Daily Security Checklist

I don't fancy myself as one of the greats in the IT world. I know I'm a lowly rookie IT professional just starting out, but I do think my daily security checklist is worth sharing. If you don't have a security checklist you go through each day you might want to create one (heck, steal mine I don't care) just so you will be able to catch things in time and for peace of mind. If I'm able, I go through this checklist first thing before I do anything else unless there's urgent work waiting for me as soon as I step through the double doors (we have a set of double doors at our building - nothing fancy, but it's kind of cool to walk through them all bad and stuff). This checklist is tailored for our network, so I'll be using the names of hardware and software we have. If you don't have the same hardware and software, replace the name for your configuration, e.g. replace Sonicwall with Cisco, Juniper, etc.

Checking the border - Firewall and DNS
Our border firewall is a Sonicwall TZ 210. This bad boy is perfect for our environment: small in physical size, priced just right, excellent security, small learning curve, and boasts a lot of tools for the admin. I check the Sonicwall logs first thing because that is the point between us and the "external." I check the following logs: attacks, anti-spam service, and networking. I then move over to the current connections under the firewall tab. After that, I check out the current data from the security dashboard. I'm not familiar with other hardware/border firewalls, Sonicwall is my area, but I would think Cisco and Juniper have similar types of logs and such. I think it's important to check the logs first thing and the current connections in and out of your network. After a while, you'll notice the "everyday" stuff. Even though it's tempting to not check these things after a week or so of clean data don't do it. Resist!

DNS security
This step might not be a necessary step depending on your configuration. I check our OpenDNS records after the border firewall check because next in line is our DNS security, so that's the logic I follow (maybe it sucks, but it works for me - haha). Anyway, I login to our OpenDNS dashboard and check the logs. It's important to see what network users are accessing and trying to access. I notice a lot of adware and malware blocked by OpenDNS. The cool thing about OpenDNS is their alert system. If OpenDNS has detected malware, you see the alert in big red letters on your dashboard. The only problem is that OpenDNS can't give you the internal IP address, but it's because it's border protection. So, not only is OpenDNS good for web service, but it's security system is nice as well.

Checking the Inside: Network Monitor, Server, and Antivirus
I then move on to internal checks. Network monitoring tools come in handy here, e.g. LANsweeper and Spiceworks, checking vulnerabilities on PCs and non-PCs. LANsweeper has an excellent dashboard view giving you information like the following: pcs not up-to-date, infections, low disk space, recent changes and other cool stuff for non-PC devices. Most network monitoring software does this. I check the necessary reports then move on.

Next, I check the Windows Server 2008 R2 logs in the server manager. If you don't use Server Manager I recommend it for the simplicity. Everything you need for quick checks is there: roles, functions, and event viewer. I check the high priority events then move on to antivirus. We use Kaspersky Small Office Security. I check the scans of all the PCs in the network to make sure there weren't any infections detected and I also check to make sure all of the PCs were updated.

That is my security checklist. I follow the outside to inside approach because it makes sense to me. Usually the biggest threats will come from the outside (threats users don't notice) and the smaller threats are on the inside. If you have any suggestions feel free to comment on this post. I'm usually on the lookout to improve my checklist.

Microsoft Security Essentials and me

New kid on the antivirus block, Microsoft Security Essentials, is silently flexing his muscles and attracting some people over to his yard. Folks are going to it and for good reason because 1) It does a very good job 2) It really is anti-annoying and 3) It's lightweight. Plus, the layout is user-friendly and very attractive because of its simplicity.

1. It does a very good job

Recently, before running a malwarebytes scan on an allegedly malware infested system, I'll run a scan on the pc with the system's currently installed antivirus agent. One particular example I can think of was an AVG 2012 protected system. The system had all of the indicators of a malware infestation. I ran a scan with AVG and it returned a "no infections found" report. I uninstalled AVG 2012, installed MSE and on the initial quick scan, MSE found a few trojans and some adware. I ran a full scan in safe mode just to be safe and the scan was clean. I then ran a Malwarebytes full scan, still in safe mode, and the report was clean. I couldn't believe it. I then started using MSE myself and I install it on client systems. MSE obviously doesn't find infections every time on the first initial quick scan after install. Sometimes, the infestation is deep in the system and something more powerful like Malwarebytes would need to be used, but for general protection I'm learning that MSE is better than others like AVG, Avast, and Panda. It's at least better than their free versions. 

