Edit Place Overview Page

Choose a layout and drag widgets onto your Overview Page to customize it. Widgets placed on the page below can be configured by selecting the symbol.

OKDon't show me this again.

Monitoring Central
All Places
Monitoring Central

Overview
Content
People
Subspaces
More

Actions
About
Share

More

Feeds

Featured Blogs

Loading...

Subject		Author
gerardodada	Welcome to Monitoring Central 4 months ago	4 months ago

Topics

Loading...


Network Management	6	0
Security	10	0
Systems Management	5	0
The Discipline of Monitoring	6	0

Recent Blog Posts

Loading...

It’s National Cyber Security Awareness Month! in Monitoring Central

Posted by joshberman

Oct 9, 2017

Security breaches have become a consistent threat, so it is critical to remain aware of the many tools, resources, and protocols available to keep you safe online. To honor and celebrate National Cyber Security Awareness Month (NCSAM), we are offering several opportunities for you to get involved and learn something new.

Think you know your cybercrime history?

We have put together a timeline of some of the most notable cybersecurity breaches throughout history. To complement the timeline, we’ve compiled a cybersecurity history quiz to test your knowledge as you travel through the decades. Take the quiz for a chance to win awesome prizes!

We need your help!

If you review the Timeline of Cybercrime, you’ll see that it is far from a comprehensive list of all cybersecurity attacks over time. Submit your suggestion of a cyberattack to add to the timeline in the comments below and receive 250 THWACK^® points for all valid suggestions!

To receive your 250 THWACK points, your submission should include:

The name of a noteworthy breach, vulnerability, or security attack of your choosing (must not already be featured on the timeline of cybercrime)
A sentence or two about the cyberattack of your choosing
A source for your research

Submit your suggestion in the comments section below. Limit one entry per THWACKster.

THWACKcamp | October 18-19

THWACKcamp^™ is right around the corner! I encourage you to check out one session in particular that’s sure to keep the conversation about cybersecurity top of mind: “Protecting the Business: Creating a Security Maturity Model with SIEM”

RSVP today!

Live webcast – Cybercrime: Defending Against the Next Attack | November 2

Following THWACKcamp and to conclude NCSAM, join @dez and @jhynds for a live webcast where they’ll discuss some of the highlights from the Timeline of Cybercrime, as well as tips and tricks to help businesses combat today’s most common cybersecurity threats.

Enjoy, and stay safe out there!

212 Views Comments: 3 Permalink Categories: Security siem, events, cybersecurity, cybercrime, ncsam

Fix Your VPN Tunnel Vision in Monitoring Central

Posted by brad.hale

Sep 25, 2017

Virtual Private Networks (VPNs) allow secure connections through the open internet. With VPN authentication, encryption, availability, and speed, end-users can work from anywhere as if they were sitting within a millisecond’s ping from the server room. Remote branch offices are connected, cloud resources are securely available, and all is well. That is, if the VPN tunnel works as it should.

Colleagues not talking to each other? Could be a grudge, could be trouble joining the call because “that VPN tunneling thingy keeps timing out.” No traffic from the remote office? Could be just lunch break, could be that the site-to-site VPN tunnel is down. What if it really is the network this time?

Setting up a trusted tunnel between two endpoints is a multi-step process—this also means that troubleshooting requires knowledge of its complexity. See these handy VPN tunnel troubleshooting flowcharts for LAN-to-LAN and Remote Access VPNs for examples of a systematic approach to figuring out why the remote connection is flunking out.

In short, you need to:

Send packets that are recognized as initiating a VPN connection attempt.
“Phase 1” establishes a secure communication channel by generating a shared secret key to encrypt further communications. Troubleshooting this phase often deals with IP addressing, encryption config, or pre-shared keys.
Following the working secure channel, in “Phase 2,” you establish IPSec security associations and negotiate information needed for the IPSec tunnel—connection type, authentication method, and access lists—resulting in a crypto map.
On we go to the data transfer: encrypted, authenticated, and secure.

When the VPN connection fails and it’s troubleshooting time, you want visibility into your VPN environment. We’ve come up with Network Insight^™ for Cisco^® ASA to help you with just that. One of the most popular security devices on the market meets the worldwide leader in network management software. Sounds promising, right?

