Operational Security

I currently work in the healthcare billing field,  and data security is a big deal.  All employees, from receptionists on up,  sign a statement  acknowledging the HIPPA law.  (Health Information Patient Privacy Act.)   In the mundane everyday routine of an office,  people often follow security protocol without much thought.  With that in mind,  I thought I'd write down some of the security principles we follow.

The principle of least privilege:  How much access does a user need to get the job done?    This concept is pretty simple- don't expose yourself to unnecessary risk by giving users access to more than they need.    It may be obvious not to allow users to have access than human resources has.   There are other cases that are more ambiguous.  Should information that an insurance processor needs be available to a person who codes new medical charts?  What's the harm?  In a world where crazy, random and reckless behavior didn't happen, there wouldn't be any harm.   Security personnel should never underestimate the amount of damage a well meaning person can do.  It' s not just security risk.  They could delete someone else's work.  By default,  things deleted off a network drive are gone forever,  -there is no recycle bin.    This principle extends to internet use, and access to physical areas.  Whenever possible,  narrow the amount of possible things that could go wrong.

Physical security-  Most workplaces have security badges and codes to get in these days.  It goes back to the previous principle,  narrowing and identifying  the amount of people in the building narrows the scope of risk of things going wrong.

Equipment security-  At my current workplace,  we have every piece of electronics identified with a sticker with a unique code.  This is for insurance purposes if it gets stolen.  I do not like this policy.  Those stickers can get lost or damaged.   Any thief with a lick of sense would peel the sticker off before selling it.   Really, this policy only saves potential lost money from stolen goods.   I'd much prefer we used physical locks on the pc towers.

Server Room security-  Our server room is accessible by code only, and is kept at 63 degrees 24/7.  The server room is far and away the most important security cog in my, and probably most workplaces.   Are core software is ran as a terminal window that connects to our server which doles out licenses for a certain amount of logins.   The active directory and outlook programs run from here.  All of our shared work is here. So needless to say, no work gets done  unless everything is in tact.  It makes sense to treat it like an icy fortress.   Most workplaces keep things even more secure than ours.   These rooms often have two part doors where the second door won't open until the first is closed.  No tailgaters!

Email security-  Everything that goes out is encrypted.

FTP security- All of the information transferred between the hospital is encrypted and opened with a PGP security key.

USB policy-  Nope.  Regular employees don't need them .  Easy way to smuggle out private info.

Password policy-  We have passwords for Windows and our software that has to be changed regularly and quickly retired when an employee is terminated.

Shouldersurfing-  I've never really encountered this,  but for security purposes employees lock their computers when they are away from their desks.

As you can see,  security goes fire beyond firewalls and antivirus.   The people you work with daily are far and away the biggest threats to information security.

Troubleshooting internet connectivity in a network environment.

Ah, the old favorite, "I can’t connect to the internet."  In my last post on printers, I covered the basics of checking to make sure the connections were tight.  I don’t want to spend much time on that, but obviously, the same “start with the simplest explanation” concept applies.  Why’ll we’re at it,  what are some other simple explanations for why a user’s internet is not working?  Here’s a few examples:

It actually is working,  but it’s just one site that’s down.

Solution:  Either wait it out, or if the site is mission critical,  get in contact with their support.

It is working but a specific site(s) is having browser issues

Solution:  Varies, but often involves enabling cookies, SSL , TSL, or switching to a different browser, if that’s allowed in your environment.

The user is trying to get on to a blocked site.

Explain that the company firewall is designed to keep everyone safe and productive, but if the site is blocked in error, we can petition IT and regular management for changes in policy.  Notice that claims of “internet not working”  can mean a lot of things to an end user.

The user has internet service, but can’t connect to intranet site, such as a file server

Solution:  Varies, but the first step is to confirm that the server isn’t having general issues, not specific to the user.  The second step is to ask the user to refresh the connection to test, and then restart the computer.  Restarts will often fix these issues, as inelegant as it seems.  The third step is to check permission settings on the file server.  Is the user part of a group that is denied permission to the server? 

The user has general connectivity issues.

For the sake of argument, let’s say the obvious solutions have been tested.     I like to use the ping command from Command Prompt to see if a user’s IP  can be reached from my computer.  If it can, that’s a sign that the network cabling between us is intact.   If not,  we need to investigate further.  From the user’s computer,  you can use the command ping google.com

You can also try to ping a public DNS server  (above)

    Ping is working loud and clear for me.  Seeing this would rule out general connectivity issues.  If it stalls and never connects, it’s a sign that A:  a network cable, possibly at the network rack, is unplugged,  or B:  Your network’s security apparatus has decided it doesn't like the end user and has blocked his IP or MAC address.

