ADMIN Network & SecurityMay/June 2024的目錄

Until a few months ago, I didn’t watch TikTok, but now I find myself staring at countless short-form videos on various topics, from the law to politics to pure silliness. It’s easy, free entertainment that requires very little from me as a casual observer. While scrolling through some of my favorite content creators’ fluff one night, I stumbled upon this animated office worker, Veronica. She works in a standard corporate office, providing phone support for her employer’s services. In short, Veronica knows how to set boundaries. She gives 100 percent to her employer for eight hours but vehemently protects her off-duty time. Did I also mention that she prevents her boss, coworkers, and customers from creating a toxic work environment? She does, and she does so in a calm, professional,…

Network Load Balancing (NLB) is an integrated feature of Windows Server 2019 and 2022. The feature makes it possible to distribute network traffic across several servers without having to purchase additional hardware. The result is improved performance, scalability, and availability of applications. The management side is not particularly complicated, and NLB clusters are flexible when it comes to setup. The first and perhaps most obvious benefit of network load balancing is the improvement in performance and the ability to handle heavy peak loads by distributing them across a number of servers to avoid any individual server being overtaxed. This aspect is particularly important for high-traffic websites and applications, where peaks in network traffic can lead to noticeable performance losses or even downtime. Another advantage of NLB is an improvement in…

The sysstat package contains numerous tools for monitoring performance and load states on systems, including iostat, mpstat, and pidstat. In addition to tools intended for ad hoc use, sysstat comes with a collection of utilities that you schedule for periodic use as cron jobs (e.g., sar). The compiled statistics range from I/O transfer rates, CPU and memory utilization, paging and page faults, network statistics, and filesystem utilization through NFS server and client activities. Of course, you could use top, vmstat, ss, and so on to determine the data, but bear in mind that system events are hardly likely to be restricted to the times at which you are sitting in front of the screen. Admins typically receive requests for more detailed information, like: “What exactly happened on system XY between…

In the list of the managed Kuber netes solutions that dominate the market, the usual suspects are present, operated by the most popular cloud platforms: Google Kubernetes Engine (GKE), AWS Elastic Kubernetes Service (EKS), and Azure Kubernetes Service (AKS). When you put Kubernetes through its paces in production environments, it’s critical that you understand the nuances of your infrastructure to achieve high levels of uptime. When testing Kubernetes and its associated workloads in a laboratory setup, you must emulate your production workloads precisely so that you can ensure the ability to scale to cope with both predictable and unexpected increases in demand. In this article I create an AKS cluster in Azure with the platform-provided command-line tool az, which is often referred to as the Azure commandline interface (CLI) tool. With…

In recent years, the software supply chains at SolarWinds and Kaseya, among others, have been targeted, along with identified vulnerabilities in widely used open source libraries, including Heartbleed in 2014, a vulnerability in OpenSSL, and Log4j in 2021. In both cases, innumerable systems were affected. Back in May 2021, the United States introduced an obligation to provide a software bill of materials (SBOM) in a Presidential Executive Order on Improving the Nation’s Cybersecurity [1]. The European Parliament recently adopted (March 2024) the Cyber Resilience Act (CRA), which also calls for an SBOM [2]. The need for action by all companies that produce and distribute software as a standalone product or as part of products such as electrical appliances or machines is real. At the same time, the SBOM offers every company…

All of today’s major vendors offer automated server installation and configuration options, but if you want to avoid being tied in to a distribution provider, you will run into major issues. Ignoring vendor-specific solutions, you are likely to search in vain for bare metal deployment tools. Although Foreman is the classic choice and niche solutions such as Orcharhino also offer a great deal of functionality, they are not considered genuine candidates because many of the applications available are either very narrowly focused on individual areas of use or have sprawled so massively over the years that introducing them is virtually impossible. The developers at Tinkerbell [1] are looking to change this difficulty and have launched a collection of tools that promise modern bare metal deployment. Rack It The IT industry…