In SolarWinds^® Network Performance Monitor 12.2, your monitored ASA devices now show additional information beyond SMNP statistics.

Site-to-Site VPN shows you whether the tunnel is up, down, or inactive. See traffic ingress and egress, duration of the VPN tunnel uptime, encryption, and hashing info. If the tunnel is down, information about the last phase completed successfully is available. Search, filter, and favorite tunnels to quickly access them in the Node Details view. You can also select specific errors from Phase 1 or Phase 2 to be ignored.

The Remote Access VPN subview presents a list of remote access tunnels, with the username and tunnel duration details, as well as the amount of data downloaded and uploaded. For failed connections, you’ll see the time and reason why the connection was ended, IP address, and client used. As always, you can use tools to search and filter the sessions.

Several predefined reports and alerts are available to keep your finger on the VPN’s pulse. Tunnel down? You’ll know first. Reaching a threshold? Won’t catch you by surprise. And of course, you can customize your own advanced reports and alerts.

You can learn more about Network Insight for Cisco ASA or try it for yourself in the fully featured 30-day trial.

604 Views Comments: 0 Permalink Categories: Network Management

Security Kung Fu: Security vs. Compliance in Monitoring Central

Posted by joshberman

Sep 22, 2017

Like traditional kung fu, in Security Kung Fu, there are two schools of thought. On one side, there are those guided by the industry’s best practices for IT security. On the other side, there are those who use regulatory frameworks like PCI DSS, HIPAA, SOX, and more as the guiding principles for their IT security strategy.

In the fourth and final chapter of the Security Kung Fu Series, we discussed these opposing strategies and provided insight into why our Security Kung Fu Masters view them as complementary, but not commensurate with one another.

If this subject is of interest, I strongly suggest you watch the on-demand recording of this session for a much deeper dive. Continue onward for a brief recap along with some highlights from the discussion.

Watch the On-Demand Recording | Check out the SlideShare^®

Meet Your Security Kung Fu Masters

For the fourth and final chapter of the Security Kung Fu series, we decided to mix things up a bit. In addition to welcoming Jamie Hynds, Senior Product Manager for SolarWinds Security Portfolio—a featured speaker in some of our previous sessions—we were joined by Destiny Bertucci, Head Geek^™ at SolarWinds.

With over 15 years of network management experience spanning healthcare and application engineering (nine of which she served as SolarWinds Senior Application Engineer), @Dez boasts an ever-growing ensemble of degrees and certifications with a slant towards IT security. If it’s not apparent now, you’ll see from this session that she really knows her stuff.

Beyond this, Destiny is a frequent presence on THWACK^®, most recently launching a blog/social commentary series on Geek Speak titled “Shields Down.” I strongly encourage you to follow along in her series and get involved in the discussion. Whether you’re an experienced IT security professional or on the lighter side of these skillsets, there is something for everyone. But don’t sit on the sidelines—share your stories and insights for the collective good of us all.

Regulatory Compliance

Compliance, as it relates to IT, involves adhering to rules and regulations that are meant to protect various types of sensitive data. It can govern everything from IT decision-making and purchasing, to configurations, and the policies and procedures a company must create and enforce to uphold this important task.

Rightfully so, many businesses are taking the obligation of compliance very seriously. After all, there is a lot at stake when fines and penalties can be levied against you (among other legal repercussions) for noncompliance.

Security vs. Compliance

Though, yes, compliance for many businesses is absolutely critical, it is not the end all be all. We contended throughout this session that taking a compliance-dominated approach to the way you secure your IT operations is not the way to go. In fact, with many of the examples we provided in this session, it can sometimes be a detriment to IT security.

On that note, we provided three really solid points to shape your mindset.

Compliance is more than a checkbox. Many view compliance as a “must have” to avoid the wrath of auditors. But, like I mentioned before, they let it dominate their IT strategy. Our tip is to not lose sight of the bigger picture. IT compliance should be seen as an opportunity to ensure the right controls are in place to actually keep your network and sensitive data secure.

As an example, it’s choosing between applying encryption for data in transit because it’s an IT best practice, instead of opting out of doing so because the regulations your business faces do not mandate it. If the end game is to ensure the confidentiality, integrity, and availability of sensitive data, you are doing yourself and your business a disservice and leaving yourself susceptible to attack without it.

