Security: A Sample E-mail How-To Guide For End Users

With the plethora of e-mail born Office documents with active macros in them to pull down malware/ransomware we sent out the following e-mail to all of our clients for distribution internally.

***

Good day everyone,

It’s gotten to the point now where we are considering a universal restriction on incoming Office Documents. By that we mean plucking them right out of the e-mail via ExchangeDefender by default.

We have somehow travelled back to the 1990s where the bad guys are setting up Office documents with a Macro, an automatic script that runs when the document gets opened, that goes on to pull down their nefarious malware or ransomware.

Here are some steps to help protect us:

1. Microsoft Office has a Save As PDF feature built-in. Please have all outside folks send a PDF instead of an Office document
1. This is especially critical for Resumes. All job postings _must_ request PDF and note that Office documents would be deleted on the spot!
2. If collaboration is required for Office documents use ShareFile
3. Preferred over Dropbox since security is questionable with the Dropbox service
2. Most Office documents that have Macros built-in have an “m” in the extension
1. 
2. Save the Office document to Downloads and verify!
3. If extensions are not shown then right click the file and left click on Properties
4. 
3. Users _should_ be prompted:
1. 
4. Obviously, the answer should be to NOT click that button
5. If they do, there is one last cause for pause
1. 
6. This is what happens if I try and click on something that is Macro driven _before_ clicking Enable Content
1. 

Along with the need to be mindful of any Microsoft Office attachments in our e-mail we should also remember the following:

1. Never click on a link in an e-mail without at the least verifying its destination:
1. 
2. Hover the mouse cursor over the link to verify
3. As a rule: Never, ever, click on a link in an e-mail. Go to the web site after opening a new browser window (IE, Firefox, Chrome, Safari)
2. It may _look_ like it came from someone you know but never trust that. Call and ask!
1. There are a few exceptions to this rule thus make sure to hover your mouse over the link before clicking!
2. Advanced users can check the headers
1. 
2. 
3. Follow the flow from origin server to destination server
3. Don’t save important site’s information in the browser
1. Banking IDs and passwords
2. CRA and critical site’s IDs and passwords
3. Do not disable the secondary question for any computer
1. Banking sites use this feature to help protect the account as one example
2. Answer the question, it only takes a couple seconds and could save your savings!
4. Never call the 800 number that comes up in a Search for Support!
1. Go to the manufacturer’s web site and click on the Support link to find the correct phone number
5. Never believe a pop-up message that says your computer is infected with something!
1. And never, EVER, call the 800 number on that pop-up!
2. Don’t click anywhere, close and save your work if needed then, reboot!
3. Do NOT click anywhere in the pop-up window. Looks are deceiving as all areas of that pop-up = YES/ACCEPT/CONTINUE
6. Never volunteer a credit card number or banking information to anyone
1. Social Security/Social Insurance Numbers too!
2. Folks can garner a lot about us online. Never volunteer any information when asked via any incoming call/e-mail/forum
3. Always call them back!
7. Caller says they are from the bank, CRA, or other seemingly critical business?
1. Ask for their badge number, an 800 number to call, and an extension
2. Open a browser and verify the 800 number belongs to the bank/CRA/CritBiz.
3. Then call them back after hanging up if the number proves true!

While the above list is far from complete, by following these guidelines we can greatly reduce the chances of a malware or ransomware infection.

And, as always, e-mail or call if you are not sure about something!

***

Please feel free to use this as a template for training users!

Have a great weekend everyone. It’s +10C here and much like an awesome Spring day!

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Some Thoughts On Security Layering for SMB and SME

We are by no means masters of security for our SMB and SME clients. Since we have to wear many hats we sometimes need to bring folks in that can help us to fine tune the security layers in our client’s networks.

Here are some of the Pearls (blog category) that we have garnered over the years. This was posted originally to the SBS2K Yahoo List and has been modified for this post.

***

Layering is important.

Some examples follow.