In a previous article, I examined the basics of parallel programming [1], including key terms such as speedup, defining the ratio between the original, single-threaded implementation and the faster parallel version. Amdahl’s Law [2] critically observes that you can parallelize only part of an application, which caps the speedup ratio in most programs – and should make you raise an eyebrow in Vulcan fashion when promised double-digit speedups like 10x by a vendor who has yet to see your code. Accomplishing a 10x speedup requires that 90 percent of the execution time be parallelized. The span of your code’s critical section therefore determines how much the application can actually be accelerated: If one minute of a 20-minute process is single threaded, the maximum speedup theoretically possible is 20x because only 95…

DHS Releases New Guidelines for Securing Critical Infrastructure The US Department of Homeland Security has released new resources to help address threats posed by AI, including guidelines to mitigate AI risks to critical infrastructure (https://www.dhs.gov/news/2024/04/29/dhs-publishes-guidelines-and-report-secure-critical-infrastructure-and-weapons-mass). “AI can present transformative solutions for US critical infrastructure, and it also carries the risk of making those systems vulnerable in new ways to critical failures, physical attacks, and cyber attacks. Our department is taking steps to identify and mitigate those threats,” said Secretary of Homeland Security Alejandro Mayorkas. DHS outlines a four-part mitigation strategy, involving the following steps: • Govern: Establish an organizational culture of AI risk management — build organizational structures that prioritize security.• Map: Understand your individual AI use context and risk profile.• Measure: Develop systems to assess, analyze, and track AI…

If you follow the rules and keep the configurations of multiple tenants, testing, integration, and production in harmony or regularly have to check and document the most important security settings in the Microsoft cloud, you will certainly already have devised ways and scripts to make your work easier. One of the most interesting tools in this field, and one that is increasingly finding its way into the corporate landscape, is Microsoft 365 Desired State Configuration. The idea behind the project is to equip the PowerShell DSC framework for the Microsoft Cloud and provide features such as documentation, change detection, change rollback, and configuration clones. Anyone already familiar with PowerShell DSC for Windows Server, for example, will quickly be able to find their way around Microsoft 365 DSC. The project includes many…

The Windows Package Manager is Microsoft’s answer for simplifying the deployment and management of applications within the Windows ecosystem. The WinGet client, generally synonymous with Windows Package Manager, is the main face of this relatively new package system and offers a command-line interface (CLI). Drawing on the rich heritage of Linux package managers such as Apt and Windows-native equivalents such as Chocolatey and AppGet, WinGet signifies Microsoft’s most direct effort to refine the software installation experience for administrators, developers, and users. Since its launch in May 2021 with version 1.0, Windows Package Manager has quickly gained acceptance through community adoption of WinGet and its public repository, with more than 4,000 package contributions. In this article, I touch on the WinGet CLI and the associated app lifecycle and provide an overview…

An escape room is an immersive team-building game in which friends or colleagues work together to solve puzzles and clues to escape a room before time runs out. Within the domain of Kubernetes [1] and Docker [2], one of the primary goals for malicious actors is seeking to compromise a pod or Docker instance. Once they find a way to escape to the host, they can gain root access, resulting in critical consequences – i.e., game over. Securing the container means addressing multiple layers in the container’s environment, such as access and control, internal permissions, network segmentation, vulnerability management, misconfigurations, and excessive privileges, among other things. Also, you need to differentiate whether containers are deployed within a cloud provider’s infrastructure or as on-premises clusters, because each requires a different…

Manually typing in device IDs for asset tracking can quickly become a major chore in large environments. Automated entry with a radio frequency identification (RFID) system saves valuable time compared with barcode and other traditional methods, but it comes with its own problems. In this article, I look at various tech-based approaches to RFID asset tracking in the IT environment. After doing so, I turn my attention to sample implementations and software and some potential security concerns. Break It Down The first question related to asset tracking with an RFID system is the type of transponder to be used. The energy source built into active tags enables longer ranges, and the reader supplies energy to passive tags. However, the battery in the tags requires maintenance, which can mean some additional work,…

