Best IT Documents.com Blog


Sample Remedy Ticket Flow Visio – Help Desk

Posted in Visio Samples - Stencils (457) by Guest on the November 26th, 2010

Free Sample Remedy Ticket Flow Visio download

Sample Remedy Ticket Flow Visio

 http://www.bestitdocuments.com/Services.html

 

Comments Off on Sample Remedy Ticket Flow Visio – Help Desk

NFS vs Coda

Posted in O S (375) by Guest on the November 22nd, 2010

NFS vs Coda
Considerations
NFS
Coda
Design goals
Access transparency
High availability
Communication
RPC
RPC
Access model
Remote
Up/Download
Mount granularity
Directory
File system
Server groups
No
Yes
Name space
Per client
Global
Sharing sem
Session
Transactional
Cache consist.
write-back
write-back
Fault tolerance
Reliable comm.
Replication and caching
Recovery
Client-based
Reintegration
Secure channels
Existing mechanisms
Needham-Schroeder
Comments Off on NFS vs Coda

Sample Visio – NFS Security Architecture

Posted in Security (1500),Visio Samples - Stencils (457) by Guest on the November 18th, 2010
Comments Off on Sample Visio – NFS Security Architecture

Sample Visio – Satellite Internet ISA Sample

Posted in Visio Samples - Stencils (457) by Guest on the November 17th, 2010

Free Sample Document Visio download Satellite Internet ISA

Satellite Internet ISA Sample.vsd

http://www.bestitdocuments.com/Services.html

 

Comments Off on Sample Visio – Satellite Internet ISA Sample

Sample Visio – RPC Security Architecture

Posted in Visio Samples - Stencils (457) by Guest on the November 15th, 2010
Comments Off on Sample Visio – RPC Security Architecture

Sample Visio – Unix Kernal Layer

Posted in O S (375),Visio Samples - Stencils (457) by Guest on the November 12th, 2010

Free Sample Document download Unix Kernal visio Sample

 Unix Kernal Layer 

http://www.bestitdocuments.com/Services.html

 

Comments Off on Sample Visio – Unix Kernal Layer

Sample Word – Cyclades ACS Appliance – Out of Band Management

Posted in O S (375) by Guest on the November 9th, 2010

One possible solution for Out of Band Network Management.

Cyclades_ACS_Appliance.doc

http://www.bestitdocuments.com/Services.html

 

Comments Off on Sample Word – Cyclades ACS Appliance – Out of Band Management

Secure your servers

Posted in Security (1500) by Guest on the November 8th, 2010

Review and implement my company’s security policies as they relate to web security. 

  • Implement a secure network infrastructure by controlling access to/from your web server by using: Firewalls, Routers and Switches. 
    Implement a Network Intrusion Detection System to monitor attacks against the web server.
  • Patched servers. 
  • Implement load-balancing/failover capability in case of Denial of Service or server shutdown
  • Educated developers about writing secure code.
  • Implement a log rotation mechanism.
  • Implement a disk space monitoring process.
  • The WHOIS Domain information registered for your web presence does not reveal sensitive personnel information, which may be leveraged for Social Engineering (Individual POC Names), War Dialing (Phone Numbers) and Brute Force Attacks (Email addresses matching actual system usernames). 
  • Check your Domain Name Service (DNS) servers have been properly secured to prevent domain hi-jacking via cache poisoning, etc…

http://bestitdocuments.com/Services.html

Comments Off on Secure your servers

Web Server Pieces

Posted in Security (1500) by Guest on the November 7th, 2010
  1. Server OS + Hardware •Web Server
  2. Database Server
  3. Web application framework or language
  4. Scripting language or Application
  5. Client & Browser Security •Authentication and Session Management 

Web Server

•Apache and IIS 6 / 7 are not secure OTB

•Configurations can become complex over time

–Look for unused modules or paths

–Look for world readable scripts or code

–Use Hardening Guides CIS and MS

–Keep your config well-organized and easy to read •Create default error messages

–Stop applications and SQL from revealing how they work •Monitor Logs –Everyday

–Most web applications typically log to web server log file

•Remove sample and test applications •Patch, (win / Unix)