2. It's Anti-annoying and anti-expensive 

"It's true. It's true," said Kurt Angle when asked if MSE was anti-annoying and anti-expensive. I'm just kidding. To my knowledge Angle hasn't been interviewed on MSE (it was funny though, right?). No, but MSE is very silent, lean, and doesn't annoy you unless it has protected you from a threat. It doesn't even tell you when it's been updated like other antivirus programs. 

I received a call from a client last week about a problem. He told me his computer was acting funny, i.e., Internet Explorer was crashing every few seconds. When I arrive at this site, he gives me free reign. Before I do anything, I check to see what is running (down close to his clock) and I see that Avast! and MSE are both running. I remembered installing MSE on his pc a while back, but didn't remember Avast! being on his pc. I asked him if he installed Avast! and he said he did just a week ago because he didn't think he had antivirus running on the system since he wasn't getting alerted every day about something. I laughed and showed him MSE was on his system and that was his protection from threats. He mentioned that he remembered me giving him an overview of that, but thought I didn't install it because he couldn't tell it was even on there. That's one thing that makes MSE better than the rest. It's anti-annoying.

3. Lightweight 

MSE isn't resource intensive. You don't even notice it updating, scanning; you forget it's even there. Compared with Avast! and AVG, it's very skinny.

The only complaint I have is with scan scheduling. You can either schedule a quick scan or a full scan, but not both. Personally, I would like to have the scan schedule be a quick scan Sunday through Friday, then a full scan on Saturday, but MSE (as far as I know) won't let you do schedule like that. It's a very minor flaw. I have my schedule for quick scan 6 days a week, then do a manual full scan once a week. It's no problem.

Download MSE here. 

RAID 5 Hell

In the IT world it's apparently a given that RAID 5 sucks. No, maybe the IT tech you talk to won't give you those exact words when you inquire about RAID 5, but that RAID 5 sucks will be the message behind his words. It's true, it's true. Before this week I hadn't encountered a RAID 5 problem because where I work we have a fairly humble system of simply backing up all data and images to a NAS, so if there is a problem we restore from our backups. I'm not sure this non-RAID system is good for every network so don't think I'm promoting a non-RAID data security plan for you, just know that it's doable and not a terrible plan.

One of my co-IT-workers is off for sick leave this week and probably two more weeks so all calls from his department will go to me. I get a call on Monday that a lady can't remote in to her mapping server. She said she went to the server to see if it was powered on (good idea!) and it was on, but it was stuck at "press F1 to resume." She said that when she hit F1 the next screen was something "...about RAID-5 degraded not bootable" message. My first thought: CRAP. I know that RAID-5 needs at least three hard drives to be operational. If one fails, you can swap the bad drive out with a new drive of identical brand and same size or larger to rebuild the RAID, but if two fail then there is a serious possibility of not being able to rebuild the RAID. In fact, I don't know of anyone rebuilding a RAID-5 array from a two out three hard drive failure; maybe someone out there has and if you have then please tell me the story because I would love to add it to my growing list of tech stories. Anyway, I check things out and after about a hour of doing troubleshooting I come to the conclusion that two of the three hard drives are in fact failed drives. CRAP. I let the user of the server know that I can run to the local Staples, grab two new drives and just see if I can rebuild the array. She says, "cool" and that's the plan. I write down the type of hard drive used in the array: 1 TB Seagate Barracuda 7200 RPM.

I arrive at Staples, they have that type of drive and I immediately do my happy dance. I take the card to the cashier, she calls for a tech to go in the back and grab two drives for me, he comes back to the front with one drive and informs me that they only had one drive left. I then execute my sad face. I go ahead and purchase the one drive. When I get back to work, I inform the user of the happenings. She is somewhat sad. I tell her we can try and rebuild the array with the working drive, the new drive, and one of the failed drives just to see if we can rebuild it (I'm somewhat of a hopeful guy who likes to try almost certain failure scenarios) and to no surprise the RAID would not rebuild. We went through the immediate actions we could take:
* Reinstall Windows Server 2008 R2 on the new drive, add the second drive as a backup drive, and order a third drive and install it when it arrives and use that as a backup drive also. The server would be up and running in just a few hours.
* Wait for a new drive to arrive in at the earliest two days. Install the third drive with only a small possibility of the RAID-5 Array rebuilding. The server would not be up and running soon. Two departments use the server to access maps out on the road and at remote locations.

We went with the first option. From this experience it's plain to me that RAID-5 sucks unless you have a five or six RAID-5 array. I would rather have updated system-image backups of the computer for simple restore options in case of system failure. RAID-6 and RAID-10 I think are nice arrays, but this is the second time I've had problems with Intel's RAID-5 arrays. In the past, before this experience, I was able to shut-down the PC, disconnect then reconnect the sata cables and the array would rebuild itself. I never had an issue with RAID-5 array drives failing. The good thing in this experience is that this mapping server pulled its data from another PC so there was actually zero critical data loss. The only thing lost was availability. The mapping company will have to come down to our location and install the mapping software, but that should be by the end of this week.