Windows Firewall

• Windows Firewall is managed by Group Policy
• All Profiles: ON
• All Profiles: Block ON
• All Profiles: Logging ON
• All Profiles: Pop-Up for new services ON
• DOMAIN Profile: Custom Inbound rule sets for required services beyond the default.
• Private and Public Profile: INBOUND BLOCK ALL
• If data sharing is required then a small and inexpensive NAS should be set up

Mail Sanitation and Continuity

ExchangeDefender (xD), for us, is one of the principle ways we keep bad stuff outside of the network.
Why allow it to hit the edge in the first place? Plus, it eliminates SMTP Auth attacks as the WAN IP is not published via MX among other attacks. Interested? Ping us and we’ll set you up.

Edge (Router)

A solid edge device, we use SonicWALL, with a BLOCK ALWAYS rule for ALL outbound traffic is a key element. Rule sets for outbound traffic are very specific and tailored to a client’s needs.

• Examples:
• DNS queries to non on-premises DNS servers are blocked. All DNS queries must go through the on-premises DCs.
• On-Premises edge only or DCs can have the DNS Forwarders set to DNS filtering services.
• SMTP traffic outbound only from the on-premises Exchange server. Or, local copiers/MFPs to ISP SMTP server IP only
• Inbound is HTTPS via ANY
• SMTP via xD subnets only.
• RDP on ANY port should NEVER be published to the Internet.
• RD Gateway with Network Level Authentication is a must today.
• Any exceptions require a static IP on the source end to allow inbound rule filtering based on IP.
• Look up TSGrinder if not sure why…

Ransomware Protection

Third Tier’s Ransomware Protection Kit is another layer of protection. Everything is contained in this kit to deploy a very tight layer of protection against today’s Ransomware.

Microsoft Office Group Policy Security

Office Group Policy structures with Macros disabled by default, non-local sources blocked, and other security settings for Office files provide another layer.

• This one gives users grief because they need a few extra steps to get to the documents.
• We’ve started requesting that clients have a PDF only policy on their Jobs listing pages and such.

A User Focused Effort

IMNSHO, A/V at the endpoint has become virtually useless today. Things seem to be a lot more targeted on the virus side with ransomware taking over as the big cash cow. We still install A/V on all endpoints. :)

What we are saying, is that the principle portion of the risk of infection comes via the user.

A well trained user means the risk of infection drops substantially.

A user’s browsing habits and link clicking are the two key areas of training we focus on. Sites visited are another.

We suggest to clients that a company policy of allowing browsing for business related tasks only while connected to the company’s network resources. This policy can further reduce exposure.

Part of our training regimen is a somewhat regular e-mail from an outside account to users to test them and challenge them is a good idea every once in a while.

• Link hovering to discover the true destination
• Attached Word doc with *BUZZ WRONG* when opened
• Just because it SAYS it’s “FROM” someone we know doesn’t mean it is!

Backup Protection

Oh, and protect the backup loop (blog post on closing the backup loop)!

BTW, we just heard about another NAS based backup that was ransomware encrypted as a result of the destination folder being open to users.

Anyone, and I mean ANYONE, that has a backup structure, whether NAS or HDD based, that allows users and admins access outside of the backup software username and password setup needs to close that loop NOW. Not on the To Do List, not for tomorrow, not next week, but NOW.

Just in case: Close that Backup Loop Now.

Hyper-V Standalone Setups

One more point of order: In standalone Hyper-V settings leave the host in workgroup mode.

No one on the network should have the admin username and password to that host. No. One. It should be documented somewhere but not public knowledge.

Please feel free to add the layers you use to this post via comments.

Thanks for reading!

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Hyper-V Virtualization 101: Some Basics Around Hyper-V Setups

Here are some pearls learned over our years working with Hyper-V:

• Host/Node Setup
• Make sure the host and all nodes in a cluster have the BIOS Settings identical (All settings)
• Leave ~1GB to 1.5GB physical RAM to the host
• We leave 1.5GB of space on a dedicated to VM LUN
• We leave ~50GB to ~100GB of free space on a shared LUN/Partition
• We set the MiniDump option and lock the swap file down to 840MB
• wmic RECOVEROS set DebugInfoType = 3
• Always set up a standalone host with two partitions: OS and Data
• Hyper-V
• Hyper-V lays out a file equivalent in size to the vRAM assigned to VMs. We must have space for them.
• Snapshots/CheckPoints create differencing disks. These _grow_ over time.
• Deleting Snapshots/CheckPoints requires enough free space to create an entirely new Parent VHDX.
• vRAM assigned to the VM should not traverse NUMA nodes (performance) (more on hardware).
• vCPUs = Threads in CPU and must be processed in parallel thus # physical cores - 1 is best.
• GHz is preferred over CPU Core counts for most workloads.
• Storage
• Be aware of the IOPS required to run _all_ workloads on the host/nodes.
• More smaller sized spindles is better than less larger size spindles = More IOPS.
• 10GbE should be the minimum bandwidth considered for any iSCSI deployments.
• At least _two_ 10GbE switches are mandatory for the storage path
• Networking
• Broadcom physical NIC ports must always have VMQ turned off (blog post)
• We prefer to use Intel Gigabit and 10Gb Ethernet Server Adapters
• We start with a minumum of 4 physical ports in our hosts/nodes
• UPS Systems
• UPS Systems should have at least 1-1.5 Hours of runtime.
• Host/Nodes and storage should be tested for shutdown durations.

There are quite a lot of these types of posts on our blog. Please click through the category tags to find more!

Thanks for reading.

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Some Remote Desktop Session Host Guidelines

We’ve put about four years and two versions into our Small Business Solution (SBS). We have it running on-premises on standalone Hyper-V servers as well as on Hyper-V clusters (Clustered Storage Spaces and Hyper-V cluster we just deployed for a 15 seat accounting firm).

It is the foundation for the Cloud Office services we’ve been offering for the last year or so.

Since our Cloud Office solution runs in Remote Desktop Services we figured we’d share some pearls around delivering Remote Desktop Session Host based environments to clients:

• ~512MB/User is cutting it tight
• ~20 to 25 users in a 12GB to 16GB vRAM Hyper-V VM works okay with 2-3 vCPUs
• RDP via 8.1 RDP clients saturates a 1Mb DSL uplink at ~13-15 users depending on workload
• ALL browsers can bring the RDSHs to their knees
• Printing can be a bear to manage (Use Universal Print Drivers and Isolation where possible)
• Group Policy configuration and lockdown is mandatory
• Two partitions with User Profile Disks (UPDs), if used, on the second partition
• NOTE: UPDs + Office 2013 and earlier + Exchange 2013 and earlier = Broken Search!!!
• NOTE: RDSH Search Indexes for Outlook OSTs in UPDs can fill up the C: partition!
• Office 2016 and Exchange 2016 together are supposed to address the broken search situation in RDSH setups were UPDs are used. We have yet to begin testing the two together.

Our Cloud Office (SBS) is running on clusters we’ve designed based on Scale-Out File Server and Hyper-V.

Need a clustered solution for your SMB/SME clients? Drop us a line. They are _very_ affordable. ;)

Philip Elder
Microsoft High Availability MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Some I.T. Professional Business Pearls

Here are some thoughts on the many aspects of running an I.T. business in today’s world that have been garnered over my 13 years in business so far.

• Never reveal business operations
• Financial
• Client’s names (don’t ever reveal clients supported to others)
• Projects, Purchases, or other such products and services WE provide
• Never volunteer _any_ information
• Always keep scheduling information time related
• I’m running behind, I’ll call in 15
• I’m working on something that went sideways, let’s delay to tomorrow please
• Always call, text, reach out in-person versus e-mail
• If calling follow-up with an e-mail “thanks for allowing us to delay by a day” or some such note
• We keep a priority band that our clients are aware of
• Priority 1: Business Critical Outage
• Priority 2: User down or problematic app
• Priority 3: App updates, changes and such
• Priority 4: All of the other stuff
• Never, ever, give a customer poop for leaving
• I learned this one the hard way
• Business is business no matter how the termination was handled by the now former client
• Never, ever, take things personally
• Respect their decision and acquiesce with grace and integrity
• Be silent
• Resist the urge to be defensive - shut this one right down
• Cooperate with the next I.T. company if need be
• Give over the keys to the kingdom with ease
• Always, and everywhere, do everything in writing
• “Yes, Ms. Customer, I’d be more than happy to help you do X and it’ll be done on Y” via e-mail after a conversation
• Always confirm project add-ons and scope creep with an e-mail indicating back charges and extras as they fall out of scope
• Keep an extensive set of audit notes for each client
• Keep an extensive change log for all clients
• Snip everything, name them accordingly, and keep them forever
• Be disciplined and document everything
• Use a time keeper
• Outlook Tasks or CRM with due dates and reminders
• OneNote notebook with Surface 4/Pro and pen close at hand
• Note keeper pocket notebook and mechanical pencils
• Write all requests down and transfer what needs to be to Outlook or CRM