Database Security •Isolate Database Server

–Database should be separate from web server

–Use a firewall to severely restrict access •Encrypt database connections •Harden the Database Server –CIS SQL Hardening Guide

–Configure Users and permissions carefully

–Use separate SQL accounts for Users and Admins

–Make sure to set administrative password

•Use parameterized SQL or Server Side SQL

http://www.bestitdocuments.com/Services.html

Comments Off on Web Server Pieces

Exchange Pre-Migration Data Collection considerations

Posted in eMail (66) by Guest on the November 6th, 2010

Accounts and Mailboxes
How many mailboxes are there?
How many exceed the 200MB limit? Please list.
How many contacts and custom recipients are there?
Which mailboxes have no quotas set?
How many lists and distribution lists are there?
What clients are in use?

• Outlook 200x
• Outlook 2003 via MAPI
• Outlook 2007 via MAPI
• Outlook 2003 RPC over HTTP
• Outlook Express via IMAP4
• Outlook Express POP3
• Entourage
• HTTP or HTTP/S (OWA)
• RPC over HTTPS
• ActiveSync
• Other

Is Outlook 200x cached mode in use?
What client operating systems are in use?
Application-Related Issues
List applications dependent on Active Directory.
List applications with authentication requirements to Active Directory, if known.
Identify all applications impacted by a domain name change.
Do all applications run when not in contact with a domain controller?
List applications dependent on E-Mail.

Identify all User IDs and Passwords imbedded within any application’s configuration.
Have any application-specific AD schema extensions taken place?  If so, please list.
Are any Windows Server 200x Active Directory Application Mode (ADAM) schema partitions in use for custom applications?  If so, please list.

Provide a dump of your schema.
Windows Environment
Versions
What is the current Windows environment?

• Windows Server 200x
• Windows XP
• Are their any XP systems that have been upgraded from Windows 2000
• Windows Vista
• Windows 2007
• Other (please specify)

Forests
Is AD deployed?
What is your forest functional level?
Are multiple forests involved?
Domains
What is your domain functional level?
Are multiple domains involved? If so, list the domain structure.
Trusts
Are there any AD trusts in place?
What’s the trust model in place?
Infrastructure Environment
Describe the network architecture underlying your environment (AD sites and IP Subnets)

• Where are primary and remote data centers and offices located?
• What speed connectivity exists between primary sites?
• Between remote sites? 

What IP Address ranges are utilized? List all Subnets.
Is your department utilizing any private IP Address space?  If so and not listed above, list all Subnets
Private IP Address ranges
10.0.0.0 – 10.255.255.255
172.16.0.0 – 172.31.255.255
192.168.0.0 – 192.168.255.255 

Which subnets have DHCP?
Generate network scan.
Develop a network topology diagram.
Identify all wireless/other devices such as laptops and mobile devices not discovered through network scanning.  Note:  We have discovered that computers whose sole network attachment is via a Wireless connection do not migrate easily.  Therefore, ensure all computers are connected through a wired Ethernet LAN connection before migration.
Describe the types of Domain Name Systems (DNS) in use (i.e. AD integrated, BIND, split-brain, etc.).
Describe internal and external DNS zones, MX records, Forwarders and Zone transfers.
What happens if an SMTP server becomes inaccessible? Does mail queue up somewhere? Has this been tested and confirmed?
Are Smart hosts in use?
Describe the Windows Internet Naming Service (WINS) topology.
Is there a Global Catalog (GC) Server local to every Exchange location?
Generate AD topology map.

Compile a master list of migration targets which contains the following information:

  *   User Name
  *   User ID
  *   Personal Computer Name
  *   Domain Computer belongs to (when multiple domains are present)
  *   Domain User ID belongs to (when multiple domains are present)
  *   Server Name and services it provides 