RAID 5 or RAID 6?

PCs Intermittently Lose Connection to Server

Have you had this problem with your network? Over the past 2 1/2 years at work I've had this problem. We have funding/accounting/management software installed on Server1 and users who "use" this software do so via a mapped drive on their PC to Server1. Once in a blue moon a few PCs (not the same ones each time) will lose connection to Server1 (this happened 3 times - odd) completely, i.e. PC can't ping, RD to, or access shares on Server1 and likewise with Server1 to the PCs. The communication between them is dead, over, gone...you get it. How do I solve the problem? Now, the PCs can communicate with other nodes on the network, which they're getting juice to do that from Server2 I suppose. How do I solve the problem? By restarting Server1. I don't want to do that each time though. I want to know why this is happening and if there is another way to fix it.

Keep in mind that when I troubleshot this issue the user was impatient and wanted "it" fixed right away, so I didn't have the time to explore the problem deeply. The following is what I tried in order to keep from restarting Server1.

1. Restarting the problem PC. It didn't work.
2. Rejoining the PC to the domain. I took the PC off the domain, joined it to WORKGROUP then joined it to the domain. This didn't work either.
3. Did a GPUpdate via CMD line. Don't ask...I was scratching the bottom of the idea barrel. Obviously it didn't work.

That's what I tried. By this point the user was huffing and puffing. So, I went ahead and restarted the server and then all was right with the world; at least in the users world. So, I would like to fix this problem without resorting to server restart. Further, I would like to know what causes this to happen. I jumped over to Server Fault to glean wisdom from the sages there and boy did I glean!

Since the problem arises at random times and surfaces very little (3 times over 2 1/2 years) it's going to be difficult to actually troubleshoot this problem, but the guys over at Server Fault told me I could develop an attack plan for when it rears its ugly head again. So the plan, so far, is as follows: to see what is going on during the issue run Wireshark on one of the affect machines and also on Server1; to try and fix the issue disable then re-enable the network card on Server1 or run the following cmd on Server 1: arp -d* (enter). These were just a few suggestions given to me. I thought there would be a network service I could restart under Admin tools\Services, but the guys there said this isn't a service issue.

Anyway, I plan on updating this periodically as I explore the issue. I just posted the question at Server Fault today, so I might get more answers sometime after this posting.

***UPDATE*** 7/18/2012

The problem occurred again yesterday morning and at lunch, but this time it was just one PC that wasn't in the affected group last week. During the problem I did the following:

• Restarted the switch in her department - didn't work.
• Enabled then disabled her network adapter and the server adapter - didn't work
• Updated the driver on her PC this did work for the morning.

The monster reared its ugly head again at lunch.
 
Went to the server, collected wireshark packets between the affected PC and the server. Then, I restarted the server because I know that works. That fixed the issue. I was only able to read through the collected data for a few minutes because other issues came up (I'm the only IT pro - one man crew) that occupied my time for the rest of the shift. Thought about it through the night. Came in this morning, collected network traffic just to see if there were any network process hogs and couldn't find anything bloating the "pipe." Then it hit me: check the kaspersky logs on the server. I checked the network attack blocker logs and found that last week Kaspersky detected dos.generic.synflood "attacks" from the 3 affected machines last week and the affected machine yesterday. When Kaspersky detects things like that, it will cut off communication with the attacking node for 60 minutes. The logs gave the exact time of the issue and the time matched up with the time affected users called me about the issue. I tracked the logs back 30 days and noticed those logs were clean of attacks.

I set the network attack blocker to only block the attacking node for 1 minute. I'm also going to investigate what the synflood attacks could be. At least for now I know why those machines were disconnected from the server. Of course now, I need to figure out the source of those dos.generic.synflood attacks.

Black screen hell

Taken from Tips 4 PC (not my work, but I thought it would be useful).

Some common causes of a computer black screen in Windows:

I have to be honest, there are literally hundred’s of reasons why your computer might have a black screen. Hopefully your problem will be something relatively basic.
If you see the screen that tells you your computer had an error, do not choose to start normally, choose to start in safe mode now. See what is safe mode. This is your chance to go the safe way. Many people rush and press to start Windows normally and sometimes this causes a serious problem.

