Posts

A walkthrough of getting #Syspeace licenses and how it works

Getting #Syspeace licenses and how it works.

From time to time we get an email from customers that have bought their Syspeace licenses and they ask for the license key that they expect to get in an email.

Here’s a walkthrough of how #Syspeace licensing actually works.

First you install a #Syspeace trial, register a valid email address and choose a password password (this is done in the initial setup of SysPeace ).

The license key is then email to that mailaddress.
This is the key that will also become the live license when you buy the license, There is no separate license key mailed to you if you purchase licenses.

Once you purchase the license, the Syspeace client will automatically be updated upon the next contact with the license server when it requests a new token to validate the license or the next time it is restared.

If you want to extend your Syspeace license to be valid for more servers, simply login to the Syspeace licensing page and extend your license and install Syspeace on the next servers , using the same license key.

When you extend the license, you also have to ability to align license renewals to fit your needs. As an example, if you bought a Syspeace license in april for 3 #Windowsservers and two months later you install an additional server. The easiest way is to extend the running license and simply adding a fourth server. This way you don’t have to have an administrative nightmare in order to rememember various license renewals for diferent servers.

If you’ve bought your license through a reseller such they’ll manage all of the administration for you.

Have a try for yourself and download a free, fully functional trial of Syspeace and have your #Windows #Server, #Exchange and #OWA , #SQL , #Citrix , #Terminal #RD #RDweb , #Sharepoint and more automatically #intrusion protexted in a minute.

#bruteforce attacks and #dictionary attacks blocked, tracked and reported.

So far , #Syspeace has blocked 2 042 900 #intrusion attempts worldwide!

By Juha Jurvanen – Syspeace reseller at JufCorp and independent IT Consultant

Syspeace license password reset

Hi, all.

As all of you know, we put a lot of effort and work into getting various features and improvements in place to help you protect your Windows 2003/2008/2008R2 and the Windows Server 2012 support coming up , Terminal Servers, Sharepoint Servers, Citrix Servers, Exchange Servers and so on.

We’re just so into making Syspeace the nr 1 product for intrusion prevention for Windows servers and a natural part of any Windows servers baseline security so that’s where our main focus is.

From time to time, our administrative efforts get left behind.

One of the most common questions , acually by far the most common question, emailed to our support is that when you wanted to buy a license for Syspeace, you’d forgotten your password and we provided you with a password reset link manually.
From one point of view, we’re happy to talk to you guys and help you out but of course, a password reset thing should be automated to help you get your licenses as soon as possible.

So, finally, we’ve now implemented a “Password reset” feature on the licensing page. Simply fill in the emailaddress you used when you registered and a password reset link will be emailed to you.

We’ve also got the instructions more clearly into the email you receive when you buy a license that you actually won’t have to do anything.

The trial license you’re running will be automatically verified as a valid, live license the next time your Syspeace contacts the license server.

So, in short, you won’t have to wait for a license number to be sent to you since you’ve already got it.

PS. As a heads up, we’ll be releasing the SQL Server support and we’re also working on a GUI feature to easily sort, search, find and export various reports to CSV files D.S.

by Juha Jurvanen

Syspeace now also for Windows 2003 Server

We’re happy to annonuce that the 2.0 version of Syspeace now also supports Windows 2003.

A few other changes in there are that the engine is rewritten to be even faster, the GUI has been simplified and we’ve done a few other changes “under the hood” to make it more modular for future development for new functions.

If you’re looking for an easy to use , cost efficient brute force and dictionary attack intrusion prevention software for Windows Servers on Windows 2003, 2008 2008 R2, 2003 SBS, 2008 SBS and so on.

We have also tested it on Windows 2012 but the official support will come later, but so far though, it has worked as expected.

Once you install Syspeace it protect your Citrix, Sharepoint, Exchange OWA, Terminal Servers and more ..

Have a look at Syspeace.,

The fully working trial is absolutely free for one month

Getting the datacenter ready for the Holidays – a few thoughts

Note: This was written just before Christmas 2012 but it does apply to any longer holidays or vacations ../Juha Jurvanen

The Christmas holidays are coming up and most people look forward to them as always.

