What happens if I Google, “google?”

As I was playing with Google searching the other day, I stumbled across some ways to search that might be helpful to you in specific situations.  Check these out.

Search Terms

You can use the minus sign to exclude certain words from your search.

Enter this search: SQL -Oracle

To find this: A list of all pages that refer to SQL but do not have the word Oracle on them.

You can search all pages that link to your site.

Enter this search: www.centriq.com:link

To find this:  A list of all pages on the web that have a clickable link to your site.

You can search a specific web site.

Enter this search: sql site:www.centriq.com

To find this: A list of pages on Centriq's site that have the word "SQL" on them.

You can search the contents of a url.

Enter this search: inurl:msdn SQL

To find this: All pages that have a URL that contains "MSDN" and have the term "SQL" somewhere on the page.

Of course you can mix and match these queries with AND, NOT and OR, to find combinations of results.

You can also either directly type the following query stings, OR dynamically generate then through asp code for some creative useful searching to users on your site.

Search Parameters

Enter this address:  http://www.google.com/search?q=sql

To find this:  All pages that have "SQL" on them.

Enter this address: http://www.google.com/search?q=sql&as_eq=oracle

To find this: A list of all pages that refer to SQL but do not have the word Oracle on them.  (notice, same as above)

Enter this address:  http://www.google.com/search?as_sitesearch=www.centriq.com

To find this:  Every page at www.centriq.com.

Enter this address:  http://www.google.com/search?q=techsmartkc&as_sitesearch=www.centriq.com

To find this:  Only pages at www.centriq.com that have the term "techsmartkc" on them.

You will find a list of how to use all search terms and search parameters at https://developers.google.com/search-appliance/documentation/50/xml_reference

Happy searching, I hope this article sparks some creativity and encourages you to use Google in an innovative way.

Closed without saving?? Never fear!

Did you ever accidentally close a document that you had worked on for a while and clicked “no” when prompted to save changes? Good news! The applications in the Microsoft Office 2010 suite have the ability to recover these documents. Instead of gnashing your teeth, try this!

First, make sure that AutoRecover is turned on!

1.  In the backstage view (File tab), click Options. In the Save category, make sure that the check box for Save AutoRecover information every xx minutes is selected.
Note: This must be enabled separately for each application (Word, Excel, PowerPoint)! 

 

2. Test it! When you close a document, you should see the following warning: “Do you want to save changes… If you click “Don’t Save”, a recent copy of this file will be temporarily available.”

To recover an unsaved document:

          1. Open the backstage view (File tab).

          2. From the Info category, click Manage Versions. The Recover Unsaved Documents button will appear.

(Alternately, choose Recent from the menu.

Near the bottom of the window, click the Recover Unsaved Documents button!)

  

             3.  Open the unsaved document from the UnsavedFiles folder.

     4.  When the document reopens, don’t forget to save it properly! You can thank me later :) 
  


     - Irene Heckert

Part II – Security Policy, SMB - Security Is At The Forefront

View Part I

For a lot of SMB’s a good security policy is the basis for a strong network defense.  However for those companies who have not designed and implemented a security policy within their organizations, security issues are lying in wait.

A security policy is the backbone and foundation for information security.  However in this day and age some SMB’s have ignored or not kept up with current security concerns and their policy or lack of policy may allow for a severe security breach.  This may in fact prove fatal for a SMB.

In Part II of my series for SMB, I am going to look at what makes a good security policy.

1.  Executive Management Buy In

All security policies should begin with an executive management summary that includes the purpose, direction and approval of the policy.  This informs IT as well as employees that security is supported in all aspects of the business.  Security needs to be addressed from a top down approach when it pertains to support.  By supporting security initiatives from this approach employees know that security is not only implemented but supported at all levels.

2.  Policies

A security policy is actually a collection of different types policies put together to create one policy.  The other types of policies are created from different areas that need to be secured, such as identification, authentication, authorization and auditing.   Other types of policies would include a user access policy, password policy, vpn policy, remote access policy, wireless policy and acceptable use policy.  Each one of these policies would address a certain set of guidelines and procedures when implementing these technologies.

3)  Standards


Each policy will have standards of how the technology can be implemented.  Standards are important because they allow us to measure by a metric.  For example, if the password policy has a minimum length of 8 characters, then when we set passwords we have a value to measure if we have met the standard.