Where is your Monitor plugged in? “My computer screen is black”

The first and most obvious reason for a computer appearing to run but you cannot see the video is the monitor. A common mistake is to plug the monitor into the on-board video plug when you actually have a PCI or AGP video card installed. Trust me I have done this myself. Simply move the plug to the correct position. If you see two blue monitor plugs at the back of the computer or even a blue plug and a HDMI port then try using a different plug.
Obviously you should also check to see if the monitor plugged is actually in firmly. It could have been knocked out if it was not correctly positioned in the first place. This is the simplest computer black screen you can get.

Failing Display adapter or video card can cause a black screen in windows:

Most of the time you can tell if your computer video card is deteriorating by seeing little tell tale signs. Lines appearing or flashing can sometimes occur, however sometimes nothing happens at all. You might turn your computer on and have the dreaded black screen. You can try removing your video card and using onboard video, or replacing the video card to see if that is the problem.

People often also see a computer black screen when they have plugged their computer into a different monitor or even a TV where the screen resolution is not compatible. If it is a simple black screen on your computer it can also be a simple problem to fix, but unfortunately people do not realize this problem and start troubleshooting, which actually gives the computer are serious black screen. When I know that my computer is showing a black screen on my Windows computer and I know that I have just connected it to a different monitor, I immediately restart and press F8. This will take me to the the menu where I will choose enable VGA mode or something similar.

The next reason the computer will not boot up is RAM…or memory:

This can be the cause when your computer has a black screen in Windows.
If your memory is not seated properly (not in), is damaged, or even absent altogether, this can cause a black screen.

1. If you have no memory installed at all, some computers make no sounds and just show a black screen on startup. Other computers go crazy and beep their head off. I am an expert at this one, as I build so my computers.
2. When your computer gets a black screen only sometimes, it usually means your ram is on the way out..For example if you boot your computer and it doesn’t work, then go back an hour later, and it does work, your memory is playing up. You can try taking the ram out, gently cleaning it with an antistatic cloth, and replacing it. This may solve your problem. If it does not, then you should try running your computer with another compatible stick of ram installed.

If you plan to open your computer case and remove the ram please read these articles on how to open computer cases safely and Upgrade Memory

Black screen on startup with an amber flashing light

A flashing amber light along with your black screen on startup can be a few things.

1. Not enough power getting to the motherboard.
2. A dead power supply.
3. A bent pin or shorted out USB port causing a problem.

Computer black screen after installing new hardware

Often when computer users install hardware in order to upgrade their own computers they run into problems. If you have just performed an upgrade and then get a black screen, the answer is obvious. Some hardware components may not be compatible with the others in your system. And of course there is always the risk of static electricity damaging your components when you are not an experienced computer repair person.
You might just be installing a new piece of RAM but the best way to troubleshoot this is to go back to where you started from. Always start from the beginning. If your computer was working and you installed something, then take it back out. Think about what you are doing and try again.
This has nothing to with getting a black screen in Windows, as sometimes you have not even installed Windows yet. The hardware must be compatible together and also must be installed correctly.

Leaving a bootable usb flash drive connected to your computer

Yes this can confuse your computer and it won’t know where to boot up. When your computer has a black screen on startup from doing this and you realize this is the problem and remove the USB, the computer just continues to boot normally..this sometimes happens because a computer sometimes recognizes a USB as a CD drive and tries to boot to it. This is the easiest cause of a black screen in Windows as you can simply just take it out and restart your computer.

Corrupting the Boot Sector

A black screen on startup can be so many things! I have learned this lesson the hard way. Never turn off the computer when it is half way through the boot procedure. Even when it is taking forever, or having a major problem you must let it run through if possible. Interrupting it once may be ok, but twice or three times is a no no. After you have carelessly restarted and shutdown a few times the black screen may appear. But this time it may be beyond repair for the average computer user. How to repair a damaged boot sector by replacing the master boot record (MBR) in Windows XP

Black screen on startup – Your CPU is not correctly seated

If your computer has a black screen after transporting one place to another, this is the first place I look. Transporting a working computer, and then not working with a black screen = dislodging the CPU. You can fix this easily by removing the CPU fan and carefully replacing it back in its spot. You may also have to replace some thermal paste between the cpu and heat sink as it stops the cpu from overheating. Be very careful not to bend any pins when dealing with your computer CPU.