One aspect of the holidays though that might be worth to remember is that your serves might be more attacked during the holiday seasons since many hackers assume that your ususal vigilance for monitoring brute force attacka and dictionary attacks is lowered.

This year, Christmas Eve is on a Tuesday and for quite a few the time away from work can be up to a couple of weeks, including system administrators and techs.

The downside to this well-deserved leave is that it might give an attacker at least two weeks to try and hack your servers without anyone noticing it.

A few things you may want to do before you leave work for Christmas then.

Security patches

Make sure your servers and systems (such as firmware for switches, WiFi and so on) have all necessary security patches installed.

Antivirus status

Make sure your antivirus is running and updated.

Firewalls and WiFi entry points

Have a final look at any entrypoints to your networks i.e. have a look at firewall rules and WiFi access points. Shutdown everything that doesn’t need to be running.

Test servers

Have look around and see that you don’t have any unncessary test systems running, if for no other reason than to save money on current. If your test-serevrs are in a virtual environment, shut them down since they could pose a securiy risk. Test systems are always test systems.

External access via VPN

Make sure you don’t have any rogue VPN certificates out in the wild or any users active that should’t have access. Also, consider changing administrative passwords if it’s been a while.

UPS

Have a look at battery and charging levels for your UPS ,
Should a power failure occur and these things don’t work , you might be forced to fix a failed hardrive on Christnmas Evev and nobody wants that.

Hardware health checks

Check for any hardware errors in your monitoring sodtware (such as the HP Insight interface ) to see make sure you don’t have hard drives that are predicted to fail or any other hardwrae malfuncion going on.

Backups

Have a good look at your backups, logs and doublecheck they’re running correctly and that data is duplicated automatically. Especially for any backups that clear logsfiles sucha as Exchange backups, SQL Server backups . You don’t want to fill up yur system drives if ou’re not around to take care of it.

Contingency plan

Make sure there’s an updated plan in place with the correct phone numbers and contact info to the right staff and suppliers in case of an emergency. Have a look at the schedules to see who’s on call and make sure the plan is reachable, even if the datacenter isn’t.

Network monitoring

Install software for monitoring and scanning your network and have it alert via email for anything strange such as a new device on your network, a newly created user somewhere, mismatch in network configurations and so on. You could have a look at SpiceWorks that’s free and gets the job done if don’t have anything in pace now,

Brute force and dictionary attacks and intrusion detection

Install Syspeace to automatically block, trace and report any brute force attacks against your Windows, Citrix, Exchange OWA, Sharepoint, Terminal servers, Sharepoint and so on.

I’m sure there’s even more things that might be worth doing but this is a start anyway.

By Juha Jurvanen – Senior IT Consultant

Securing Cloud services from dictionary attacks – hack yourself and check your Cloud providers / outsourcing providers security and response

The more we move our data to various Cloud services and to outsourcing companies, we also need to take the consequences into account what that means from a security perspective.

Prior to a move to Cloud services, a company could keep track of how communications are secured, they could set their own account lockout policies and monitor all logfiles in order to keep security at the desired level.

With the popularity of Cloud services becoming more widespread, a lot of the possibilities for this kind of control and tightened security has disappeared. As a Cloud user you rarely get any indication that someone is for instance trying to use your username and password to gain access to your, for instance , your Microsoft Exchange Webmail , also called OWA.

A hacker can probably try to guess your password with a brute force attack or dictionary attack for quite some time and nothing really happens. The protective measures at the Cloud service provider are most likely unknown to you and you will not get a notification of that something might be going on.

An easy way for you to verify this is actually to try hack yourself. By this I mean, try to login to you account but with an invalid password. See what happens. Is your account locked out? Does the OWA disappear for you, indicating your IP address has been locked down by some security countermeasure?
Are you as a customer and user notified and alerted in any way of the attempt? This is of course also a simple test you can do against you own companys webmail if you want to, although the server team won’t like it when you point out the problem.

Keep in mind that it would take quite some time to do each logon manually but hackers don’t do this manually. They use special software for this that is freely available for download and they can render thousands and thousands logon attempts in  few minutes.