“Compliant” does NOT equate to “secure.” Meeting regulatory compliance alone does not guarantee IT security. In some cases, it can lead you away from this objective. There are countless real-world examples of this, but it should be well-understood that in several cases, following compliance schemes strictly “by the book” can undercut your security responsibility. Why not go beyond what they dictate? For this, think of my earlier example involving encryption.

No one solution can make you compliant. The same too can be said for security in general, but simply applying one or more security solutions to your IT arsenal will not inherently make you compliant with any framework. Compliance involves many aspects outside of your software-purchasing decisions down to the very core of how your business operates.

In this session, we urged that for the sake of both these objectives, Defense in Depth strategies are applied. If you haven’t caught on yet, this was continually preached throughout the Security Kung Fu webinar series.

According to the SANS Institute, Defense in Depth is “the concept of protecting a computer network with a series of defensive mechanisms such that if one mechanism fails, another will already be in place to thwart an attack.”

This approach has for a long time been a mainstay in the security realm, but it too should play into your approach to compliance.

Five Tips for Continuous Compliance (and Security)

As we called an end to the Security Kung Fu series, we left our viewers with some concluding thoughts on this subject. In no way does this cover all your needs, but they are all worth considering.

Define policies and establish your network security baseline.
Collect, correlate, and securely store all relevant and required log data.
Actively monitor and analyze what’s going on within the IT infrastructure at all times.
Run regularly scheduled compliance reports.
Leverage regulatory requirements and audits as an opportunity to truly assess network risks and help ensure the security of your entire IT infrastructure—from perimeter to endpoint!

A final takeaway, however: no matter your objectives, there are a multitude of software offerings from SolarWinds that can assist your business and support an in-depth defense strategy. Visit the IT Security Software page to learn more.

Well, I hope you enjoyed not only the webinars that made up this series, but each recap I’ve provided as well. As always, I welcome your feedback or thoughts on any of this subject matter.

2190 Views Comments: 6 Permalink Categories: Security pci, compliance, hipaa, sox, it security, pci dss

Get your Cisco ASA firewall ACLs under control with these five easy steps in Monitoring Central

Posted by ams.norman Sep 20, 2017

DO YOUR FIREWALLS HAVE ACCESS CONTROL LISTS OR OUT-OF-CONTROL LISTS?

Do you badge in and out of your office each day? That electronic lock should be doing two things: making sure you can get in (and get to work), and keeping people who shouldn’t be there out. If the permissions aren’t right, you could be blocked from entering. Or, worse, people who aren’t authorized could walk right in. This is what happens if the Access Control Lists (ACLs) on your firewall aren’t properly configured. Valid traffic could be blocked, or unauthorized traffic could slip through. This can impact productivity and even be a security risk.

ACLs can be hundreds or even thousands of lines long. They may have been set up years ago and been modified too many times to count. Are you confident that they are controlling the traffic the way you want? Do you need deeper network insights to see what is really going on?

Reviewing your Access Control Lists can be a tedious task, but the latest release of SolarWinds^® Network Configuration Manager (NCM) makes it easy. This release introduces a new feature, Network Insight™ for Cisco^® ASA, so you can easily review and audit ACLs for your Cisco ASA firewall.

Review what ACLs are configured
You can’t control it if you don’t know you have it. First, take a look to see what Access Control Lists are set up. The network insights you get with NCM will allow you to view all ACLs configured on the ASA. See if you have an ACL that was configured but never applied. Do you have ACLs that were set up so long ago that none of the original creators are still around?
Audit where and how they are assigned
An ACL may be configured correctly but assigned to the wrong zone, reducing its effectiveness. Are your ACLs assigned to the correct zones? What interfaces are assigned to those zones? Review where your Cisco ASA ACLs are assigned to maximize their strength.
See what rules are being used
Do you have rules in place that are never used, or rules that are getting hit all the time? Use NCM’s ACL Rule Browser to browse to object group definitions, search and filter within your ACLs, and view the hit count for individual rules to debug your access rules. Rules that are never hit may have been superseded by other policy changes. Rules that are getting hit all the time may indicate a need to refine the rule. With increased network insight you can optimize the ACL rules on your Cisco ASA.
Detect shadow or redundant rules
Access Control List rules are applied in the order they are listed. When a rule is overridden by a previous rule that does a different action, it is a shadow rule. A rule that is hidden because a previous rule does the same action is a redundant rule. For example, your office wants to let in anyone who is an employee, but not on the weekends. If the badge reader checks “let in all employees” first and then checks the day of the week, the weekend rule is a shadow rule. It will not matter because the door unlocked after confirming it was an employee who was trying to enter. You can reduce security risks and help ensure your ACLs are working as intended by identifying shadow or redundant rules.
Compare ACLs for changes
It can be difficult to troubleshoot ACL config issues. Network Configuration Manager helps make this process easier with side-by-side ACL config comparisons on your Cisco ASAs. You can compare an ACL to a previous version on the same node, or compare to other nodes, interfaces, or to a different ACL. Identify errors and verify consistency with Network Insights for Cisco ASA.

