Fortify IT, Inc Blog

Sorry

2011-01-27T19:50:00.000-05:00

Hi All,

sorry, It's been busy and I just haven't really wanted to post anything. haha. just being a slacker.

I'll continue to post stuff once I get back into the swing of things and things settle down. It's been really busy.

Thanks
mike

Off to Nashville!

2010-08-11T18:41:00.000-04:00

I'll be off to Nashville Aug 12 to the 13th (hopefully just the 13th) for a network upgrade for a dental client. It's a fairly simple install/upgrade. Should be fun. It'll be the second time I've been to Nashville (3 if you count driving through to St. Louis in 2009).

Rite Aid HIPPA data breach Settlement

2010-07-30T14:34:00.000-04:00

Rite Aid to pay $1 million in HIPAA settlement
by SearchSecurity.com staff

In its settlement agreement with the HHS over alleged HIPAA violations, the pharmacy chain will pay $1 million and must establish procedures for disposing of protected health information (PHI).

Yet another corporation in violation of protecting individuals private information. Companies still don't get that there are a lot of regulations that are trying to protect the individuals private information. Hopefully sooner rather than later, all companies will take these regulations seriously.

XP won't die.

2010-07-15T08:16:00.002-04:00

Windows XP Will Never Die

Microsoft originally said that new owners of Windows 7 who wanted to downgrade to XP would only have until 2011 to do so, but now the company has changed its mind and extended support for the old operating system until 2020.

(osnews.com)

Company Issued Devices Ruling

2010-07-11T16:53:00.000-04:00

The US Supreme Court has overturned a lower-court ruling and concluded that management has a right to review employee text messages on company-issued devices. If used as a precedent, this case may have far-reaching consequences for employee expectations of privacy in workplace communications. However, the ruling should also serve as a wake-up call for organizations that do not have explicit written security and privacy policies.

So for everyone out there with a company issued cell phone, be careful what you say over texts because it may not end up so good for you.

Vacation Time

2010-05-31T10:30:00.001-04:00

I am off to Norway for a vacation, June 2nd to June 12th. Be back soon and maybe I'll start updating this blog some more. It's been busy so that is good!

Thanks

Ticketing System

2010-05-13T17:07:00.000-04:00

I created a ticketing system for it to be easier for me to track all the items that I get in email regarding support that is needed. This will definitely help me keep me more organized.

Users can create a new ticket at:

http://fortifyit.no-ip.biz/osticket

Also on this page, you can track your tickets by entering your email address and your ticket ID number.

Thanks!

Running as Admin = Not Good for Security Exploits (and in general)

2010-03-31T15:16:00.000-04:00

Just found this article about how to easily mitigate security exploits in Windows and it of course means running as a Power User or a Regular User. Most database programs require Power User status so that would be the most common for my clients and most of them run Quickbooks or some other database program.

Here are some numbers from the article.

-100% of Microsoft Office vulnerabilities are mitigated by configuring users to operate without administrator rights.

-By removing administrator rights companies will be better protected against exploitation of 94% of vulnerabilities in all versions of Internet Explorer, and 100% of those in IE 8.

-87% of vulnerabilities categorized as Remote Code Execution vulnerabilities are mitigated by removing administrator rights.

-Companies are better protected against 81% of Critical Microsoft vulnerabilities by configuring users without administrator rights.

-Of the total published Microsoft vulnerabilities, 64% are mitigated by removing administrator rights.

-In 2009, exploits of 53% of Windows operating system vulnerabilities can be diminished by configuring users as standard users.

-90% of Critical Windows 7 operating system vulnerabilities are mitigated by having users log in as standard users.

-Of all Windows 7 vulnerabilities ever published, 57% are mitigated by removing administrator rights.

-----
Source: BeyondTrust, Inc. http://www.beyondtrust.com/downloads/whitepapers/documents/wp039_BeyondTrust_2009_Microsoft_Vulnerability_Analysis.pdf

Done with School!

2010-03-31T15:08:00.003-04:00

Hi everyone (who ever reads this blog),

I have completed my BS Degree in Information Assurance and Security on March 19th. The school is just checking my records to ensure I have completed everything and that I am in good standing..etc. Blah. But I am done. I'm happy and excited about the accomplishment.

Next I am going to be working on a certification called the Systems Security Certified Practitioner (SSCP), which is the little brother to the industry standard CISSP certification. I'll work on the CISSP at some point down the road. Also I will be working on a HIPPA certification since I have a lot of dental clients and it'll be nice for patient records to be safe. :)

Beyond those two items, not sure what I will do. Probably continue on with my Masters after those two certifications are done.

