Roger's Information Security Blog

You dont have backups unless you have successfully recovered from them. Sometimes you just have to learn lessons the hardway if you dont take the time to learn them from others.
I’ve heard a lot of commercials lately pushing Mozy or Carbonite that pretty much guarantee that everyone has a hard drive failure at some point. This month the hard drive in my Dell Optiplex 755 at work gave up the ghost. Two weeks short of its end of lease. Very frustrating. But it was about to get more frustrating.
The enterprise desktop backup product we use is configured to backup the user profile, c:\data and c:\lotus. Unfortunately Vista is not a standard supported operating system at work, and the backup admin made a mistake when he configured the backup product to backup c:\users. It didn’t backup my user profile at all. So all I have is the backup I made in July when I migrated from XP to Vista. So I’m out quite a bit of work.
This really makes me wonder about all of my data. The trust is just gone right now. For my work computers, Should I be using Windows Easy Transfer to backup my files on a regular basis. Should I just take a ghost image on a scheduled basis, so I can recover easily? Hmmm, side note, I should check the software inventory for evidence of users performing rogue backups with Carbonite/Mozy etc.
For my home computer, I realize that only using Mozy’s free service I have a lot of mp3s and photos not backed up. That is important stuff to me. I also have never tested recovering even one file from Mozy. Need to do the due diligence.
Well, anyway if you’ve read all this and you want to check out Mozy for your home backups click on this link. We’ll both get 256MB extra storage space once you start using Mozy. Like I said though, I”d suggest verifying even a rudimentary recovery.
Its so easy to assume that things work correctly. Most of us dont have the time to verify that other people have done their jobs correctly. But when its going to really hurt if backups fail, it doesn’t take that long to do a test restore. Particularly if you have access to initiate the restore yourself.

I’ve written before about Mozy the online remote backup solution.
Through the end of October, if you signup and begin using Mozy backup, we both get an extra 512 MB of backup space. (this is normally 256 MB).
Your account has 2 GB of backup space for free. This is an easy way to get a bit more. The software is relatively easy to use. Give it a shot so that later you aren’t crying about your lost data.

Greg Playle’s article “The Seven Week Get Healthy Plan for Small Business” in this months ISSA Journal (ISSA Membership Required) outlines 7 security steps for small businesses to consider.
One of my friends recently received a telephone call from his doctor asking if he had an appointment. An upgrade of the appointment system had gone south and they were reconstructing the appointment book by calling all patients and asking them if they had an appointment. Whoever is handling the IT duties at these small businesses apparently doesn’t know to take a backup before starting a upgrade.
I’ve wondered many times just what the Mortgage guy or my Dentist is doing to protect my personal information. I feel like I don’t know them well enough to give them this article, at the same time as a customer don’t I have the write to be proactive in making sure my data is protected.
There are a couple of errors in the article. The first I hope was an editors mistake. While describing how to gather the physical address to use to whitelist what servers are allowed on the wireless network, the example given is an IP address.
The bigger problem is that the author has apparently not read George Ou’s Wireless Security Myths that Will Not Die. If the author had read that he would not be making some of the wireless security recommendations that he makes.
Do not broadcast the Service Set IDentifier (SSID). Kismet will reveal hidden SSIDs. Not broadcasting it doesn’t gain you much except against the causal browser. The casual browser is already stopped by your use of WPA2.
Worse yet, your client computers will now have to probe for that network everywhere you go.
See also Josh Wright’s article Issues with SSID Cloaking.
PCI 1.2 no longer requires the disabling of SSID broadcast. The message is starting to get out.
Turn on Wireless Security to at least 128 bit WEP
You’re only buying time by using 128 bit WEP over 64 bit. As the retailers have learned, NEVER USE WEP if you have something to protect. Since this article assumes you need to protect the small business, I think the recommendation needs to be a bit stronger. I think even WPA-PSK is suspect for a work environment.
It seems like some of the things suggest are belt and suspenders solutions. Others are more like belt and Hawaiian shirt. The belt is doing the work, the shirt is just there for looks. If you have WPA2 do you really need DHCP reservations and MAC address filtering? If they break your encryption are those things really going to help? Probably not.
The article over all is good. The experience of finding wide open wireless at a small business is far too common. This article will help.