By working through this simple checklist, you can restore confidence that your firewalls are effectively managing the traffic flow in and out of your network. You can try Network Insight for Cisco ASA in the latest release of Network Configuration Manager. With a free, 30-day trial of NCM, you can see for yourself how easily you can bring your ACLs back under control. Look like a firewall expert without having to be a firewall expert!

615 Views Comments: 3 Permalink Categories: Network Management ncm, acl, network configuration manager, cisco asa firewalls, network insight, network insight for cisco asa

Security Kung Fu: The Security Threats From Within in Monitoring Central

Posted by joshberman

Sep 15, 2017

While countless companies rely on Active Directory^® (AD) to ensure only the right individuals have the right access, hackers still can penetrate, lie in wait, and jump at the next opportunity to elevate their permissions. Each move is calculated, and if undetected, earns them greater and greater access to data and systems to begin the slow siphoning of intelligence or suddenly launch IT security attacks.

How the bad guys get in can vary, but the who in this equation matters just as much. Not only do external parties pose a threat, there are also those coming from within your own ranks who can be just as dangerous, whether intentionally or not.

It can also be said that AD changes and events, such as unauthorized account provisioning, escalating of privileges, and changing user accounts may not only be indicators of malicious activity on the network, but the very acts themselves can create security holes that may lead to compromises in the future.

When threats can manifest from both outside and inside the four walls of your businesses, any practitioner of IT security would agree that sometimes the best offense is a strong defense. In Part Three of the Security Kung Fu Webinar Series, we discuss how monitoring for Active Directory changes using security information and event management solutions (or SIEM) can help you do just that, all while helping you meet certain regulatory compliance requirements in the process.

Building on each of the subjects covered in our previous two Security Kung Fu events, we turned our focus inward to cover the IT security threats coming from within. Dive right into this subject using the resources below, or read along for a quick recap of this session to further whet your appetite for some security goodness.

Watch the On-Demand Recording | Check out the SlideShare^®

Meet Your Security Kung Fu Masters

Returning for this session are both Jamie Hynds and Ian Trump, featured speakers from Security Kung Fu: Playing with Fire(wall) Logs. If you missed the recap on this or any of the previous Security Kung Fu webinar sessions, be sure to check them out! And if you want to get deep in the weeds on certain IT security or compliance topics, I strongly encourage you to follow Jamie (@jhynds) on THWACK^®. He’s published quite a few articles that are worth a read.

The Threats From Within

Though the lion’s share of media attention is placed on external hackers finding an “in,” numerous roads lead to IT security compromise. Insiders remain a very real and substantial threat. Whether by purposefully acting out of malice or enabling external threats through their own negligent actions (or simple inaction), there’s much to consider when turning your IT security focus inward. Here are some examples we highlighted as part of this session that you should definitely consider:

Malicious intent – Though touched on above, this speaks to the purposeful action on the part of trusted insiders to act in opposition to the interests of an organization. Common IT threats include fraud, sabotage, and theft or loss of confidential information.
Not following policies or procedures – Sometimes purposeful, sometimes not, this IT security threat involves acting out of accordance with internal guidelines regarding the use of technology or the handling, disposing, and disclosing of sensitive information to unauthorized parties.
Negligent behavior – Whether these actions violate clearly written and enforced policies or procedures, or plainly defy basic logic, this involves your own employees or individuals from the businesses you represent unknowingly putting your IT operations in harm’s way. As simple as falling prey to phishing attacks or some other mode of social engineering, their actions may not have been explicitly forbidden, but they still result in compromise.
Integrity of the AD Domain – Though Active Directory is in place to ensure many of the above forms of threats do not either take a foothold or spread, simple actions on the AD Domain can give rise to security issues as well. Despite being a fundamental practice for an IT organization, potential Active Directory security vulnerabilities can be cause for concern when hackers are looking for the keys to the kingdom. If you give them an inch, they’ll take a mile.

