Hardware Firewall Is a Must

From TechRepublic's recent "10 Things" blog:

6: Deploy a hardware-based firewall Let’s face it: The built-in Windows firewall is simply not sufficient. If you want real security, you need a dedicated firewall on your network. This firewall will be a single point of entry that will stop many more attempted breaches than the standard software-based firewall will. Besides, the hardware-based fire will be far more flexible and customizable. Look at a Cisco, Sonicwall, or Fortinet hardware firewall as your primary protection.  

This is an excellent, excellent, (did I say excellent?) recommendation. If you or your business is connected straight to your modem without any border protection from the external world then you're in jeopardy and by jeopardy I don't mean the game show, I mean trouble. Why? Because your PC or group of PCs have an external IP. Your device doesn't have a bouncer to keep the bad guys and crap out of your house. You don't have that extra layer of protection that a connected device needs to operate more securely. Now, don't think a hardware firewall will make you invincible. I don't want to paint the wrong picture. I do mean to say that a hardware based firewall along with other security measures can make you more secure. 

 What are the benefits of a hardware based firewall?
   
1. NAT
*cue hissing* Some techs don't think NAT is a security feature, but I do. There is some mystery regarding NAT. Was it meant for security? Was it not meant for security? I think it's up in the air. Even so, I think it's fair to say that NAT gives *some* security in that it gives your device a local IP instead of your public, external IP. Intruders, the green ones conservatively speaking, won't know your device's IP which does help. No, it's not a super excellent security feature, but it's just another layer of protection that is nice to have while we're still mostly in a IPv4 world.   

2. Rules
With a hardware based firewall, you can make firewall rules which are rules that you create to allow the traffic you want coming in and leaving your network. You can make as many or as little rules as you like. Don't want RDP sessions coming in to your network? Block it. Don't like WMI packets coming in? Block those too. It's customizable. Some techs start by blocking everything then slowly unblocking ports as the days progress. For example, a tech had most ports blocked. He downloaded WoW was able to run some of it, then realized he needed to open certain ports for the game, so he did. That's what I mean by some techs block everything, then slowly open ports when the situation occurs. You don't need everything open right out of the gate. Only open ports that you need open.   

3. Logs
Yeah, Windows and other OSs have log views, they're limited to your system though. With a hardware firewall you'll have logs informing you who and what was trying to access your network. You'll see your rules working. You'll see intrusions prevented, this app allowed, another app blocked and so on. It's helpful. It's encouraging. You can see your firewall at work or not at work. You'll see what's getting in, out, and blocked.  Those are three reasons I can think of right away for getting a hardware firewall. You don't have to spend hundreds of dollars on a hardware firewall either. Routers come equipped with firewalls. For my home I use a Netgear wireless router that is excellent for my home setup. The firewall provides good protection, customization, and it's easy to use. Buy one. 

 Netgear WNR3500L this link gives you the specs and has links to the stores it's sold at.   

* I didn't make the image used in this blog post. I found it in a google search from this website.

How to Install Microsoft Security Essentials

Ok. Here we go. This is the best real-time antivirus scanner around. AVast! comes in second, but MSE is lightweight and knows Windows better than any other antivirus sytem.

First things first. Uninstall your "old" scanner. I don't know which one you had so I'll just use Norton as an example.

Click on the start button (the windows logo located at the bottom left of your screen on the task bar).
In the search bar, type 'programs and features' then click on the programs and features icon.

in the programs and features windows, find Norton (or whatever antivirus you already have installed), single click on it, then click uninstall (it's located between organize and change)
Follow the uninstall process.
Reboot if necessary.
Now, click on the following link http://windows.microsoft.com/en-US/windows/products/security-essentials
select your version of windows 7 (most likely 64 bit)

click on download.
Save the file.
Then run the file.
Take the defaults.
If all goes well, you'll soon be protected from malware by MSE. Yay you!

Try Everything Before You Quit - How to Reset Internet Explorer

No, this isn't a good philosophy for life, but it is a good philosophy for technology repair.

