ADMIN Network & SecurityJuly/August 2020的目錄

I’ve found that trying to maintain my focus on work, home, and self is very difficult in this time of isolation and quarantine. My guess is that you’ve struggled with the same issue. If you haven’t, good for you – I’d love to know your secret. It’s hard not to get caught up in all of the political and social issues and allow myself to drift into anger and madness about it all. I find it hardest when I’ve been stuck inside all day without a breath of fresh air. Paranoia, anxiety, and panic set in and there’s nowhere to turn to. I realized early on, around day 60, that this was going to be a problem, and I’ve searched for solutions, only to find that a lot of folks…

The volume and variety of collected data is constantly growing, which prompts enterprises, for certain use cases, to turn to a new generation of database technology. The structure and query language of graph databases allow the correlation and recognition of current data in real time. Furthermore, graph databases offer massive speed advantages when it comes to evaluating special datasets. Limits of Relational Databases Most enterprises, through websites and other methods, build huge databases. Analyzing these databases can reveal important information about customers, helping to predict user behavior, determine optimal pricing, and overcome operational challenges. For some time now, the hurdles for the use of graphs have been falling as a variety of functions from modern query languages have become available. On top of this, most cloud vendors now offer graph…

Administrators are well advised to monitor the availability and quality of their networks continuously. The open source ntopng tool has been tried and tested for years. In this article, I investigate how to commission the latest Enterprise version and explore its feature set. Ntopng was originally developed by Luca Deri, a scientist at the University of Pisa, under the name ntop [1], which explains why the business still operates under the name “ntop di Deri Luca.” The name ntop is derived from the Unix top program, which lets network administrators view system information related to CPU and memory usage and the currently running processes of a Unix system. In this vein, ntopng is a network top program that lets admins display all the relevant parameters for the connected networks. Ntopng…

Google Cloud Print could go down in history as the product with the longest beta phase – 10 years. At the end of 2019, Google announced that it was discontinuing its print service at the end of 2020. Users and printer manufacturers are probably equally disgruntled, because Google Cloud Print support is now a standard feature of many printers and will simply not work starting in 2021, prompting the need to put a similar printing environment on a new footing. Google Cloud Print is leaving the stage at a time when cloud printing is becoming increasingly important in the enterprise. More than ever before, companies are ready to move their processes to the cloud. IT managers are confronted with new and higher compliance, security, and data protection requirements in their…

Organizations, no matter the size, should implement infrastructure for preventing, detecting, and responding to security incidents. In this article, I focus mainly on detection with an AWS-native tool called GuardDuty [1], which sends its findings to a security information and event management (SIEM) system to generate and correlate security alerts to which analysts can react. Cloud Dangers One of the principal concerns many companies still have when migrating their assets to the cloud is security and compliance, even though cloud services now take this topic seriously. Cloud vendors have done a brilliant job marketing their security technology as the best and most sophisticated; however, data breaches happen frequently, and bad actors are targeting those large cloud providers. Securing an on-premises data center is slightly different from securing your assets in…

The Pandora Flexible Monitoring Solution (FMS) [1] is a full-featured network monitoring system. It equips system and network administrators with an information-rich dashboard that they can use to monitor all kinds of servers within their networks. Additionally, the Pandora FMS administration interface allows you to quickly identify and take stock of areas that are in critical need of attention. With its wide array of capabilities and reporting tools, Pandora FMS edges out the competition. However, while it is relatively easy to set up, you’ll need to spend some time familiarizing yourself with its interface. Although it isn’t the most intuitive monitoring server out there, you’ll soon learn your way around the interface’s nooks and crannies. Pandora FMS is available in two flavors: an open source community edition and an Enterprise…

Typical relational databases map relations indirectly by means of joins, whereas graph databases map the same relations directly. One example of the use of a graph database involves the so-called Panama Papers. Tax fraud, money laundering, breaches of sanctions, and a number of other criminal offenses were levied against clients of the Panamanian offshore service provider Mossack Fonseca. In 2016, journalists associated with the International Consortium of Investigative Journalists (ICIJ) from 107 newspapers, television stations, and online media in 80 countries uncovered the crimes by jointly analyzing some 11.5 million leaked email messages, database entries, letters, fax documents, deeds of incorporation, loan agreements, bills, and bank statements with the help of a graph database. Relations Alice likes Bob who follows Carol and Dave on Twitter. Streetcar line 15 runs from…

The simple monitoring tool top is often used to monitor individual systems and can be used for debugging. Because it is such a valuable and highly used tool, similar tools have been created to improve upon it. I did a survey article in late 2014 that mentions several top-like tools [1] (some of which have evolved since then and some that have not). One of the more common top-like tools, htop [2], is a bit more interactive than top, but it provides very similar information. htop uses ncurses for the interface but reads the data from /proc, as top does. It has a nice graph at the top of the default screen that presents the load on each of the cores. htop is also known for its interactivity with processes.…

While researching online recently, clicking from one security blog to another, I stumbled across a tool developed by Netflix called Stethoscope. Stethoscope is a sophisticated open-source security tool discussed in their blog [1] that is designed to assist with securing user devices. The premise of Stethoscope is to keep corporate organizations safe by helping to mitigate the risk of security breaches. For businesses, successfully attacking users is the “…primary mechanism leading to security incidents and data breaches.” Those devices that speak back to other devices present on an infrastructure are usually called “endpoints.” Examples of endpoints include laptops, thin clients, smartphones, tablets, and Internet of Things (IoT) devices, but a server could also qualify as an endpoint. Securing endpoint devices usually requires significant forethought regarding policies and compliance. Stethoscope is…

