- Sign-up Now!
 - Current Issue
 - Edit Your Profile/Unsubscribe

Subscribe | Media Kit | About Us | All Issues | Subscriber Feedback | Contact Us | Privacy Statement
Sunbelt W2Knews™ Electronic Newsletter
The secret of those "who always seem to know" - Over 500,000 Readers!
Thu, Jan 31, 2002 (Vol. 7, #9 - Issue #340)
The Price Of Info Security
  This issue of W2Knews™ contains:
    • Back To Basics
    • The Price Of Info Security
    • Need To Check For Illegal MS Licenses? Here's a freebie!
    • New Powerful Exchange Message Store Monitor
    • Transcender Sale: Prices Reduced As Low As $79
    • Dramatic Price Reduction Of Fazam 2000
  5. W2Knews 'FAVE' LINKS
    • This Week's Links We Like. Tips, Hints And Fun Stuff
    • Clustering Windows Server
  SPONSOR: Marimba
IDC reports that IT personnel spend 50% of their time in software
installation and upgrades
while performing a hardware and software
deployment operation. Marimba helps reduce the total cost of ownership
of your desktops and laptops to dramatically increase your ROI. With
Marimba, enterprises can distribute, update, and repair applications,
and collect hardware and software configuration information from each
end point.
Visit Marimba for more information.

Back To Basics

The year 2002 will go into history as the "back to basics" year. I do not see anything in the market that you could call the next big thing. The only exception would be wireless gear that allows you to stay in touch when you are on the move, but that's an evolutionary step and nothing radically new.

And back to basics means security and high availability. It's time to batten down the hatches, get sufficient redundancy built into your infrastructure, and get it secure. The U.S. Government is going to do the same thing, and spend megabucks to do it.

Some feedback on the last issue regarding passwords is next.

Using special ASCII characters over 128 has a few drawbacks, several of you reported back to me after trying it out. And I ran into unexpected trouble myself as well. Here are some pitfalls:

  • VNC (a remote control tool) only supports keyboard characters and if you ever try automating using the ASCII table characters, you'll find yourself seeing different symbols in the DOS prompt.
  • Some VPN's also choked on these special characters, and even Sunbelt's own Remote Admin tool did not like them, which I found out when I tried to remotely log into my cable-model connected Dell box at my house.
  • Investigate with the apps you have in use. Large corporate database apps that aren't exclusively tied to NT are unlikely to identify such a keystroke combination as a character, and won't permit their use in a password.
  • Use the ALT characters only in situations where remote connectivity is not an option and no scripting is needed when changing the passwords.
Warm regards,
Stu Sjouwerman (email me with feedback: [email protected])
2001 Best Seller Double-Take provides real-time (and open file) data
replication. You can use it for either High Availability and/or
Disaster Recovery. It is your main job to prevent downtime for NT and
W2K networks. Double-Take is the industry leading product that will help
you do just that. Because it is not a matter of "if" disaster strikes.
Fires, floods and other mayhem always happens when you least expect it.
Visit DOWNTIME PREVENTION for more information.

The Price Of Info Security

Gartner just came out with a very detailed analysis of the real cost involved to get your environment as secure as possible. This was just released as a web-report. You can almost use it like a checklist of things you need to have "in". Here is the summary of their report. The link to the full report is at the end. I'd almost say this is required reading if you are (partly) responsible for the security of your enterprise or need to create cost justifications for security related purchases. Let's hear how Gartner's summary reads:

"The risks in the e-commerce model are greater and more critical than they are in the traditional computing environment. Because of these risks, the cost of protecting businesses is rising. Better tactical solutions are needed, such as including risk assessment and information security design into project life cycles and including a security test plan with application and infrastructure-specific test cases.

"Information security concerns in the core design of infrastructure products, e.g., operating systems, databases and networks, are also needed. In the United States, the President's Critical Infrastructure Protection Commission is bringing together business, government and technology vendors in an effort to provide sound advice, solutions and practices for information security. Once the true cost of protecting businesses is documented, that information can then be used to bring change to the marketplace. The TCO for Information Security can help each enterprise do just that.

"Enterprises need to take the following actions to ensure a well-protected enterprise:

  • Establish a CISO (Chief Info Security Officer) position, preferably a peer of the CIO, with responsibility for ensuring that a formal business program is in place to protect the information assets of the enterprise (see Research Note SPA-13-2933, "The Role of the Chief Information Security Officer.")
  • With senior management and the legal department, review and update the enterprise's information security policy to ensure that it can be shared with trading partners.
  • Integrate information security into the PLC (programmable life cycle), including a security test plan with application- and infrastructure-specific test cases.
  • Implement an information security risk assessment process covering all businesses and information assets of the enterprise.
  • To assist in the management of the information security program, establish an inventory process including all applications, infrastructure components and personnel.
  • Establish an information security investment management process that includes hardware, software, personnel, external services and training (internal and external).
  • Perform a risk assessment on the outsourcing vendor prior to signing a contract to ensure that the vendor can comply with the information security policy. Ensure that the service-level agreement covers security activities.
  • Select security solutions that are compliant with open standards rather than proprietary solutions. Establish processes for responding to requests for security reviews from trading partners, and for conducting them in trading partners' environments.

Need To Check For Illegal MS Licenses? Here's a freebie!

As you all know, Sunbelt is a Gold Certified Microsoft Partner. That means we get to use some of the MS software without having to purchase licenses. But a month or so ago we also got a letter from their legal department to make sure we'd not be running too many licenses. So we needed to do an inventory. Our production environment in the USA has 70 machines in it, so we needed a scanner. That is when we were alerted to the existence of the Microsoft Software Inventory Analyzer (MSIA). We ran it and came to find we had to shell out 24K for some SQL licenses to get legal.