A client told me she was bringing in her mother's PC for me to fix. Her mom has att.yahoo as her homepage in Internet Explorer 8. Apparently, ATT at Yahoo! has changed the look and feel of their homepage (new code and stuff). Since that change, my client's mom can't access the att.yahoo page. She has the site set as her homepage in IE 8. When she starts IE 8, the infinity circle runs for 5+ minutes (she let it run without closing it out and she said only a tiny picture had loaded after 15 minutes). Well, my client brought in the PC for me to check out. I asked her if she had opened a new tab in IE 8 to try and access another site. She said, "No, I didn't try that." So, that was the first thing I did after booting into Windows.

I was able to open google and do a google search (I searched pizza if you're wondering). I was also able to open Yahoo!. From that, I knew IE 8 wasn't hijacked by a browser hijacker or something else. During the opening of other sites, att.yahoo was still trying to load. I closed the att.yahoo tab, then I installed Firefox, ran it, and was able to access att.yahoo just fine in Firefox. My assumption that IE 8 was "just old" and that att.yahoo's new homepage was too "advanced" for IE 8 was beginning to be a reality for me.

I told my client that Firefox loaded site just fine and that IE 9 probably would too. I asked her if she wanted me to update IE 8 to 9. She gave me the green light because she thought IE 9 would at least be more familiar to her mom than Firefox and I thought that was probably true. So, I installed IE 9. Guess what? IE 9 had trouble loading the new homepage too. What? Honestly, I was stumped. Another thought came to mind though. Perhaps IE was broken in some way? Maybe a reset would fix this issue? So that's what I did. I ran the IE reset. Guess what? Att.yahoo loaded just fine, even the same speed as Firefox. I don't know what specifically the problem was between IE and att.yahoo's new homepage, but I do know running the IE reset fixed the issue. I wonder if the IE reset in IE 8 would have fixed the issue for 8? That question ties in the title post that you should try everything before you quit on the technology you're working on. I should have tried the IE reset before upgrading to IE 9.

Want to know how to run the IE reset? These steps work for IE 7, 8, and 9.

In IE, go to Tools > Options

The Options windows opens. Click on Advanced. You should see a Reset button in the lower right portion of the window under a heading that reads, "Reset Internet Explorer Settings." Click on the Reset button.

In the Reset Internet Explorer Settings Dialog box, click on the Reset button.

After a little bit, IE will be return to the default state. 

Dropbox says not enough space, but there is plenty of space

So you have 30 MB left in Dropbox storage. You try to store a 20 MB file in the Dropbox folder in your (windows) explorer and get a message like: Can't sync examplefile.xxx...out of space in your Dropbox Oh no! What do you do? Two solutions that may solve your problem.

This may sound like a stupid question, but do you have enough space on your physical drive? Since Dropbox acts as a folder on your physical drive there has to be enough space on that drive as well for it to sync and for it to be stored in your Dropbox folder. 


Have you cleared the Dropbox cache? This is the path in Windows Explorer (assuming you're using Windows 7) %HOMEPATH%\Dropbox\.dropbox.cache type that line in the location bar in Windows Explorer and it should take you to the dropbox cache folder. I think the cache folder is deleted automatically every 3 days, but if you just recently deleted a lot of files this could be taking up valuable space in your dropbox folder.

I hope one of these helps. 

Create an Alternate HTTPS port in Sonicwall

For my new project with Remote Desktop Services, specifically Remote Apps offered externally to our network, I had to create an alternate HTTPS port in my Sonicwall TZ210 because we couldn't afford a new external IP (politics). Anyway, here's what you do.

Login to your Sonicwall appliance. In the left column, under network, click on Services. You're now in the Services section. Under Services, click on "add." The Add window opens allowing you to create your service. You should have fields for name, protocol, port range, and sub-type. After you've named your Service, select TCP for IP type and now put in the port range you want. For this setup, you probably only want one port number, so the range fields need the same number, e.g. beginning 1500 and ending with 1500. Click Add and you're done.