To remedy this, you should check to see if the wiring corresponding to the user’s data port has made it to the network switch uninterrupted.  One of your co-workers may have gotten adventurous when rearranging things and left the user unplugged.  A security administrator will have to change settings on a firewall if the user is currently blocked.    

    If none of this resolves the issue, then I would break out a technician laptop and see if it is able to connect at the users work area.  If it can connect, it narrows the issue down to the user’s personal computer.   From there, I’d move the user’s computer to a test area, ideally connected directly to the internet and not through our intranet.  If the user has a virus, we don’t want it spreading through the office.  The network interface card would be the likely culprit if it’s a hardware problem.  If it’s not lighting up at the point where the Ethernet cord is plugged in, that’s a sure sign it is not working.

Lastly there’s a chance the PC is infected with a virus.   Dealing with viruses will be the subject of a future post.    
    As you can see, internet connectivity issues are a broad set of issues, with many possible points of failure.  I’ve undoubtedly neglected a few.    On the whole, the most important thing is to communicate with the user about the true nature of the problem.   It’s by far the most time saving step.

Troubleshooting printers.

Printers are one of the most common sources of trouble for the IT help desk.   Luckily, most of the problems are not that hard to diagnose. 

EX. Caller:  Mr. Tech, My printer is dead!  It won’t print anything.

Note that your customers/co-workers may be prone to hyperbole when they describe their problems.  That doesn’t mean they shouldn’t be taken seriously.  It just means a diagnosis must cover the basics before more complex solutions.

Mr.  Tech- Okay ma’am/sir, what were you working on when it decided to quit on you?

Notice I’m getting information from the caller without making her defensive about what happened; the printer breaking was an event that happened to her.

Caller:  I was printing a large document, and was cleaning off my desk while I waited.  It just stopped right in the middle of it!

The simplest solution is probably the correct one here.   The correct course of action is to have the caller check all the connections to the printer.  It was likely knocked loose while cleaning.     First, have her navigate to printers and devices.  From there, she can tell you if there are any warnings that her printer is offline.     With that knowledge in hand, she should check all of her connections, and turn her printer off and back on.  If loose connections were ever the problem, that would solve it.

In the above graphic,  A faded out printer means it’s no longer connected.   A warning sign means it has detected problems,  for example,  a driver that is no longer working.

Caller-  It’s just got this warning sign,  everything is connected and it still won’t print!

If there is a warning sign, the best thing to do is right click the printer, click troubleshoot, and let Windows do some of the work for you.  The two most common solutions windows comes up with are: “The print spooler service has stopped working” and “The device driver has stopped working” The first will start the print service automatically, though it can be turned on manually.  The second will try to download a driver for you.    In my experience, a restart is the best way to get the print spooler back on track.  A restart has the advantage of often curing other ills, like memory issues or malfunctioning usb ports. 

Caller:  Okay it tried to download a driver and it just says “driver failed to install properly.” 

At this point, some hands on maintenance is needed.  The technician should right click the printer in “devices and printers” and uninstall it.  Then, the tech should install the printer from the original disk or manually downloading the software. 

As a next to last resort, try changing out the USB cord.  It’s rare but they do go bad. 

As a last resort, you should hook up the printer to a test station and see if it works there.  That will determine if the printer itself is a clunker or if it’s an error on the user’s computer.

That’s the core of the troubleshooting process for the large majority of issues on a local printer.  A network printer is its own animal.  It opens up its own issues of internet connectivity,  the IP address of the printer,  and if the priority the user has over other users printing at the same time.  That, my friends,  will be the subject of another post.  This post is primarily focused on issues of network connectivity,  paper jams,  dead printers, and toner issues are best discussed in your printers documentation.

The basics

At some point, everyone should learn the basics of computer hardware.   As an advanced user, it can sometimes be frustrating to hear a non-technical user talking of buying a very advanced, expensive, laptop to do the same basic things they can do on a modern smartphone.   For a hardware technician like myself, it’s Important to know the details of the hardware of for obvious reasons, and knowing the details of many form factors and legacy components doesn’t hurt as well. 

So, in the spirit of education, let’s open up a desktop p.c. and take a look.

