Network Securities?

[BlckMgk]

Hey folks,

Was wondering if any of you were in the field of network securities or database management.

If not, do you know folks that you could recommend.

The jist of what I need to done is to secure our office network, and possibly setup a VPN for a few users aswell as a secure connection between databases.

Any advice would be appreciated.

Thanks,
BM

[Maniac]

You can buy all the security stuff in the world. And then you surf to a website and you get a backdoor/trojan installed and your shrecked anyway.

Good luck

[EN4CER]

If your based in the New York area I can recommend the network consultants that we use.  We don't have a Proxy Server for Internet - Only 32 PCs with Internet Access so I use Internet Filter Softare from the link below.  Its been running for a year and no problems - makes my life easy at work.  For a database solution we use QED (Web Based and written in Java).  They are based in Mass.

Internet Filter

QED

[Vulcan]

In network security and currently in love with Netscreen (Juniper). Tell me what you want to secure - how many users - speed of your connection - are you wanting to secure/segment the databases internally?

[BlckMgk]

Vulcan, I'd like to get in contact with you via phone or e-mail.

If this is possible shot me one at shipping@jagdistributors.com,

Thanks
-BM

[Martlet]

Originally posted by BlckMgk
Hey folks,

Was wondering if any of you were in the field of network securities or database management.

If not, do you know folks that you could recommend.

The jist of what I need to done is to secure our office network, and possibly setup a VPN for a few users aswell as a secure connection between databases.

Any advice would be appreciated.

Thanks,
BM

Me, depending on what you're trying to accomplish.

[Vulcan]

email sent mate.

[indy007]

You can throw all the software & technology at it you want, but none of that fixes the primary security problem. Users. Normally, I'd recommend fixing that with a .45 & a shovel, but that's not always appropriate.

Write good security procedures. Drill them into your users heads. Enforce proper password procedures. Make an example out of somebody occasionally if they ignore you. It's pretty effective. Here, I'm alot more worried about getting hit by a social engineer than a 1337 h4x0r, because the good ones never let you realise you've been hit.

[AKS\/\/ulfe]

A brick is your best network security.

Knock everyone out before they can login.
-SW

[Vulcan]

Originally posted by indy007
You can throw all the software & technology at it you want, but none of that fixes the primary security problem. Users. Normally, I'd recommend fixing that with a .45 & a shovel, but that's not always appropriate.

Write good security procedures. Drill them into your users heads. Enforce proper password procedures. Make an example out of somebody occasionally if they ignore you. It's pretty effective. Here, I'm alot more worried about getting hit by a social engineer than a 1337 h4x0r, because the good ones never let you realise you've been hit.

Thats not the primary security problem anymore. Let me ask you a question, what sort of firewall do you use at work?

[indy007]

got a little Cisco PIX 501 on the rack. Only vulnerability I know about that could hit it is the uh.. SNMP exploit for DOS attacks. the VPNC exploit in 6.3.x isn't really a concern since nobody here gets to VPN.

our connection is contracted through the IT group at the distributor. car dealership's work kinda funny. no clue what they have on their end, and after having to talk to their techs, I don't trust it anyways.

There are only 3, thankfully, major security issues I have to keep my eye on full time here.

1) Information theft, that can lead to a hefty lawsuit by customers. That's the most major concern because... well... they've rammed it down my throat... but I don't make policy, I just enforce it.

2) Spyware & malware caused by (*@&# salespeople. I'm terrified of the day a customer hops on a kiosk PC, and the porn popups start spamming little bobby (see previous statement about lawsuit). I'll catch the fallout from that one, even though I didn't cause it, and am doing by best to prevent it... keeping thorough traffic logs in my safe for the day I have to defend myself.

3) Somebody hijacking the customer lounge wireless access. Can't fire up WEP or WPA cuz "everybody" is supposed to be able to use it. I have it isolated in a 192.x.x.x range, on it's own, very limited router, away from all of our live IP's. At least the building keeps the signals pretty well inside. Failing that, I have a wifi detector & a cattle-prod (BOFH is my hero) to ensure "site security". Customers are on their own, must protect their own stuff, but occasionally when I see wide open shares, I look around for them and point it out.