During a recent project, I needed to test against an implementation of HashiCorp’s Vault [1]. If you haven’t come across Vault before, it’s the industry leader for cloud-native secrets and certificate management that, by design, also plays very nicely with software in the cloud, such as Kubernetes. According to the Vault website, you can safely keep and fine-tune access for users and applications for “tokens, passwords, certificates, encryption keys … and other sensitive data using a UI, CLI, or HTTP API.” Working on security in DevOps teams, I had seen and used Vault, built by Terraform, on two or three different Amazon Web Services (AWS) estates but had never set up a lab myself on a local machine for testing. I wanted a simple solution that was slick and quickly…

First came Office Communications Server, then the product was renamed Lync, and later Skype for Business Online – which will be discontinued at the end of July 2021. Until then, there will purportedly be no restrictions on its use. For this reason, all new Microsoft Office 365 customers started migrating to Microsoft Teams in September 2019. In this article, I show you how to migrate to Microsoft Teams. Companies currently using Skype for Business Online can continue to add new users until it is phased out in 2021. However, as soon as Skype for Business Online is no longer available, the service’s server, which in principle is still functional, will become orphaned from the Office 365 family. Administrators need to understand that the new Microsoft Teams [1] is not the…

As soon as your code starts working, and perhaps even before it does, the engineer’s brain naturally drifts toward making it faster. These brave thoughts are premature if the program’s architecture is not yet fully settled, but once it is, the critical question becomes just how fast a segment of code runs. Measurement is critical to figuring out what part of the code is just not running fast enough for the program’s aims. Crawling Python The timeit [1] module provides a simple way to measure the performance of short code segments. Including both callable and commandline interfaces, timeit is the first stop for most users when it comes to measuring the speed of Python code. Figure 1 shows timeit in use in an interactive Python environment, comparing the performance of…

MLflow Project Joins the Linux Foundation Databricks created MLflow (https://mlflow.org/) in 2018 as an open source platform for the management of machine learning lifecycles. The platform was created in response to the complicated process of machine learning model development. Unlike traditional software development, machine learning models must not only track code versions, but versions of data sets, model parameters, and algorithms. Because of this, the variables that must be tracked and managed can grow exponentially. MLflow prevents the process from overwhelming scientists, educators, developers, and other users by providing a platform to fully manage end-to-end machine learning development lifecycles, which includes data prep, deployment, experiment tracking, creating reproducible runs, model sharing, and collaboration. Matei Zaharia, the original creator of Apache Spark and creator of MLflow, said of his platform, “MLflow…

Graph databases do not use the relational tables and join commands of traditional relational databases. Instead, they look for relations between nodes and support queries that would be slow or even impossible to process in their relational counterparts. In this article, I take advantage of the graph database structure to create an algorithm that detects fake product reviews on Amazon with a Neo4j instance in a Docker container. Fraudulent Reviews On closer inspection of a product on Amazon that has consistently earned five-star ratings, it often turns out that many of the reviewers are professional lackeys. The text obviously betrays that the author did not even use the product (Great product, fast delivery!). If you then search for further reviews from the same customer, you will often find other five-star…

LINSTOR open source software manages block storage in large Linux clusters and simplifies the deployment of high availability with distributed replicated block device version 9 (DRBD 9), dynamically provisioning storage and simplifying storage management for Kubernetes, Docker, OpenStack, OpenNebula, and OpenShift through integration. Alternatively, the software can take care of high availability with DRBD exclusively. In this article, I look into the setup and operation of the tool. At first glance, storage automation appears to be a simple problem: It’s been a long while since the tasks of creating, enlarging, and deleting storage volumes were subject to the restrictions imposed by the size of individual storage devices or the size and position of the slices or partitions created on them. Technologies such as the Logical Volume Manager (LVM) or…

The Office 365 Security & Compliance Center (OSCC) serves up numerous functions through a uniform URL that were previously scattered throughout the Office 365 world [1]. Although OSCC works with all Office 365 plans, not all features are supported by all plans [2]. Most of the functions I will look at here are available starting in enterprise plan E3, but some of them start from E5. Microsoft is in the process of splitting the OSCC into two centers: the Compliance Center and the Security Center, each with their own ports of entry [3] [4]. These centers offer more functions and are more clearly arranged. However, OSCC offers the most features under one roof. Authorizations Structure The global admin has access to all centers, but you have to grant access to…

Until a few years ago, the only critical factor on most networks was to transfer data as quickly and securely as possible between endpoints. Computers and network components on the LAN and WAN have been optimized for this purpose. However, this model is useless for Voice or Video over IP (VoIP), because both require low latency and guaranteed constant transmission rates from the network. Both packet loss and jitter can significantly affect the quality of voice transmission delivered to the end user. The Internet Engineering Task Force (IETF) has defined various quality of service (QoS) models for an IP network: best effort, IntServ (integrated services), and DiffServ (differentiated services). QoS Models The Internet uses the best-effort model, which offers minimal QoS assurance. For business networks, this model also applies if…