Just above Services is Service Groups. Click on Add Group. The Add Group window will open and you can customize your Service Group (I labeled mine <server name> RD Web). After you've named it, find the Service you created and add the Service to your Service Group. Click OK and you're done. You've created the alternate port for 443!

This is how you should feel after this accomplishment. Celebrate by yelling and beating your chest. 

Issues with camera system

At work we have a 12 camera Geovision surveillance system that runs a TCP/IP service allowing LAN users to access the system and a Web service allowing authorized WAN users/devices to access the system from outside our network. This has been in place for at least 2 years now. Well, the other day I decided to access the system from home to see if our PTZ camera was working (I had heard a complaint). I couldn't connect. More specifically, using the external IP and the port number only resulted with Google telling me it couldn't find anything related to such madness. Curious, I contacted my boss and asked him the last time he accessed the system from his iPad (geovision app). He told me it had been a long time and to not worry about fixing the problem until the next day at work. Cool.

When I arrived at work I checked the following, but I didn't follow my policy of starting with external then going internal; if I had, then I would have fixed the issue sooner. What I did was start the complete opposite. Doh!

What I did

Began with the camera server. I checked the local firewall settings. Windows Firewall was on and allowing exceptions. I had all of the correct exceptions checked too. I then moved to turning off the local firewall on the camera server and accessing externally, but that didn't work. The Web Cam service was running also on the camera server. So, no problem with that device.

I then move to what I should have checked to begin with: Sonicwall. I checked the access rules, but I didn't see anything out of the ordinary. Everything we use was right there in the list. I then go to the NAT policies. Ah-ha! I see an odd NAT service called "our server name"-services with http and https. What? My comment on the NAT rule sucked too: sick/vacation. That didn't make sense to me because I had the correct mail server stuff running and I couldn't imagine why this NAT rule could be used for mail server stuff. My geovision services use http (8080) for the web access and this random NAT service also using 8080 was conflicting with the geovision service, which is why we couldn't access the camera system externally. I turned off the random NAT rule, tried the web cam externally and like a charm I was able to access the camera system. It wasn't cheer time just yet though because I had to make sure our mail service with our employee self-service system was still running with that random NAT service turned off. I tried it out and yes, it still worked.

What did I learn from this experience? I learned a few things (things I already know, but haven't put into habitual practice yet - FAIL).

1. Work from external to internal. Working this way keeps things simple because it's easy to get the external stuff out of the way first since there aren't as many things external as there are internal.

2. Document clearly. Even non-firewall things need to be documented clearly. When you're doing something at your work leave notes on why you're doing this or doing that. I have no idea why I made that NAT rule and the comment didn't help me at all. I was testing something, but failed to turn it back off. If I had documented clearly then I would have known the purpose of that NAT rule.

3. When you turn a service off or on or replace/whatever make sure your production services are running just as they should be. You know you've done something right when the only thing the employees notice is the new thing they were expecting or nothing at all after your network project.

Windows 8 Shortcut Keys and Start Screen Editing

Stepping Into The Windows 8 Pool Part 2

 
Ah yes. You feel the breeze? It's nice isn't it? The water is feeling good. You're relaxed just hanging out on the steps in the shallow end of the pool when suddenly you're beaned in the head with a volleyball. You look around for the attacker and you realize it came from that annoying kid in the pool named "Finance App." You've heard about him. He's annoying. Sticking his tongue out at you. Making jokes and being all financey and stuff. Well, there's something we can do about that. If you cool down, stay calm, and hangout with me for a second I'll let you know how. I'm about to give you a rundown on some Start Screen Basics. Here we go.

La-la-laaaa! Start Screen Basics 

In the last post I wrote about some of the popular Start Screen apps that are pinned to the Start Screen by default. These are apps pre-pinned to appeal to a wide audience. There are some apps here that I don't want on my Start Screen. They're annoying. Telling me about Finance stuff I don't care about or how about that useless Sports app (it's useless because it doesn't include the greatest sport of all time - pro wrestling)? Maybe you are interested in those, which is fine. The steps taken to personalize your Start Screen are universal for all apps whatever you decide to keep, remove, or add. Before we get into that though, we need to learn how to maneuver around the Start Screen first.