As for clients, I'm always looking and trying to get new clients. I've been trying to think of new ways to get clients but word of mouth is always the best for me so if anyone reads this and knows me, please try and push me off to your clients. I'd appreciate it because more clients = me staying in business. :)

Thanks
Mike

What's new with Fortify IT, Inc

2010-03-12T16:30:00.000-05:00

Hey All,

Sorry for the lack of updates but it's been really busy with work (A VERY GOOD THING) and I've been trying to finish up my Bachelor's degree. I'll be done March 19th and I'm very excited! I can't wait to finally finish this up. It'll be in Information Assurance and Security so then I can start implementing some things into my clients. As always, I'll keep you guys posted on any other fun techie stuff when it comes around.

Thanks for reading
Mike

ADrive Customer Service Sucks

2010-02-25T11:39:00.000-05:00

I was trying to gather some information about ADrive for my clients for Offsite backup purposes and I emailed them 3 times over two weeks asking a simple question of "does your software work on Windows 2003?" and asking them if I could become a reseller as well since I have a lot of clients that I'd like to get onto their system. Didn't hear anything.

Finally I emailed their feedback email just so I could maybe possibly get a response. The ding dong says "support is for premium customers only". I emailed back saying that I wasn't interested in support. I wanted a simple question of answer so I could give them some more business, etc. Then the ding dong (I'll keep the name calling clean :) ) came back and said that we cannot answer all the over 1 million free user accounts questions. I replied saying all I wanted was a simple question answer and that I was possibly going to give you a lot of PAYING clients for their offsite backup. I said you guys need to work on your customer support. So I because of that, I HIGHLY recommend NO ONE Use Adrive.com for Offsite storage. Their customer service is horrible.

I've started to use ElephantDrive.com and it's really nice and they have a plan for desktops at $50 a year for unlimited and then 1tb for enterprise level for like $350 a year. They have other plans as well. Plus their customer service is NICE and helpful.

Microsoft Patch Blue Screening XP Users

2010-02-15T18:43:00.001-05:00

Found this on the web at slashdot.org. I had one that just happened last week. Repaired windows and applied sp3 and ie8 again and it's working fine.

"Tuesday's security updates from Microsoft have crippled Windows XP PCs with the notorious Blue Screen of Death, users have reported on the company's support forum. Complaints began early yesterday, and gained momentum throughout the day. 'I updated 11 Windows XP updates today and restarted my PC like it asked me to,' said a user identified as 'tansenroy' who kicked off a growing support thread: 'From then on, Windows cannot restart again! It is stopping at the blue screen with the following message: 'A problem has been detected and Windows has been shutdown to prevent damage to your computer.' Others joined in with similar reports. Several users posted solutions, but the one laid out by 'maxyimus' was marked by a Microsoft support engineer as the way out of the perpetual blue screens."

Quickbooks "Digital Certificate Generation Tool" - Don't Do It!

2010-01-29T09:33:00.000-05:00

Got an email from a client asking about this email they received. Read all the way down to the bottom for the answer...

-------------------
Dear Customer.

In order to access Intuit after 3 of February 2010, you must get a valid Digital Certificate installed on your Computer.

Creating and installing your Intuit digital certificate it is a quick and automated process.

Knowing with whom you are communicating, it is a basic principle to the security on internet transactions. only encrypt is not enough, as it provides no proof of the identity of the sender of the encrypted information. Without special safeguards, you risk being impersonated online. Digital certificates provide an electronic means for Intuit to verify your identity. Used in conjunction with encryption, digital certificates provide a more complete security solution, assuring the identity of all parties participating in a transaction.

The Intuit server has its own digital certificate to assure you that you are actually calling with Intuit and not with an racketeer.

To generate your own Digital Certificate, you need to download Digital Certificate generation tool. For security reasons, download is available only once. Please download Digital Certificate generation tool direct to your Microsoft Windows PC. It is important to note that: Your Intuit digital certificate will expire after one year. You will be prompted to enter an automatic renewal process 30 days prior to certificate expiration.

System requirements :
Internet Explorer 6.x, 7.x, 8.x
Windows XP, Vista, 2000, 2003, Seven
Mozilla FireFox 2.0 and above
ATTENTION: You will not be able to use our service without update from 3 of February 2010

--------------------

This is the response from QB's online community team.

Thank you for using the Intuit Community forum.

This is a Phishing Email. Please do not install the executable file as it will install a virus.

I hope this helps. Please mark this answer as solved (click the button under the answer in the lower, right corner) or respond with an additional comment for follow up.

