing. This results in wasted Energy Costs and lower Return on Investment (ROI) in the hardware. Hyper-V is a hypervisor-based virtualization technology that allows servers to run multiple instances of Microsoft and certain Linux distributions. What is sometimes overlooked when it comes to virtualization is the ease and consistency in obtaining a solid backup and recovery of files using snapshoting technologies. Also, the management of these virtual servers are simplified since there is only one platform to work off of.Translated Value:
Increased efficiency of resources, increased stability, reduction in cost for new server deployments, High availability, increased security.
Business Circumstance:
This applies to all businesses. From consolidation to saving on energy costs, virtualization is beneficial for all businesses.
High Availability, ISP, VPN, Servers, and Your business.
You see and hear the buzz word swarming around the internet of networks with special setups that tout “High Availability” or sometimes commonly known as “H.A.”. What is it? What does it do for my business? Ultimately in today’s economic climate… Can I afford not to have it?
There are actually different types of HA that you can implement into you IT infrastructure. At its core, HA is a system designed implementation that ensures a certain absolute degree of operational continuity during a given measurement period. In simple business terms, HA makes sure your employees are able to continue working even if primary service providers or servers or your local network experiences some sort of an outage. Yikes!
As an example:
For small to medium sized business, you need a solution – High Availability.
Most administrators of small to medium sized networks are probably already assuming you need twice the amount of hardware, extra connectors, licenses, and more. Depending on the current network equipment you have, High Availability to a certain degree can very easily be a viable option.Lets take a very common scenario as a prime example of what High Availability can do.
“The Outage” has been avoided. Your High Availability Cisco router setup automatically switched over to the secondary ISP, and you were alerted of the switch over. Your employee’s continue along with their tasks, and may not have even noticed the internet disruption.
And because you were alerted of the ISP failover, you can easily send out a “Daily Tech Update” to your remote and C-level staff, letting them know to use the secondary Cisco VPN profile or to call you for assistance.
Windows 2008 Server – Easily Secure your FTP server
Today, it’s all about security. If you aren’t practicing good security, you are probably going to be held accountable for the information that sneaks into your network, and especially the information that can find its way out of your network.
Script kids and hackers alike all begin their first “hacking” by targeting what’s easy – The poor, unsuspecting FTP server. All day long, doing its job of blindly sharing and accepting files. Here are the four key parts of FTP (and its cousin Telnet) that make it insecure.
So you have your brand new shiny server with tons of disk capacity, and a clean install of Windows 2008 Server. You’re tasked with setting up the new company FTP site. If you have experience with setting up IIS and FTP services on Windows 2000/2003 server, then you know exactly how easy it is to setup FTP service. With Windows 2008 server, securing your FTP server became just as easy. And the benefits, immense!
Windows 2008 Server utilizes the method FTPES aka FTP Explicit mode. In explicit mode, an FTPS (FTP Secure) client must “explicitly request” security from an FTPS server and then step-up to a mutually agreed encryption method (usually the minimums are defined on the server). It currently isn’t packaged onto the Windows 2008 server install media, but information and the download can be found here http://www.iis.net/downloads/default.aspx?tabid=34&g=6&i=1619
Without this extra handshaking and communication, your server-to-FTP client communication is susceptible to snooping and hijacking. With these simple steps, your server avoids the pitfalls listed above, that plague many FTP servers out on the web.
Securing your new Windows 2008 based FTP server comes down to these steps:
Tada, you’re done! Now your Windows 2008 FTP server is protected. From beginning to end, Connection, Authentication, Authorization, Data Request, Data transfer. It’s all encrypted.