Windows 8 Keyboard Shortcuts 

TechRepublic blogger Greg Shultz released a Windows 8 keyboard shortcut cheatsheet that included 100, count'em 100, keyboard shortcuts for Windows 8. I'm not going to list all 100 here in this post, but do know that you can download the PDF by clicking here or on the link provided at the end of this post.

Most people love shortcuts. I can't think of a better place to use shortcuts than in a computer because, let's face it, we don't want to take the long way clicking through a long breadcrumb-trail when a simple and fun shortcut can get us there quicker. In this post I'll go over my favorite (since they're my favorite I just know they'll be your favorite) Windows 8 keyboard shortcuts for maneuvering around the Start Screen and then a few more that will be handy for other tasks. So, strap on your seatbelt, ease your seat back, and put into gear because we're about to take off. (was that overly cheesy?)

! note: In case you don't know where the windows key is on the keyboard check out this image

1. Windows Key (from here on WK) = Switch between Metro Start Screen and last accessed app
2. WK + C = Access the Charms bar
3. WK + I = Access the Settings Charm
4. WK + K = Access Devices Charm
5. WK + Q = Access Apps Search Screen
6. WK + F = Access Files Search Screen
7. WK + X = Access Windows Tools Menu
8. WK + E = Open My Computer
9. ESC = Close a Charm
10. WK + CTRL + B = Access a program that is displaying a message in the Notifications Area  

Bonus (these aren't for maneuvering around Start, but they're very helpful shortcuts)
CTRL + A = Highlight/Select All Items
CTRL + C = Copy the selected item
CTRL + V = Paste the selected item
CTRL + X = Cut the selected item
CTRL + D = Delete the selected item
CTRL + Z = Undo action 

While the entire list is worth checking out, the above shortcuts are ones I highly recommend committing to memory because you'll be accessing these places often and learning the above shortcuts will help you be more efficient. Now, let's personalize this sucker.

Personalization 

Now we're into the subjective side of things. I'll go over trimming and expanding the "stuff" on your Start Screen then color and design.

Right-click on one of your large apps (by large I mean rectangle) and look at the options that appear at the bottom of your screen. You have the option to make the app smaller. Click on "smaller" and see what happens. Da-da! It's now a square instead of a rectangle. Right-click on the same app and now the option to make it larger is available.


Now, let's eliminate some of the apps that will never be used on the Start Screen. For my experience, the app I'll unpin for this example will be the finance app and a few others I know I won't use. Right-click on the Finance app. The options available are: unpin from start, uninstall, smaller, and turn live tile off. It's not taking up too much space and there's a possibility I might want to use it in the future so I'll just unpin it from the Start Screen. If I knew for certain I wouldn't ever use it then I would have went with uninstall. To add an app to the Start Screen there are a few ways. I will go with the "from the Start Screen..." way since this section is on the Start Screen. Right-click in a blank area. Click on "all apps" to show all the apps. Right-Click on "command prompt" for this example and look at the options below. Click on "pin to start." Now click the WK to go back to the start screen. Hey check it out! Our app is on the Start Screen. If it's not in the location you want it to be in then click and hold the app and drag it to the position you want it on your Start Screen. Personally, I moved the desktop tile to the top left of the tile arrangements so when I boot up I can just press enter to start the desktop. Tweak the app tiles to what you like.

Let's go over color and background design. Use the key combination to bring up the charm settings (WK+I if you forgot) then click on "Change PC Settings." Once the window opens, click on "start screen." Now, you can change the background design and color of your Start Screen. When you've decided on your choices, go back to the Start Screen by pressing the WK.

There are still some personalization tips I want to go over, but I'll do that in the next post since this one is going on a little bit too long.

Related Post
Stepping into the Windows 8 Pool