This is the basic ATX form factor.   ATX is the de facto standard for desktop PCs.    An important note before opening a desktop up yourself- take precaution!  Like any electrical device, it needs to be unplugged before its inner components are touched.   After unplugging, it’s recommended your wait a few seconds for the electrical current to die down before continuing.      Once inside, you can go start looking at key components.   Ideally, you’ll have gloves on to avoid static and be using tools without any magnetism to avoid damaging the components.  

Key Components

1.        Power Supply =Once inside, note the power supply at the top left.    There’s no need to open that up, unless you consider yourself an electrical specialist.    There are clear warnings that it can cause electrical shock.   There’s a time and place to replace a power unit, but for now leave it alone.

2.        Heat sink fan/CPU- To a beginner, it might seem strange that something as important as the central processing unit is a small chip buried underneath the fan.    It’s designed that way for a reason- the CPU can get very hot.  The heat sink is a spiked piece of aluminum (below the fan,

above the CPU) that absorbs the heat from the CPU and releases into the air for the fan to spread around.   If you take it apart, don’t neglect to put the heat sink back on.  It is critically important for the survival of your PC.    The fan explains itself.  It fans the heated air from the CPU to the vents on the desktop case to keep the unit cool.     Deep underneath it all rests the CPU.  It serves as the central interstate system for all the information being passed along the motherboard from the hard drive, RAM, GPU and chipset.  It’s rare to replace a CPU in my experience, but the important thing is to follow directions, using a processor that is compatible with your motherboard and socket type so as not to damage the metal teeth that hold it tightly in place.  There are too many socket types to list here, but looking up the motherboard name on a search engine will turn up the manufacturer’s website and a list of compatible processors.

3.       Video card is also called a GPU –Graphical Processing Unit.     Without it, your PC will only see very basic, blurry, shapes.    If you are familiar with safe mode, it boots without the GPU.    The GPU will look differently than the above picture from behind.  It screws into the back of the case, and will have your video connections, usually HDMI or digital in the newest computers.

4.       Hard Drive- You can think of the hard drive as the computer’s long term memory.  Your documents, programs, and the operating system itself reside on the hard drive to be retrieved as needed.

5.       Memory (RAM)   RAM stand for Random Access Memory.    The best way to understand it is too contrast it with the Hard Drive.   Each bit of information stored on a hard drive exists on a physical space on a spinning plate with the hard drive casing.    RAM is a stick directly integrated into the circuitry of the motherboard.    It can quickly read and write information and is used primarily to allow the computer to quickly juggle many tasks.  In practical terms, the more complex the needs of your computer (e.g. editing video with graphical effects) the more RAM is recommended.

6.       Motherboard.    This is the circuitry that connects all this together.   The board has all the connections for all the peripherals and slots to expand them.  The practical thing to know as a technician is that each make and model will have different peripherals that is compatible with depending on its and manufacturer.    A 2005 motherboard is not likely to be compatible with a high end gaming GPU and processor.

That’s it for today’s basic lesson.   These topics can be delved into much deeper.   I remember the study guide for my first A+ certification was 1100 pages.   Not all of that detail is necessary for most people.  But knowing the basic hardware in your PC will prevent you from getting lost in your future travels as a consumer or technician.

Subnetting: Like math but you actually use it.

I initially had trouble understanding subnetting because I rushed into it without having a deep understanding of how binary made up IP addresses.  So for the education of myself or anybody that needs to have it broken down, I'll try to explain.  This post assumes you know some of the generalities of how the internet works, but are fuzzy on the specifics of subnetting.

What is a subnet and why should I care?

A subnet is a logical division of a network.  A network is a group of computers that communicate with each other through (generally)  a backbone of Ethernet cords, switches, routers, and servers within a domain.  To best picture it,  consider a large office building to be a domain.   All of the computers in the office are in the domain.  The purpose of the network is to conveniently and privately share information in the office without going through the cloud of the internet.

The purpose of subnetting is to separate the office's network up in to pieces. This has many benefits.  For example,  most companies don't want the information on the Human resources computers to be easily accessible to the computers in the sales department.  Putting them on different subnets is best practice.  Also, in a large network, subnetting will make it for faster communication because it limits the number of  PCs contacted during a broadcast.

How does it work?

Here's where it gets complicated.    To understand subnetting, you must understand the elements of an IP address and to understand that, you must understand the binary nature of IP addresses.