The above is the culmination of my 13 years running our I.T. company. I hope it helps! :)

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Business Guidance Pearls Mentoring Opportunity

Our blog post on Some IT Pro Business Guidance Pearls has generated a _lot_ of questions! Thank you for that. :)

So, how about this?

Third Tier has a special on a block of 3 hours that ends in a few days.

Drop in to the Third Tier Help Desk, register, and purchase a time block. From there, open a ticket: Business Guidance Pearls Mentorship.

I would pick up the ticket and get in touch about scheduling our time together.

The structure would be:

• 1 Hour: Practice Assessment and Goals
• 1 Hour: Goals Roadmap
• 1 Hour: Goals Implementation Steps

I was very fortunate to have a former employer that worked very hard to teach me how to run an I.T. business. By “run” we’re talking about a lot more than just the bookkeeping and cash flow aspects.

Believe me when I say this, you’d not regret any minute spent. We’d look at the big picture right through to the details to facilitate growth in your I.T. Pro practice.

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business

Some IT Pro Business Guidance Pearls

Here are some bits and pieces of business wisdom that I’ve gathered over the years. Much of my initial business formation came from my first employer out here Larry MacDonald while working for Logical Computer Company.

• Keep a business journal (for me it’s my blog, Twitter, and forum helps)
• Document everything (take pictures of everything with SmartPhone, use Snip in Windows ALL THE TIME)
• Create build documentation for everything
• We have builds for clusters, Exchange setups, Exchange migrations, SBS setups, SBS Migrations, More
• Be consistent (build documentation helps)
• Use Tasks in Outlook and on the phone to track everything
• Be disciplined in tracking, responding, and being present to clients
• Spend 10%-20% on R&D
• Spend 10%-15% on lunches, dinners, and such with others
• Put 10% away for a rainy day
• Get involved with user groups or start one
• Get a _good_ accountant and keep them

As far as recurring revenue:

• IMSNHO, blended is better than full MSP
• ~$60/User to $110/User for:
• Server OS patch, Server App patch, and Microsoft App patch/install management
• Desktop OS patch and Microsoft App patch management
• A/V Management along with e-mail sanitation (we use ExchangeDefender)
• Remote Server Monitoring and management included
• On-site not included
• Phone and e-mail support beyond 15 minutes not included
• Offer backup rotation with quarterly full bare metal or hypervisor restore
• $150-$250 per OS per month
• Need a dedicated box for this (Intel S1400FP4 with 96GB ECC, and RAID 6 across spindles or SSDs)

Services

• Non-contract break/fix:
• $250/Hr immediate response
• $200/Hr 4 hour response
• $175/Hr 24 hour response
• Contract on above
• 4 Hour response included
• Immediate response at 1.5 rate
• Time Blocks offered at discounted rates

*Response being an acknowledgement of the request/ticket.

There are a lot of benefits over time as far as financial stability but also client relationships become a lot more stable and long term with support contracts in place versus a break/fix model.

We soon discover the clients that value our IT services and those that don’t when we move into the above model. What business that runs a fleet does not have a crew of mechanics to maintain that fleet? Why is IT infrastructure any different?

A major plus is in the routines that we build up. Our schedule gets a lot more stable and predictable. While we are still at our client’s beck and call we now have an established set of boundaries as far as how, when, and where the help would be provided.

We can have a few more evenings a week pursuing other things and _not_ looking at screens! ;)

Philip Elder
Microsoft Cluster MVP
MPECS Inc.
Co-Author: SBS 2008 Blueprint Book

Chef de partie in the SMBKitchen ASP Project
Find out more at
Third Tier: Enterprise Solutions for Small Business