Outlook's Stupid NK2 File

2010-01-27T22:33:00.000-05:00

The worst thing that has ever come out of Redmond, WA(that would be Microsoft's home), is NOT ME nor Vista but Outlook's piece of crap NK2 file. What is a NK2 file? Glad you asked, it is the little file that Outlook uses when you create a new message and start typing in the To: field and the email address magically appears whenever you type a letter. Great for efficiency but when you change email providers, the email addresses in there will not work because by whatever reason, the file stores the SMTP info from the old provider and if you use it on the new provider, the email thinks it is still going through the old provider so the email just sits there.

Here's the part I hate, People always ask me when changing providers "where are my contacts?" I get so frustrated at that because I tell people that those are not actually contacts. That is a quick entry and those files get corrupted easily and you can't use them with a new provider. People always get mad. I can't do anything about it. It's the NK2 files fault. The only thing I can do is to export the NK2 file and import it into their contacts. People just always insist that is their contact list and it's so annoying. I hear more about the NK2 file than I have ever heard about Vista or ME COMBINED!!! And then I have to explain things about it and why it sucks and you are not actually creating contacts with that file.

So that is why I the NK2 file is THE DUMBEST THING MICROSOFT HAS EVER PRODUCED!!! Just freaking annoying!

Geek Squad Sucks... Need I Say More????

2010-01-26T15:52:00.000-05:00

I have a new client who got a virus and brought their computer to Best Buy so the Dork Patrol could fix it. She told the Geek Squad ding dongs she didn't care about ANYTHING other than her Quickbooks data, that meant she'd lose pictures of her child in order to keep her QB data. What did the moron's at Geek Squad do? they saved the pictures, great, but didn't backup her QB data. The QB data is not a personal account but an actual company account.

So what they did was backed up her my documents and then put her computer back to factory default and charged her an arm and a leg to do that. This is why I HATE These people! They have Ding Dong workers that don't care and don't understand how valuable someone else's data is. I've heard this same story so many times from people bringing their computer to the Geek Squad or when CompUSA was around. It's just insane. I would never allow any one to have them setup their computer. Don't take your computer to them, they will just lose your data. Call me 404.585.1015 as I know what I am doing. :)

Chrome to my rescue!

2010-01-23T10:04:00.000-05:00

Another reason Internet Explorer 8 sucks...

I can log into my monitoring service's portal fine with IE8 but when I have to go to another page, IE8 just sits there with a blank page. I had to create a VMWare image so I could load up crappy Vista so I could use IE7. That works fine, it's a pain but at least it works!!

So I just loaded the IE Tab extension for Google :) Chrome and guess what, IT WORKS. Go figure. I have to use Chrome in order to be able to use IE8 within my monitoring portal. Wow, just wow... IE8 is so haphazard in the reasons why it doesn't work that it just boggles my mind! I hope Microsoft is reading these and fixes it soon.

SSCP "Good Stuff To Know" Book

2010-01-22T18:09:00.000-05:00

This is a little gem of a book as it covers the main points of anything covered on the SSCP exam. I have not taken the exam yet but it covers everything I have read in the SSCP Office ISC2 study guide. It's a nice checklist style format of the things you need to know with the info you need to know about each without having a long winded discussion about it. Good complement to any full 500 page study book. Recommend it.

Microsoft Online Exchange

2010-01-20T14:38:00.000-05:00

Well Microsoft Online Exchange really blows. Been working on problems since I installed it in Late Aug 2009. I've been on from September to January 2010 with their tech support. Running Outlook 2003 SP3 and you would think that MICROSOFT'S own freaking Exchange 2007 would be able to work right. But it doesn't! As outlook tries to connect to the server to pull the data, it just locks all their computers up for 30-60 seconds. This happens several times a day, randomly. It's just totally unacceptable! So I just setup Google Apps accounts for them so Screw Off Microsoft Online Exchange. It's just pathetic that I've been on with tech support since Sept 09 and nothing has been resolved.

Google Apps Premier all the way!!

Malware Junk

2010-01-18T17:52:00.000-05:00

Hey all, if you get infected with Internet Security 2010 and you successfully clean it out, your TCP/IP stack will probably be toast. There is a free tool from microsoft that will actually repair your network stack. I had two clients who got infected and after I cleaned it, I couldn't get onto the network or internet. I would manually set an IP address and the network card saw the IP address but doing an ipconfig, it displayed 0.0.0.0 for an IP address. Ugh! Found this tool from microsoft that fixed the stack. Comment if you need it and i'll try and find the tool. it was buried in support docs and it was linking to another doc within microsoft.

Another Reason not to use Internet Explorer (any version)

2010-01-17T22:26:00.000-05:00

So clean install of Windows XP Pro, then SP3 went on, then IE8, that is all, besides AVG 9 of course since we are in the virus paradise of Windows. Well I cannot even download any ActiveX components such as Windows Update and Adobe Acrobat and their download manager. IE8 crashes. Unbelievable!! IT's a clean install! This is not the first time i've seen this either, this has happened to me a lot. I hate IE, all versions. People may say IE6 sucks but at least it works unlike IE7 and IE8. What total crap.