4)  Guidelines

As mentioned earlier, each policy may also have a set of guidelines.  Guidelines are helpful because they allow us to implement technology with variables that may differ from one area to another area.  Guidelines provide a range of values because if we set a standard it may not be appropriate for that technology.  An example of a guideline would be the types of hardware purchased for laptops.  No one laptop may fit all the needs so guidelines are put in place to ensure secure hardware is purchased.

5)      Procedures

These are the details that go along with every policy that explains the how, who, what and when of how the technology is implemented.  An example of a set of procedures would be how a Cisco wireless thin client would be installed and managed.

6)      Acceptable Use Policy

This is part of the security policy that informs everyone on how company assets and resources are to be used inside and outside of the company.  The acceptable use policy has guidelines, procedures and standards from how you can use a company laptop to where you can go on the internet.  It is important that companies ensure this is updated and employees are made aware of changes.

If you would like to get some more information of creating a security policy and download some templates for the creation of different types of policies try SANS: Information Security Policy Templates

Next month in part 3, I will be discussing how SMB’s can implement and improve security awareness. 

Thank you and if you have any questions during the series please feel free to email me at wpruett@centriq.com

Tom Pruett
Consultant/Instructor


Connect with Tom!
LinkedIn 
Facebook
Twitter
KC IT Security Blog
YouTube

Taking On Microsoft's Lync Certification!

As a technical instructor, we are often challenged to take on and learn new technologies. For a Microsoft Certified Trainer, there are additional challenges – we have to earn our certification in those technologies before we can step into the classroom and share what we have learned.

Over the course of the past year, I’ve decided to tackle Microsoft Lync 2010. It seemed to be a good fit for me, as I spend a lot of time working in the messaging space with Microsoft Exchange 2010, and Lync integrates with Exchange. The other side of it is the fact that Lync evolved out of components that were part of Exchange back in the early days (pre-Active Directory), so that reinforced my resolve.

There are two exams to earn one’s MCITP:Microsoft Lync Certification. The first step is to become Microsoft Certified Technology Specialist for Lync by passing the TS: Microsoft Lync Server 2010, Configuring exam (70-664).  The second best piece of advice I can offer regarding this exam is to spend time with the product and the Lync 2010 Resource Kit. Specific to the exam, however, the best advice is to thoroughly ingest every article mentioned in Enrique Lima’s study guide for the Lync exam.

After you punch your ticket on 70-664, you’ll ramp up for the 70-665 exam. Once again, my old friend Enrique has another unofficial prep guide, and this one is a two parter: part one can be found here, and part two here.

Feel free to shoot me a line about any other questions you might have with Lync certification. Lync is one of Microsoft’s hottest properties right now, and the need for knowledgeable, certified professionals is on the rise.

Bob Reinsch

breinsch@centriq.com

How Can I Print in Color in Visual Studio?

One issue that came up in class some time back was that a student was printing his code from Visual Studio when he noticed that all of his code was being printed in black and white. From a learning perspective, he sometimes likes to view his code on paper, mark it up by hand, draw arrows and in other ways interact with it and make it sense of it.

However, one of the helpful features of Visual Studio, of course, (and of most Integrated Development Environments) is the color coding. By default, comments are shown in green, strings of text in red, keywords in dark blue and so on. So the student wanted to see if there was any way to get Visual Studio to print the code using the color coding that shows up onscreen.

It turns out that in Visual Studio 2008 and 2010, the color coding isn't enabled for print-outs. However, there is an extension from Microsoft that can be loaded to enable it to print in color.

The upside is being able to print in color.

The downsides are:

1)      The extensions are not supported in the Express versions of the Visual Studio products, and so Microsoft's color printing extension cannot be loaded on those versions.

2)      Collapsible regions will be printed as expanded; they cannot be skipped from the printout.

3)      The new print dialog box doesn't enable printing line numbers, and so they can only be printed by enabling line number margins in Tools-->Options.

4)      Margins for the page itself cannot be altered in this version.

To review the documentation and/or install the Color Printing extension for Visual Studio, visit: http://visualstudiogallery.msdn.microsoft.com/00ec88c2-1553-47d2-8170-3c5baa0c6e44/?SRC=Home

What's New With SQL Server 2012 Training?