Identify all “workstations” that require contact with a licensing server (AutoCAD, ArcGIS, etc.) Any dongles?
Provide a list of all services currently running on your existing Domain Controllers such as WINS, DNS, DHCP, DFS, or any other third party service.
If department has multiple domains, identify all duplicate computer names and user ids across the domains.
List Intranet sites (HTTP, FTP and SharePoint).
List other AD objects (non-computer, non-user).
List all Group Policies.
What Group Policy management tools are used? (i.e. Policy Maker, GPPE)
List all SQL servers, their versions as well as their physical setup (in a cluster?)
Is DFS is use? If so, describe the setup to include replication schemes and server names.
Exchange Environment
Where is Exchange present (in a single, multiple or resource domain)?
How many Exchange servers are there?
Are your Exchange servers in mixed or native mode?
What are the Exchange server names?
Do you have clustered Exchange servers in place? If so, describe the setup (how many, passive, active, etc.)
What version of Exchange is running on each server?
What service pack and/or hotfixes are installed on each Exchange server?
What is the function of each Exchange server (i.e. mailbox server, public folder server, bridgehead server, X.400 server, NNTP server, Internet mail server, chat server, front-end SMTP server (virtual server or SMTP connector), front-end HTTP (OWA) server, front-end POP3 server, front-end IMAP4 server, T.120 Multi-point control unit (MCU) Exchange Conferencing Server (ECS), Windows 2000 Multicast Address Dynamic Client Allocation Protocol (MADCAP) server, ECS host server, Instant Messaging Server and Connector Server (Lotus notes, Groupwise, SNADS, IBM PROFS, Mobile Information Server Enterprise Edition, etc.)?
Are these Exchange servers ded
icated to a primary function, or are they multi-function servers? If multifunction, list the functions.
What third-party Exchange-related servers or appliances are in place?

• Anti-virus solutions (gateway-scanning, store-scanning, etc.)
• Anti-spam solutions (in-house or hosted)
• Secure messaging solutions
• Unified messaging solutions
• Wireless messaging solutions
• Workflow solutions
• Electronic forms solutions
• Document management solutions
• Records management solutions
• Fax solutions
• Backup solutions
• Electronic discovery solutions
• Storage management solutions
• Event management solutions
• Performance management solutions
• Diagnostics solutions
• Reporting solutions
• Monitoring solutions
• Instant messaging solutions
• Desktop search solutions
• Others 

Is Exchange installed on any domain controllers?
Organizations
How many Exchange organizations are present?
What are the organization names?
Have organization names (display name or CN) ever been changed?
Sites/Routing Groups
How many Exchange sites/routing groups are there?
What are their names?
How many servers are in each?
Connectors
How many connectors are there?
Identify the following for each connector:

• Connector name
• Connector type
• Connector costs
• Connector application (i.e. *, @exchange.mydomain.com, etc.)
 

Are any transport or store event sinks in place?
Directories and Lookup
Is directory synchronization in place (automated or manual) between AD and any other data source/directory?
Is there an inter-Org synchronization tool in place anywhere? 

• Has it been used previously in production?   

Are Offline Address Books (OABs) used?
Are multiple Global Address Lists (GALs) in use?
 

Are multiple Exchange 2000x Address Lists (ALs) in use?

• How is security configured for these?
 

How long is Free/Busy (users’ schedules for meeting requests, etc.) information published by all Outlook clients?
Is Free/Busy information published to any FTP servers?
Is Free/Busy information replicated across all sites?
Public Folders 

How many public folders are there?  Provide a list with their current sizes.

• What are all the key attributes (i.e. display names, server, SMTP address, if mail-enabled, any permissions, etc.)?

How is public folder replication configured?

• What is the replication topology?
• Have any public folder replication issues occurred? 

What organizational forms (OFs) libraries are in use?

• Names?
• Locales?
• Associated organization?
 

What types of E-forms are in use?

• 16-bit MAPI?
• 32-bit Outlook?
• ‘Web store’ forms?

Are any non-MAPI top-level hierarchies in place (i.e. have any non-MAPI Public Stores been created for custom applications)?
Storage
How many storage groups do you have?

• What are the storage group names?
• Locations?
• Is full-text indexing in use?
 

How many stores do you have?

• What are the store names?
• Locations?
 

What types of stores are in use?

• Mailbox stores?
• Public stores (MAPI and non-MAPI Top-level Hierarchies (TLHs))?