IE8 and Windows 2000 to XP upgrade

2010-01-17T16:30:00.002-05:00

Here's something interesting, Upgraded a computer from Windows 2000 to XP and Internet Explorer 8 installs and works just fine but the menu bar is completely Blacked Out! really weird. Uninstall and install IE7, it's all good.

Another reason not to use Internet Explorer at all.

Good Basic Computer Security Tips

2010-01-08T19:38:00.002-05:00

This is an excerpt from the White House blog and the new US Chief Security Officer for our country.

Cybersecurity matters to all of us – and it’s our shared responsibility to mitigate the threats in this space. You can take cybersecurity into your own hands with these tips for protecting yourself online:

Keep your security software and operating system up-to-date. At a minimum, your computer should have current anti-virus and anti-spyware software and a firewall to protect yourself from hackers and malicious software that can steal sensitive personal information. Hackers also take advantage of Web browsers and operating system software that do not have the latest security updates. Operating system companies issue security patches for flaws that they find in their systems, so it is important to set your operating system and web browser software to download and install security patches automatically.

Protect your personal information online. Millions of people become victims of identity theft each year. One way that cyber criminals convince computer users to divulge their confidential personal information is through fake "phishing" emails, which are often cleverly disguised to look like authentic emails. Be wary of clicking on links in emails that are unfamiliar and be very cautious about providing personal information online, such as your password, financial information, or social security number.

Know who you are dealing with. It is remarkably simple for online scammers to impersonate a legitimate business, so you need to know who you are dealing with. If you are thinking about shopping on an unfamiliar website, do some independent research before you buy. Similarly, before you download software, be sure that the software developer is trustworthy. Cyber criminals will often embed the capability to steal passwords and files into free software.

Learn what to do if something goes wrong. If your computer gets hacked, the effects may be obvious (e.g., deleted or corrupted files), or they may be subtle (e.g., slow computing performance). As a first step, you should scan your computer with updated anti-virus software. You may wish to get professional assistance through your computer’s manufacturer, computer retail store, or local computer technician. You can also alert the appropriate authorities by contacting your Internet Service Provider or the Internet Crime Complaint Center. The Federal Trade Commission (FTC) can assist if you are subject to identity theft. You can also forward spam or phishing emails to the FTC at spam@uce.gov.

Taken from the White House blog:
http://www.whitehouse.gov/blog/2009/12/22/introducing-new-cybersecurity-coordinator

Monitoring

2010-01-05T21:46:00.000-05:00

I have just started rolling out my monitoring service. The monitoring is actually done by a company called Zenith InfoTech and I now have two clients on it. It provides for server and desktop hardware, software monitoring and Microsoft patch rollouts. It's a great service and I wish to get all of my clients on the server to be proactive instead of being reactive to issues. Servers are $50 per server per month and each desktop is $10 per desktop per month.

AVG 8.5 and lower virus definition problem

2009-12-21T09:46:00.002-05:00

Got this from my monitoring service. If your Google Talk, Google Desktop, or Logmein is not working, this would be the problem. Update your AVG defs and then reinstall the programs.

When AVG released virus definitions 270.14.112/2571, the AVG Antivirus clients started detecting LogMeIn.exe, GoogleDesktop.exe and GoogleTalkPlugin.exe as Trojan Horse ‘Vundo.JI’. This false positive has been fixed with the release of AVG virus definitions 270.14.113/2572.

This problem is applicable to all AVG versions previous to version 9.0. AVG 9.0 is not affected.

Extra Storage for Gmail and an Eye-Fi Card free!

2009-12-10T19:02:00.000-05:00

This is copied straight from this website: http://picasa.google.com/eyefi.html

read it over and get lots of storage!!!

The Eye-Fi card requires a SDHC compatible camera and a Wi-Fi router. If your camera is more than 3 years old, it might not work! Check if your camera is compatible.
Special, limited time offer available while supplies last.
Sorry, no refunds or returns.
Valid only in US and Canada, only for users buying paid storage for the first time. Limit 5 per household.
Your Eye-Fi cards will be delivered within 2-4 weeks after purchase, and shipping is free.
Google paid storage renews annually, but you can always downgrade to a smaller storage plan or choose not to renew.
4GB SDHC Eye-Fi Home video card ($69.99 value) includes one free year of Web Share and Geotagging ($24.98 value). These services will remain free if Eye-Fi card is used to upload to Picasa Web Albums.
Have more questions? Read all the details.