Enterprise Firewall request for Change management

Lots of people ask us how do we insure we have up to date firewall policy. we say insure you have a review policy in place so every 6 months you do this: 

Firewall Rule Policy Request change Procedure for Organization X and Remote location.

Summery

IT management and staff at Organization X are authorized to manage the wired and wireless networks at the X Location’s and COLO.

IT and IS systems utilize firewalls based on layer 7 firewalls; in many locations to protect these networks from disruption, intrusion, and other cyber threats posed by a lasting connection to the Internet and its inter LAN connection within ORGX and its remote offices.

Purpose

The purpose of this procedure is to:

• Manage the deployment and configuration of firewalls at the Organization X and remote locations, located in 25+ sites.
• Enforce the security of ORGX’s information and electronic communications resources.
• Prevent the possible intrusion of ORGX networks from unauthorized users.

Scope

This process applies to all firewalls at Organization X and its remote offices. This standard does not apply to firewalls deployed by independent agents or any personal agent’s machines.

Process

Firewall rule changes are usually requested by computer support team (HELPDESK) or IT managers for their network subnet and approved by their supervisor or authorized experience contractor. 

All firewall rule change requests must follow the above figure layout:

1. Require a predefined lead time to be applied.
2. Must include the following information:
1. Source and destination addresses, including IP's and domain names (where applicable).
2. Source and destination ports requested to be open.
3. Date when the change is required.
4. An explanation or reason why the change is needed.( example .. ICloud is not working for Agent X, and he needs this service.).
3. Will be evaluated to ensure that they conform to current IT security standards and best practices and will be denied if they do not meet current these standards.
4. Will be subjected to weakness testing by IT Information Security and an outside contractor.
5. If approved, will be scheduled to be implemented according to IT Management procedures.
6. Approval must have 2 IT personals. 1 from ORGX Helpdesk main staff and one from the outside contracted it staff or a senior IT staff. This to insure full integrity of policy implementation.
7. Documentation and Backup. After the changes are made, the changes must be documented and e-mailed to all IT staff, and the current firewall configuration must be backed-up before and after the changes. The backup will also be saved to the local IT staff shared drive.

Exceptional Circumstances

Deployed firewall rules will be re-evaluated over time and may be canceled if security requirements change in the future.  

Emergency firewall rule change requests must be approved by IT management. But can bypass the above process to fix a major limitation in the network. Or for example to stop a DDOS attack or a virus threat.

Brute force attack on ESX

Below is a example of a brute force attack that was detected on one of our clients ESXi hosts. It's important to understand that these kind of servers should never have direct access to the internet. they should be behind a dmz zone and some kind of firewall.

If the server requires access from the outside its best to use a white list. by doing so only the correct IP's can connect to the host.  

In this example you can see from the Events log within ESXi that someone from India 112.196.49.101 was trying to get in using the root account.

This link has some great info on this problem.
https://hakin9.org/vmware-vsphere-security-and-metasploit-exploitation-framework/

https://www.us-cert.gov/ncas/tips/ST15-002

https://www.us-cert.gov/ncas/tips/ST15-002

DarkBot detection using Canada Cyber security servers.

One of our security server at a client have detected some IOC's that look like darkbot.
when we looked at the pcap files we did see why ... below are some rules that Canada cyber sensor have triggered.

For more information: 
https://www.us-cert.gov/ncas/alerts/TA15-337A
http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Worm%3AWin32/Dorkbot#tab=2


This first screen is the first request to via DNS to  wipmania.com something that is normal of darkbot.

Next screen is the HTTP request to the same domain.

We have updated our site

We decided to get a new face left for our website .. ? what do you think ..

Some of the new things:
1. always redirect to https.
2. very small foot print. under 1 mega byte.
3. should work on any screen.
4. no executable, Good luck trying to hack this l33t ;-)

 

Our site screen from before : 

 

hard drive forensics

Not your average day at Canada Cyber, we usually deal with network security and forensics, but this week we have to do a hard drive recovery on a laptop, that is suspected to be the root of a problem in a client network. The drive mbr/GPT was removed and before that it was formatted via malware. Ironically this is the 2nd hard drive we had to deal with this week. first one was for a client that lost his Raid Config. biggest problem with all of this, is the time the software needs to get things back.

Cyber attacks via DDOS On one of the servers we are securing

We thought this is interesting to share with you, this is a chart from a 12 min span from a our security sensor showing over 1.2 million TCP port 80 request to a web server running IIS on a windows 2012 R2.

Our systems have been able to identify that and a quick e-mail/sms was sent to our staff who then within minutes contacted the owner of the server.

the diagram also shows the source nation, this is a DDOS attack as the attack was conducted using 100,000  of unique IP address.