The innovation currently sweeping across the IT industry is artificial intelligence (AI). Language models such as ChatGPT, which can be trained with existing materials, have established themselves as a factor in our daily lives. However, language models are only a small part of AI and not exactly the most obvious candidates when it comes to integrating artificial intelligence into everyday IT processes. Instead, industry service Gartner listed better suited candidates a while back, while coining the term “AIOps” (artificial intelligence for IT). After experiencing the pronouncement of DevOps, ChatOps, SecOps – and now AIOps – you might be frustrated by yet more stuff that mainly comes from the vendors’ marketing departments and doesn’t really address actual needs in the daily IT grind. What’s more, when it comes to artificial intelligence,…

An important aspect of high availability is ensuring that the maximum performance of a system is maintained, even at maximum load. This state is achieved with tools that intelligently distribute access to the various servers. Seesaw v2 comes into play wherever high-performance load balancing is required. Seesaw only works up to Layer 4 and can therefore act faster than other potential candidates, such as HAProxy or NGINX. Load balancing is necessary to ensure the availability and scalability of business applications. The principle is basically simple, but ingenious at the same time: The load balancer offers access to the servers according to an algorithm, and additional servers can be added to the server pool, if required, while the end user remains blissfully unaware of any of these operations. The load balancer…

The cybersecurity landscape is large and constantly evolving. System providers incorporate a variety of security mechanisms into their systems, and many more security mechanisms and services targeting home or enterprise are available for purchase. The services share the common goal of preventing or detecting system attacks, or both. A newcomer has emerged in the commercial cybersecurity space called runtime integrity that promises not only the ability to detect when a system is attacked, but also to provide strong evidence that systems – even vulnerable systems in the face of dreaded zero-day attacks – have not been compromised. False Sense of Security Every day people access their various computing devices for a multitude of reasons, some critically important to their work or personal lives. So pervasive are these devices that virtually no…

In the realm of cloud computing, the performance of your virtual machines (VMs) directly affects the efficiency, reliability, and cost-effectiveness of your services, especially in Microsoft Azure, where Linux VMs are often deployed to run various applications – from web services to data processing tasks. System optimization for Azure VMs running Linux is not just a routine task; it’s a critical endeavor that ensures your workloads perform optimally, making the best use of resources while controlling costs. Assessing System Performance In the pursuit of optimizing Azure VMs on Linux, it is essential to grasp and utilize the correct tools and metrics to assess system performance effectively. These tools are pivotal in pinpointing performance bottlenecks and are integral to the ongoing process of monitoring and adjustment. Azure Monitor stands out as…

Unauthorized access to credentials is a part of virtually any successful cyberattack. Attackers are particularly interested in techniques that provide access credentials that allow far-reaching authorizations without immediately setting off the alarm bells on monitoring systems. Sometimes these techniques result from the functionality of Windows and Active Directory (AD). Stolen and Broken Kerberoasting [1] is an attack technique that relies on the ability of every user or computer to request, in Kerberos, a service ticket from the domain controller (DC) for every service. A check as to whether the requesting account has the right to do this only occurs when the service is accessed with this ticket. Therefore, if a security principal in the AD has a service principal name (SPN), any user – including a standard user or a…

Chances are that any system administrator who governs a meaningful number or servers uses a configuration manager of some sort. Just imagine upgrading the kernel on 20 identical virtual machines manually – you just wouldn’t do it. Instead, you run a program that goes through the hard work while you have a nice cup of coffee. Ansible, a popular software suite written in Python and probably the most popular tool for managing server fleets, is widely used to provision software (i.e., install software in servers) and configure your deployed applications according to required specifications. Because it is an industry standard at this point, aspiring system administrators are likely to learn Ansible because it is a marketable skill, even though it is not the only tool available for server management. Sake…

DNS over HTTPS (DoH) is an estab 443) as HTTPS. As a result, administrators initially have no way of distinguishing between DNS and HTTPS traffic. The standard is now supported by most web browsers, as well as Windows 11, and a number of public DNS servers also speak this protocol [2]. DNS over TLS (DoT) was standardized two years earlier in RFC 7858 [3]. As the name suggests, the DNS traffic is encrypted directly above the User Datagram Protocol (UDP), without needing another protocol in the application layer, making it easier for DNS providers to support this standard because they don’t have to implement the fairly complex HTTP protocol on the DNS server. However, as with HTTPS, a public key infrastructure (PKI) is required; the DNS server must offer an…