Cloudflare Now Active

After the recent high-profile vulnerabilities, I decided to turn on the free version of CloudFlare for this domain.

CloudFlare provides a reverse proxy service that sits in front of your domain. It will serve content where it can on your behalf (caching), optimise content where it can (e.g. minimising JavaScript, HTML, CSS, etc.). But even more important from my perspective is their ability to protect against a number of vulnerabilities.

The most obvious protection – because this is where CloudFlare started – is DDOS protection. DDOS is a way of throwing very large numbers of requests at your domain, preventing legitimate access. But CloudFlare also now provide protection against other threats and it is interesting to look at the dashboard and seeing a bunch of threats being filtered out every few days.

A recent add-on, especially to the free service, is the ability for CloudFlare to provide SSL security for free. This means that your whole site can present as HTTPS (encrypted HTTP) & you can even enforce this so that visitors cannot connect without encryption. This is easily done without the hassle normally associated with creating and maintaining SSL security.

Kudos to CloudFlare for providing this excellent service and for providing a useful free version. I’m happy to recommend it to everyone who runs a web site or service.

Stay Secure! The Latest Recommendations for IT Security

Individuals and enterprises do not understand the value of their Information nor how to protect it. This article attempts to reveal simple and practical ways to protect IT assets and outlines some of the latest thinking and tools from industry experts.

IT Security changes over time and it is important to stay abreast. New threats are appearing all the time and so threat management also needs to change.

Here are some tips and pointers to the current thinking in IT Security.

Back in February of this year (2013), the Centre for Strategic and International Studies (CSIS) in the USA published a short but to the point paper on how to successfully combat the majority of current cyber security threats. The paper gives an excellent background to the latest threats without getting too technical. But the great thing is the 4 steps that they give to combating the majority of current threats.

These are summarised as:

  1. Use application “whitelisting” to help prevent malicious software and other unapproved programs from running.
    Whiles this is not quite as convenient for users, some of whom want to run anything they like, it is vastly superior to spending money on Anti-Virus tools that can slow down PC’s and often fail to catch the key malware. Of course, Anti-Virus tools do provide additional protection and should continue to be used.
    Example products for whitelisting are: SecureAPlus (review on gHacks), McAfee Application Control, and several others
    See also the SANS whitepaper “Application Whitelisting: Panacea or Propaganda” which describes the issues and opportunities in detail and gives useful conclusions. There is also a write-up on application whitelisting on Tech Republic, and another on InfoWorld.
  2. Patch applications such as PDF readers, Microsoft Office, Java, Flash Player, and web browsers.
    Patching schedules need to be vastly accelerated for most organisations. Having 2 or 3 “updates” a year leaves vast open security holes in enterprise infrastructure that is just asking to be compromised. Patching of key applications such as those listed here needs to happen weekly at least, as soon as possible is best. The bad guys aren’t waiting, they change their toolkits within hours to exploit newly found vulnerabilities.
  3. Patch operating system vulnerabilities, for the same reasons discussed above.
  4. Minimize the number of users with administrative privileges, the highest level of authority to make changes or undertake actions on a network.
    Users with administrative privileges are the goldmine for the bad guys. They are the easy back door into the heart of your enterprise systems.

According to these papers, following these simple rules is likely to protect 80-100% of common enterprise attacks right now.

For the latest on the underbelly of the Internet and the current threats, take a look at the blog of Brian Krebbs – Krebbs on Security. In particular, I strongly recommend reading and paying attention to his article: Tools for a Safer PC. Also pay attention to his article The Scrap Value of a Hacked PC that describes just why the bad guys want your PC even though you think there is nothing of value on it.