An IP address such as 192.168.10.25 is not really “192.168.10.25″. IP hosts really see this address as:

11000000.10101000.00001010.00011001

The IP as us humans see it is in dot decimal notation.  To convert them to binary,you must first realize that each number(S) between the decimals translates to 8 digits in binary, each with different value based on their position.

The values based on position.

128 64 32 16 8 4 2 1

So,  lets do some simple math.     To get the 192 in the fist bracket,  you would need to add 128 and 64 together.  In binary, we can imagine a 1 to turn the full positional amount on and 0 to be turning the positional amount off.   So as listed above 192 equals  1100000 .   The 128 and 64 are turned on and the rest are turned off.

Now lets move on to 168.  128+32+8 will do it.   So converting it to binary looks like  10101000

Now, truthfully your windows calculator will convert this for you through the programmer function.  To me,  however, understanding the concept was important for me not to feel lost.  Let's move to the next important concept.

An IP address is comprised of two parts.  The network address and the host address.  The subnet mask is what will determine which parts of the address are which.  In your network settings,  you probably see something like this.

IP  192.168.10.25

Subnet mask  255.255.255.0

255 is the highest possible value in each of the decimal groups.  (Also called Octets because they take 8 bits each, just like IP.)     So the subnet mask is 24 bits  (8+8+8)  What this means for the IP address is that the first 3 octets are network addresses and the last one is the host address. What this means for an IT person is that your network has one octet (254 addresses plus one broadcast address) available to be assigned to local computers.  To the outside internet, they will appear to be coming from the IP of the same router. (default gateway)  But through a technology called  DNS,  they will be translated to the host computers address as necessary.   This is convenient as is conserves our limited number of public IPV4 addresses.    If we modified the subnet mask  to .255.255.0.0  we would have 16 bits and 65,534 hosts.  (take my word on the number of hosts.)  The trouble with this is that it leaves us with little flexibility in how many hosts we have.  254  or 65,534.   To get that number to Goldilocks levels of just right,  we must subnet.

To subnet, we are stealing a bit or two from the host address and using at a division to separate out a tighter fit  in the number of host addressed we have available.  Imagine you are in a company with 500  computers.    .254 is to small but 65,534 is too much to keep up with,

The “stolen” host–>network bits are in bold:

/24 – 255.255.255.0  = 11111111.11111111.11111111.00000000
/25 – 255.255.255.128 = 11111111.11111111.11111111.10000000
/26 – 255.255.255.192 = 11111111.11111111.11111111.11000000
/27 – 255.255.255.224 = 11111111.11111111.11111111.11100000
/30 – 255.255.255.252 = 11111111.11111111.11111111.11111100

The 24 bit mask is normal.   It is the common class C mask. To learn about the historical classes,click here.  Nothing has been stolen and the last octet allows 254 hosts.   Each line below steals an additional bit from the host. Note that the quantity of new subnets does not match up with the quantity of stolen bits. For example, if you steal 3 bits, this does not mean you have just allowed for the creation of 3 subnets. Looking at the /26 row along with the IP address 192.168.10.0, this would mean you have a potential for the creation of 4 new networks using the expanded fourth octet of the mask (11000000): 00000000, 01000000, 10000000, and 11000000. These networks would correspond to 192.168.10.0, 192.168.10.64, 192.168.10.128, and 192.168.10.192. You have to realize, though,that the more you steal from the host address, the less hosts you have available for hosts.

When I continue,  We'll learn how to tell what subnet an IP belongs to.  It's not the most intuitive thing in the world, but with the right guidance, it can be done without a headache.

---Continued--

The way to find out the subnet, you must add up the binary form of the IP and the subnet mask.  Except,  this doesn't follow the normal rules of math. To get it,  you must  use this chart.

• 1 + 1 = 1
• 1 + 0 = 0
• 0 + 0 = 0

So, lets add an example's IP and binary.

172.16.17.42 −- 10101100.00010000.00010001.00101010
255.255.240.0 − 11111111.11111111.11110000.00000000
Subnet address ==== 10101100.00010000.00010000.00000000 (172.16.16.00)

Ok,  I'll make up an example to work out.  Try to figure them out yourselves before looking at the answer.

192.168.12.52
255.255.255.230

11000000 10101000 000001100 00110100
11111111 11111111 111111111 11110000
11000000 10101000 000001100 00110000

192.168.12.48

Thoroughly frustrated?   Once you've got the concept down,  try using a subnet calculator.

Video Version