Keyboard Faulty

This one surprised me because when there is a problem with the keyboard the computer still boots and says that there is no keyboard detected on the screen. Well this didn’t happen for me. I had a keyboard with a bent pin on the cable, so when it was plugged into the computer, it just plugged in normally. Then the computer black screen on startup appeared, you could here it starting up but no posting beeps, no display, nothing. I even swapped monitors around until finally I tested the keyboard and found the bent pin. I never thought to look there because of the usual default message that appears on the screen when there is something wrong with your keyboard. This is why having a black screen in Windows as a crazy amount of causes and solutions. I really did not expect this one to come out of the woodwork.

Corrupted User Account – Computer Boots to Black Screen

If you have logged into Windows, so you actually saw the login screen, then logged into Windows, this can mean a few different things. One is that it can be a corrupted user account. In this case it would be handy to have another user account to login to. Then you would be able to tell straight away if that was the problem or not. If you can log into another account you will be able to access the corrupted user account through the main hard drive which is usually called C: drive. You will see a folder called “users” and then there will be another folder for the actual username.
If you are using windows XP than the files are in the Document and Settings section.

Notes relating to your computer black screen in Windows:

• If your computer has black screen but you can see one small flashing cursor, I see this as a good sign! It usually means your computer is ok to be formatted. It can also mean that you should try to repair the boot sector first. How to repair a damaged boot sector by replacing the master boot record (MBR) in Windows XP
• Here is an error specific article about your computer boots to a black screen with blinking cursor.
• Lets face it.. Having a black screen on startup is a common symptom for so many problems.
• Sometimes you can repair a black screen in windows or fix boot errors using a post diagnostic card.
• See more black screen troubleshooting tips.

More options when dealing with a black screen:

Buy the Ebook “Recover Your Computer From a Black Screen” only $7..


We also have a Tips4pc forum where you can chat with others that have the same problem.

If your computer has a black screen, please research your possible problem and be patient as fixing this error is usually left to the experts.
I really hope that your computer black screen has been caused by something simple and is a problem that you can fix quickly without too much stress.

Related Posts

• Black Screen in Windows Troubleshooting Computer Tips
• Windows Wont Boot – What Can I do?
• Computer Boots to Black Screen with Blinking Cursor
• My Program Won’t Start. What Can I Do?
• External Hard Drive Buying Guide
• The Best Windows 7 Tips and Tricks
• 10 Tips To Improve Your Computer Security

The Microsoft Surface excitement

It's here. Yes, it's here. Well almost. What am I talking about? I'm talking about the Microsoft Surface baby! The Surface is Microsoft's tablet, set for a fall launch time as of this writing. I'm excited. Are you excited? If not, you should be because this tablet is definitely worth taking into consideration for purchase. Before this tablet, the only tablet that really turned on my processor was the ASUS Transformer Pad and I seriously thought about purchasing that tablet sometime this fall, but now Microsoft's Surface has my gaze.

This is a bold move by Microsoft. Why? Well, because Microsoft is making the tablet with it's own hardware (as of this writing anyway - that's the story being told). Microsoft isn't going with Dell or HP and I don't blame them. Dell and HP aren't in position to build a killer Windows 8 tablet. Microsoft is going solo. I think it's a good, but bold and risky move. 

What do I personally like from what I know so far about the tablet? Well I like that the tablet comes equipped with a kickstand and a detachable keyboard. You don't have to pay extra for those things, which is nice. I like that it sports two full USB 3.0 slots and has a SD slot. Those are very nice things I have looked for in a tablet since the tablet craze started. The cool thing about the keyboard is that it's "just there" if you need it. Want to create content that has more characters than a tweet? Attach your keyboard. It's that simple. You don't have to take the unnecessary bluetooth steps. It's just there if you need then gets the heck out of the way if you don't. Cool. I also really like the Metro UI. My smartphone is a mango phone, so I'm used to the Metro UI. It's simple. It's clean. It's not busy like the Apple and Android UIs. 

I'm not going to be one of those techies who will shout, "Apple and Android will die at the merciless hands of the Surface! Doom! Doom! Doom to non-Surface tablets!" No, I'm not that guy. However, I will say this tablet is going to be big. It may not shove Apple off the tablet mountain, but it will get close.

Check it out. It's worth the look.

Microsoft Surface official site 

Poll: Would you buy your next tablet from Microsoft?

Wrath of the Data Center!

There is a new podcast up over at Packet Pushers called Wrath of the Data Center. It's worth checking out. The official description of the podcast is: "...the new podcast dedicated to the pursuit of the CCIE Data Center certification. The host of the show Tony Bourke brings guests to the show to talk about CCIE Data Center study topics." Even if you're not actively pursuing the CCIE Data Center cert, the podcast is still worth checking out because of the wealth of information coming from professionals who are in the field, which is always profitable for IT pros.

The podcast page can be found here.