I should temper this in saying that in no way is this any exhaustive list. In fact, we go into greater detail about other possible internally-caused IT security issues on the webinar itself. The point here is that there are numerous ways a trusted insider can become your weakest link or gravest threat.

The Necessity of Monitoring Active Directory

We cover each of these modes of insider threats and signs of abuse with purpose. It highlights the very important need for monitoring and auditing Active Directory changes to at least identify the signs that something has gone awry.

A SIEM tool is perfect for that. Not only can you use one to keep close watch of things, but it can also issue alerts when an anomaly is spotted. Further, this software can help enable real-time active responses, such as logging off users, blocking IP addresses, killing processes, and adjusting Active Directory settings at the first sign of threat. SIEM solutions can not only contribute to improving IT security, but also compliance.

So, what are among the most pertinent items to look out for when monitoring Active Directory changes? Here are some of the standouts:

User events
Authentication events
Group changes
Policy changes
Password resets

Though seemingly harmless, these actions should be reviewed for authenticity. There’s simply too much at stake.

Pro Tip: Users of Log & Event Manager (LEM), SolarWinds’ own SIEM solution, should check out this video in the SolarWinds Success Center for guidance on how to leverage LEM to detect privilege changes in Active Directory.

A Nod to Compliance

The ability to monitor and respond to threats is so critical to a business’ IT security, and the ultimate goal of maintaining the confidentiality, integrity, and availability of sensitive data, that it’s no wonder many of the top compliance frameworks include provisions that cite the need for monitoring for such Active Directory changes. We spoke about this in depth during an Ultimate Window Security Event we participated in, titled “Monitoring Active Directory Changes for Compliance: Top 32 Security Events IDs to Watch and What They Mean.” SOX, HIPAA, PCI DSS, FISMA, NIST, GLBA—you name any compliance law or standard—all cover, in some way, the need for tracking such actions. There are even certain AD events that can be mapped directly to these frameworks to assist in meeting certain objectives and demonstrate potential IT security vulnerabilities to auditors.

Though we only touched on the subject briefly as part of this and our other Security Kung Fu webinars, the fourth and final event in the series covers the topic of compliance in-depth. There, we discussed the two prevailing “schools of thought,” or drivers of IT decision-making and practice: security vs. compliance.

I hope you’re finding these session recaps helpful. Stay tuned for my recap of the final session from the Security Kung Fu series.

1952 Views Comments: 1 Permalink Categories: Security siem, compliance, active directory, it security, active directory management

HTML

Loading...

Top Rated Blogs

Loading...

GDPR – What is it and how can SolarWinds help? in Monitoring Central
Welcome to Monitoring Central in Monitoring Central
The Cloud is Dead. Long Live the Cloud. in Monitoring Central
Security Kung Fu: The Saga Begins in Monitoring Central
Security Kung Fu: Playing With Fire(wall) Logs in Monitoring Central
Security Kung Fu: Security vs. Compliance in Monitoring Central
Fix Your VPN Tunnel Vision in Monitoring Central

Edit Place Overview Page

Featured Blogs

Topics

Recent Blog Posts

Think you know your cybercrime history?

We need your help!

Live webcast – Cybercrime: Defending Against the Next Attack | November 2

Watch the On-Demand Recording | Check out the SlideShare®

Meet Your Security Kung Fu Masters

Regulatory Compliance

Security vs. Compliance

Five Tips for Continuous Compliance (and Security)

Watch the On-Demand Recording | Check out the SlideShare®

Meet Your Security Kung Fu Masters

The Threats From Within

The Necessity of Monitoring Active Directory

A Nod to Compliance

HTML

Top Rated Blogs

Watch the On-Demand Recording | Check out the SlideShare^®

Watch the On-Demand Recording | Check out the SlideShare^®