[StarOfAfrica2]

Originally posted by Vulcan
Thats not the primary security problem anymore. Let me ask you a question, what sort of firewall do you use at work?

Here's some links you might find useful...........

http://www.myrne.net/tech.htm

A useful collection of links on security and hacking issues, as well as setting up VPN.  If you use Linux, you might find this one interesting (even if parts of it are a little dated, it's still relevant)

http://www.ibiblio.org/mdw/HOWTO/VPN-HOWTO/

And this one.......

http://www.e-infomax.com/ipmasq/

IP Masq is a pretty darn cool way of keeping a small network hidden from hackers (even if that wasnt its original intent).  I've used it successfully on a home network, as has a buddy of mine who is a UNIX sysadmin.

[Vulcan]

Originally posted by indy007
got a little Cisco PIX 501 on the rack. Only vulnerability I know about that could hit it is the uh.. SNMP exploit for DOS attacks. the VPNC exploit in 6.3.x isn't really a concern since nobody here gets to VPN.

our connection is contracted through the IT group at the distributor. car dealership's work kinda funny. no clue what they have on their end, and after having to talk to their techs, I don't trust it anyways.

There are only 3, thankfully, major security issues I have to keep my eye on full time here.

1) Information theft, that can lead to a hefty lawsuit by customers. That's the most major concern because... well... they've rammed it down my throat... but I don't make policy, I just enforce it.

2) Spyware & malware caused by (*@&# salespeople. I'm terrified of the day a customer hops on a kiosk PC, and the porn popups start spamming little bobby (see previous statement about lawsuit). I'll catch the fallout from that one, even though I didn't cause it, and am doing by best to prevent it... keeping thorough traffic logs in my safe for the day I have to defend myself.

3) Somebody hijacking the customer lounge wireless access. Can't fire up WEP or WPA cuz "everybody" is supposed to be able to use it. I have it isolated in a 192.x.x.x range, on it's own, very limited router, away from all of our live IP's. At least the building keeps the signals pretty well inside. Failing that, I have a wifi detector & a cattle-prod (BOFH is my hero) to ensure "site security". Customers are on their own, must protect their own stuff, but occasionally when I see wide open shares, I look around for them and point it out.

Perfect example. Cisco PIX 501, probably the smallest stinking pile of poo you can use for security. If you brought it more than 12 months ago you're forgiven, if you brought it within the last 12 months you need a kick in the ass.

Three solutions that you should have looked at: Sonicwall TZ170; Sonicwall TZW or TZ170W; Netscreen 5GT.

All of these provide light IDP capabilites which not only will protect any services you might be hosting, but will also stop a huge amount of spyware/malware even getting through to your users desktops. The Netscreen also provides content filtering and anti-virus on the gateway (NAI).

In the case of the TZW/TZ170W these are integrated Wireless security solutions. You can secure your Wireless traffic with IPSEC as well as providing wireless guest services with a "walled garden" approach, as well as provide IDP on the wireless traffic to spot any nasty's.

A properly configured GOOD QUALITY firewall will stop the nasty's getting in, and in the case of these 3 report any nasty's trying to get out (even nasty's trying to tunnel over http).

That PIX on the edge of your network... you might as well have put a cheap crappy netgear in.

[indy007]

It was here before I got here. Also, my annual IT security budget is $0.00. I work with what I've got, which unfortunately is uh... not much.

[Vulcan]

Originally posted by StarOfAfrica2
Here's some links you might find useful...........

http://www.myrne.net/tech.htm

A useful collection of links on security and hacking issues, as well as setting up VPN.  If you use Linux, you might find this one interesting (even if parts of it are a little dated, it's still relevant)

http://www.ibiblio.org/mdw/HOWTO/VPN-HOWTO/

And this one.......

http://www.e-infomax.com/ipmasq/

IP Masq is a pretty darn cool way of keeping a small network hidden from hackers (even if that wasnt its original intent).  I've used it successfully on a home network, as has a buddy of mine who is a UNIX sysadmin.

Errr that stuff is all crap. sysadmins = people who think they know about networks but don't.  That stuff deals with 5 year old security issues, its not going to help you in todays environment.