This puppy allows you to scan your local and network boxes and look for MS apps and tools. And just for fun, I just ran it again over the whole network. It takes about 20 minutes for 70 systems. MSIA identifies all the versions of Windows 2000 Pro and Server but also all the Microsoft Office versions. (We're W2K wall to wall, and a few of our Techs are running WinXP Pro on their workstations now.

MSIA was really only created to manage licenses. But it's free. You can enter the amount of licenses you officially own, and then run MSIA which will do the (simple) math for you. This puppy runs on your desktop and if you are a system admin, it's worth having for sure. Better yet, it's worth running every three months or so, just to make sure you stay legal. Here is the free download:


New Powerful Exchange Message Store Monitor

A lot of companies have jumped on the new CAMEO Recon to monitor their Exchange Information Store. Because of the sensitive nature of e-mail and corporate security, many of these customers do not wish to have their names published, so we're talking "in general" here. However, the product has a lot of customers in many different corporate, educational, government and military structures.

The functions the software performs for each company can differ based on the individual needs of each organization. For example.... Companies use CAMEO Recon to monitor and delete unwanted e-mails and attachment files from users mailboxes and sub-folders. This is especially useful if a company is hit with a virus that invades the mail system.

Antivirus software can prevent viruses from spreading however, antivirus fixes are not always immediately available to an organization and by the time that most users were alerted to the threat, the damage had been done. Virus scanning should be mandatory in any organization, but it's not enough. We have an Independent School District that used the product when they were hit with the 'Goner' and 'BadTrans' viruses. They used CAMEO Recon to delete the email message that was distributed to the users to prevent the virus from any continual spreading.

Other companies are using the product to monitor and scan for specific content employees have sent or received in e-mail messages. This is beneficial for many corporations that may be required to go back into their Exchange Information Store to research content that may be useful for legal situations.

More often in the headlines today it is revealed that a certain corporation is in a lawsuit over something that can be traced through e-mail. Even if a company is utilizing filtering software for real-time monitoring, the content they are looking for now may not be what was being monitored for at the time the original e-mail was sent; as a result, employers must try to go back and research the store.

Whether it is leaked corporate secrets or evidence for a harassment claim, CAMEO Recon can find messages buried in any part of an e-mail system-even in folders created by the user. Check it out over here:

Transcender Sale: Prices Reduced As Low As $79

Transcender has lowered single-user license prices for most of their TranscenderCert products, including Paks, for a limited time. During the current sale, single-user prices are $79 each for C++ Cert/Desktop 6.0, C++ Cert/Distributed 6.0, VBA-Cert 6.0 CommerceCert 3.0, SiteCert 3.0, i-Net+Cert 1.0 and Win98Cert. Single-user licenses for other products range from $99 to $149. In addition, Pak prices have been reduced and savings range from $160 off the MCSD Pak, which is now available for $339, to $20 off the CompTIA Pak 2.0, which is now available for $339. More at:

Dramatic Price Reduction Of Fazam 2000

Migrating to W2K and Active Directory? Here's a way to plan, deploy and manage Group Policies way more efficiently and save SO much time. If you do not know what GPO's are, this offer is not for you. If you do, read on! You'll love this product.

FAZAM 2000 (made by FullArmor) provides you with management and analysis of your Group Policy Objects (GPO's), which everyone agrees are a major headache in the more advanced environments. W2K based IT infrastructure can dramatically improve overall business performance. If done right. You need some third party tools to get that really done.

Enterprise policy management simply is needed in mid- to advanced W2K environments. FAZAM 2000 complements and enhances Microsoft?s policy management initiative. Check these features. Then check the price!!!

  • Provides Resultant Set of Policies (RSoP) or the set of effective policies that apply to a user when logging on to a machine.
  • Multi-Forest/Multi-Domain GPO Replication: Ability to create GPOs in one domain and replicate them to other domains and forests.
  • Reporting: Allows you to view detailed reports on GPOs in Active Directory through MMC console or Web Browser.
  • Automating Administration: Allows you to script the backing up, importing, and reporting of GPOs.
  • A Policy-Centric view of Active Directory: Provides a view of Active Directory with Group Policy links and filters.
  • Back Up, Restore, and Import: Allows you to back up and restore individual GPOs on a domain including filters and links.
  • Policy Auditing & Diagnostics: Provides you with the ability to perform remote diagnostics from a central administrators' console.
So now, how about that pricing? There are no more tiers. From 10 to 9,999 users the price is just $10 per license and $2 per license for maintenance effective immediately. This is a really good deal. This tool has suddenly become available for practically anybody running Windows 2000 and plans AD as well. Check:

This Week's Links We Like. Tips, Hints And Fun Stuff

  • From our web-archeologist: One of the earliest (if not the original) readme.txt of the most popular password cracker around.
  • The Ultimate Car Book is a grrreat resource. Separates the 'lemons' from the peaches. $US14 @ Amazon, a must if you plan to buy a new one.
  • The Microsoft-English Dictionary 1.5 (What Microsoft Really Means To Say)[grin]:
  • Paul Robichaux maintains a website called the ExchangeFAQ. If you are running Exchange, check it out:

    Clustering Windows Server

    This book demystifies Windows clustering from both a hardware and software viewpoint. It defines clustering terminology and concepts from a vendor-neutral perspective, and provides a matrix for evaluating the multitude of cluster technology offerings. You can use it as a road map to creating scalable and reliable Windows 2000 clustered systems.

    This unique book is for everyone from system designers to IT managers who want a solid understanding of the optimal products and technologies they can use in creating "clusters" of computers to support truly enterprise-caliber programs.