Policies
Describe the addressing policies in place:

• Internal SMTP namespaces (i.e. @mycompany.com, @myothernameformycompany.com, etc.)
• Recipient Policies (i.e. SMTP, X.400, other)
• Detail Templates

Describe the SMTP Transport policies in place:

• Allow Out of Office (OOF) to the Internet?
• Allow automatic replies to the Internet?
• Allow automatic forwarding to the Internet?
• Allow Non-Delivery Reports (NDRs) to the Internet? Action on NDR?
• Preserve Display Names to the Internet?
 

Describe the storage policies in place:

• Mailbox Quotas (warning quotas, prohibit send quotas and prohibit send/receive quotas)
 

Resources

Identify all the Resources that currently exist (i.e. conference rooms, equipment, automobiles, etc.):

• List the Resource attributes/properties
• Does the Resource automatically accept a schedule?
• Is the Resource moderated? Does it require approval?

NOTE: following migration department OU Administrators will be able to manage their resources. Make sure that no resources are schedule beyond your migration date. For any Resources that have been scheduled beyond the migration date the schedules will be lost.
 

Security
Is a Certification Authority in use? If so please describe that setup (how many servers, administrative mode, etc.).
Please list certificate types and use. Identify any external (Web/IIS, etc.) certificates in use. Identify secondary certificate use for a
Application such as 802.1X and Wireless, etc.
Is two-factor authentication required for access to any Exchange-related functionality or data stored anywhere in Exchange?
Are security devices (i.e. smart card readers, retinal scanners, etc.) required for access?
Identify department-specific privacy and security issues.
Are Exchange 2003 Real-time Block Lists (RBLs) in use?
Is Exchange 200x Sender filtering in use?
Are Intelligent Message Filters (IMF) in use?
Identify any department processes which include the hard copy or electronic storage, use or transmission of citizen or employee Tax information.
Identify any processes which include the hard copy or electronic storage, use or transmission of Health Insurance Portability and Accountability Act (HIPAA) requirements.
Identify any processes which include on-line credit card transactions which would require the department to meet the Payment Card Industry Data Security Standard (PCI DSS).
Identify any processes which include the hard copy or electronic storage, use or transmission of customer financial records and require meeting the security requirements set by the Gramm-Leach-Bliley Act (GLBA).
Identify any processes which include the hard copy or electronic storage, use or transmission of citizen or employee privacy information.
Identify and provide any department IT Security Policies.
Identify which ITRMC Policies, Standards and Guidelines are used as or which form the basis for department policies.
Identify any e-mail server and e-mail storage security precautions you have established above default security settings and practices.
Are Virtual Private Networks (VPNs) in place?   If so, why?
What are on the VLANs?

What client-side authentication mechanisms are used to accomplish the following:

• Access Exchange
• NT Authentication
• Log on ‘locally’ using Outlook to log on
• Logon ‘locally’ using Outlook Express to log on 

What Antivirus Software and Antivirus Service Pack Levels are used on all machines and are they running local firewalls?
Administration and Management
Which accounts/groups have Service Account level access to Exchange? To AD?
Which accounts/groups have Full Administrator level access to Exchange?
Which accounts/groups have Administrator access to Exchange?
Which accounts/groups have View-Only Administrator level access to Exchange?
Which accounts/groups have rights to modify the Configuration Naming Context (CNC) (Exchange 200x/AD)?
Which accounts/groups have rights to extend the AD schema?
Have Exchange administrative rights been delegated  to any users/groups?
 

Have Active Directory administrative rights been delegated to anyone/groups?

• Are users enabled to modify their distribution list/group membership?
• Are any self-service administration tools in place?
 

Are there any mailbox-only Administrators?
Are there any distribution list/group-only administrators?
Is Exchange administered centrally?

• If not, how is Exchange ownership distributed across the business units of your department? 

Who is notified of critical events to do with Exchange?

• Is this automated?
• What tools are in place to achieve this?
• How are notifications sent (i.e. e-mail, pager, messenger service, instant messaging, phone call, manual, etc.)? 

Who has ultimate authority for the corporate messaging system?

• What is the reporting tree from this person down to the Exchange administrators and support personnel?
• Who does this person report to? 

Who has day-to-day operational responsibility for the Exchange environment?
Do you provision different groups of users differently? For example:

• Are company executives’ mailboxes placed on a specific storage group, store or server?
• Are attributes used to identify or differentiate between groups of users (i.e. is custom attribute 1 set to “Executive” or something similar)? 