I wanted to share with everyone what to expect in the classroom from SQL Server 2012 courses.  As many of you know, for a long time SQL Server classes have been arranged in three core courses, while the content has changed over the years to support the various versions, the structure of these three courses has remained the same.  This structure being: query writing, "traditional" db administration, and database development.  With 2012, these three core facets remain in place in three new 2012 courses.  The query writing course which used to be a jammed packed three day course is now a jammed packed 5 day course (thankfully).  The administration and development courses remain unchanged in length and strong in focusing on the core fundamentals of both administration and development, like backup, restore, indexing, tuning, automating, auditing, and error handling.

These courses are now in beta and we at Centriq are evaluating and providing feedback to Microsoft to ensure the courses offer students what they need.  We plan on offering them to the public as soon as possible and right now that looks like second quarter.

I feel very good about the 2012 SQL training present offerings and I hope to see you in class!

Please use the following URL to get detailed course information on these core course and additional courses as Microsoft makes them available.

http://learning.microsoft.com/manager/catalog.aspx?qry=SQL+2012&nav=trainingtype%3aClassroom+Training&btn=1

Part I - Threats and Vulnerabilities, SMB - Security Is At The Forefront

SMB's share a lot of similarities with large enterprises when it comes to IT Security.  Those similarities include confidentiality of data, preventing unauthorized access and ensuring availability of data.  However, enterprises have the resources such as security personnel to ensure these objectives are achieved.  SMB's have the same threats and vulnerabilities except they may or may not have the the personnel or knowledge that these threats and vulnerabilities may even exist or that they may even be effected by them.  

In Part I of of my "SMB - Security Is At The Forefront" series I am going to explore the unique challenges presented by threats and vulnerabilities for SMB's. 

I. Security Policies  - The Key

Whenever I do a security audit for a SMB, the first thing I find is the lack of a specific security policy.  I either find no policy or only a statement in the employee handbook about the AUP (Acceptable User Policy).  This is not enough in this day and age to ensure a secure environment.  First, the owner or owners need to understand that security is important and that their acceptance and support of a security policy is first and foremost.  A written policy explaining the policies, baselines, standards, procedures and who is responsible for security should be created so everyone understands what is to be expected with regards to security. 

II. Patching Control 

Most SMB's do not have a managed patching system.  By this I mean a centralized method of controlling when and what patches are applied to OS's and applications.  Most SMB's rely on Windows Update to individually update the OS, however it is up to the individual to ensure the updates are applied.  This can mean a workstation might not be updated and have a serious vulnerability.  A major component to a secure system is ensuring that all systems are up to date with the latest patches.  This includes a process that ensures that patches and updates are tested and rolled in a timely fashion.  This can be done easily and effectively by WSUS (Windows Server Update Service).  Also, ensuring a set of procedures to audit to ensure all systems are up to date is very important.

Weak Passwords

This is one of the biggest vulnerabilities for a SMB.  A lot of SMB's have weak password policies or none at all.  Employees are allowed to create passwords on their own for their workstations without any guidelines nor are they made to change them.  Also, in some cases there is no password on the system at all.   A strong password policy is crucial to securing a system.  All employees should be required to have passwords that are at least 8 characters, have a number and a character and should be changed at least every 45 days. 

Default Accounts

The use of default accounts is also sometimes an issue.  By this I mean workstations have just a default account on them such as administrator or guest with no password.  This allows anyone to use the system with minimal or no controls creating a vulnerability whereas a hacker or employee could exploit the machine.

Physical Controls

Since most SMB's only have a few offices, there may not be a great need for locks and door security since this is usually done.  However security to the IT closet or where the servers are located needs to be addressed.  Normally having only a few devices does not negate the fact that all servers, routers, switches and firewalls need to be in a secure place and have limited access. 

Wireless - Rouge Access Points, Weak Wireless Security

Sometimes SMB's will employ wireless solutions just as they would as if they were installing one at home.  This can be a serious concern because business wireless should not be treated like home wireless.  Business wireless should be concerned with getting connectivity with secure protocols and most importantly controlling access to the wired network.  Basic installation and lack of controls on the use of the wireless usually lead to a security breach.

Lack of Security Awareness

Owner and employees need to be aware of secure practices when doing their job.  All employees should understand the impact on the company if they are working on a computer regardless if it is connected to a network.  Having a good understanding of secure practices will help protect the company from most security breaches.

Next month in part 2, I will be discussing most specifics on how to create a SMB security policy.

Thank you and if you have any questions during the series please feel free to email me at wpruett@centriq.com 

Tom Pruett

Network Security Engineer/Senior Technical Instructor