Identify the primary user for each machine
If multiple users share the same machine, document all users per each machine

Backup and Recovery
What backup software is in use?
What backup rotation scheme is in use?
What onsite and offsite backup media storage locations are in use?
How is backup media inventoried and who has access to inventories?
How is backup media secured during transport and storage and who has access? Is access logged in any way?
Is Deleted Item Retention in use?
Is Deleted Mailbox Retention (Exchange 2000 and higher) in use?
Are Exchange 200x Recovery Storage Groups in use?
Is item-level recovery provided as a service to end-users? To executives?
Is an Exchange Recovery Environment/lab maintained? Describe?
Usage (Provide if possible)
What are per-server traffic patterns (i.e. quantity and volume messages, system and user-generated traffic) for the following periods of time?

• Last week
• Last month
• Last year
 

What are forecasts for future time periods?
What are inter-server delivery times?

• Is there an established service level agreement (SLA) for intra-organizational message delivery?
• Are there bottlenecks in SMTP transport evidenced by low delivery times?
What are top mailbox sizes?
Who are top senders and receivers (i.e. by quantity and volume)?
• What about to and from the Internet?
Which Distribution Lists/Groups are used the most?
• Which are not being used? 

Which Public Folders are empty?
Other Workstations

• Verify File and Print services is enabled
• Verify “Server Services” is running
 

Identify hardware and software resources that can be reallocated to other functions.
List GroupWise considerations, if any.
List BlackBerry considerations, if any.
Identify and document any perceived obstacles that may cause issues during migration

http://www.bestitdocuments.com/Services.html

 

Comments Off on Exchange Pre-Migration Data Collection considerations

Web Security Attacks

Posted in Security (1500) by Guest on the November 5th, 2010

•Abuse of Functionality

•Brute Force

 

•Buffer Overflow

•Content Spoofing

 

•Credential/Session Prediction

•Cross-site Scripting

 

•Denial of Service

•Directory Indexing

 

•Format String Attack

•Information Leakage

 

•Insufficient Anti-automation

•Insufficient Authentication

 

•Insufficient Authorization

•Insufficient Process Validation

 

•Insufficient Session Expiration

•LDAP Injection

 

•OS Commanding

•Path Traversal

 

•Predictable Resource Location

•Session Fixation SQL Injection

 

•SSL Injection

•Weak Password

 

•Recovery Validation

•XPathInjection

 

•Fingerprinting

•HTTP Response Splitting

http://bestitdocuments.com/Services.html

Comments Off on Web Security Attacks

Top 10 Web Security Vulnerabilities

Posted in Security (1500) by Guest on the November 4th, 2010

1.      Poorly validated Input

2.      Broken Access Control

3.      Broken Authentication and Session Management

4.      Cross Site Scripting

5.      Buffer Overflow

6.      Injection Flaws

7.      Improper Error Handling

8.      Insecure Storage

9.      Application Denial of Service

10.  Insecure Configuration Management



How to counteract these issues:

Test existing web applications against common exploitation techniques

Architect, design and develop more secure web applications

http://bestitdocuments.com/Services.html

Comments Off on Top 10 Web Security Vulnerabilities

Sample Excel – Performance Reference Model Sample Descriptions

Posted in Sample - IT Spreadsheets - PowerPoints (251) by Guest on the November 3rd, 2010
Comments Off on Sample Excel – Performance Reference Model Sample Descriptions

Sample Excel – Data Reference Model Sample Descriptions

Posted in Sample - IT Spreadsheets - PowerPoints (251) by Guest on the November 2nd, 2010
Comments Off on Sample Excel – Data Reference Model Sample Descriptions

Sample Excel – Business Reference Model Sample Descriptions

Posted in Sample - IT Spreadsheets - PowerPoints (251) by Guest on the November 1st, 2010
Comments Off on Sample Excel – Business Reference Model Sample Descriptions

Sample Excel – Service Reference Model Sample Descriptions

Posted in Sample - IT Spreadsheets - PowerPoints (251) by Guest on the November 1st, 2010
Comments Off on Sample Excel – Service Reference Model Sample Descriptions