From the Cloud Service provider point of view, this has been a big problem for years. Brute force prevention and dictionary attack prevention on especially the Windows server platform has always come with lots of manual labor and high costs so it’s usually not even dealt with.

From the user point of view, there’s not that much you can do about it reslly more than verify what happens if you try and then ask your service provider for a solution if you’re not happy with the result after hacking yourself.

If you’re running Virtual Private Servers (VPS) with Windows you should consider this also but as a Cloud Service provider should.

As an important piece of the puzzle of the security systems that need to be in place, and as a natural part of the server baseline security configuration, have a look at Syspeace , an easy to use, easy to deploy and configure brute force prevention software that automatically blocks the intruders IP address,tracks it and reports it to the system administrator. Without causing the legitimate users account to be locked out and with no manual intervention at all.

Syspeace works by monitoring the servers eventlogs and is triggered by unsuccesful login attempts as alerted by a process called Windows Authentication.

With this method, there is out of the box protection for Citrix, Microsoft Terminal Server, Sharepoint, Exchange Server and more. There is also a Global Blacklist, offering preemptive protection from well known hackers around the world.

If you’re a Cloud Service provider or if you running or hosting any Windows servers you want protected, download a free trial from Syspeace trial download and see for yourself how easily you can get rid of a big problem and, at a low cost.


Posted with WordPress for Android.
Juha Jurvanen
Senior IT consultant in backup, server operations, security and cloud. Syspeace reseller in Sweden.

JufCorp

Preventing and blocking brute force and dictionary attacks in a Windows Server environment with Syspeace

Syspeace is an automated brute force prevention / dictionary attack software that protects Microsoft Windows Servers by monitoring the Windows Authentication mechanisms for unsuccessful logins.

 

This means that you get immediate protection for Microsoft Terminal Server, Citrix, Exchange OWA Webmail , SharePoint, CRM, Terminal Server RDWeb and more, for instance there is also built in protection for Exchange connectors.

Each attack is automatically blocked, tracked and reported and as a system administrator you set up your own rules on when to block and for how long.

Syspeace is easy to install and you’re up & running and protected within minutes of the download. No need for changing your infrastructure, buy costly new appliances or hire specialized consultants.

The Global Blacklist that is shared among all Syspeace installation around the world gives you preemptive protectionfrom well known hackers and ddos attackers, blocking them even before an attack can be initiated.

Syspeace also contain reporting capabilities, giving you the ability to check for failed and successful logins for your servers and separated mail notifcations based on events.

The Syspeace licensing model is very flexible and and targeted to be easily affordable for any company, whether you’re n the SMB segment, a large enterprise or even a large Cloud Service Provider or an outsourcing company.

One of the goals for Syspeace is to become a natural part of every servers installed security mechanisms as part of the baseline security and an important piece of that security work is

Windows 2003 version of Syspeace is underway to also provide brute force and dictiionary atacks prevention for older servers

Try for yourself and see how easy it is

/

Other IT Security aspects

If you’re interested in various aspects of server security questions you might want to check out  http://syspeace.wordpress.com and this blog where there’s quite a few articles on why and how Syspeace can help you with your everyday battle of brute force and dictionary attacks but also a few other guidelines for IT security.

Protecting your customers from brute force attacks in Cloud services or in an outsourcing company

 About brute force protection and Cloud Security and VPS (Virtual Private Servers) and outsourcing or hosted environments

Thoughts on cloud security by Juha Jurvanen @ JufCorp

If you are a Cloud Service provider or an outsourcing company and giving your customers access to various Windows services such as file access, Exchange, Exchange OWA,  Sharepoint, Citrix, RemoteApp and Terminal Server services or even VPS (Virtual Private Servers) , there are things you may want to consider.

Cloud security is often debated and it should be. There are pros and cons to each technical solution. Your customers rely on you to have your services reachable, virtually 24/7 and initially, they’ll be happy when that works.

Nowadays though , Cloud Computing has grown to be more accepted and with it a few questions are coming to life.

Your customers will eventually start asking you how you actually deal with various brute force attacks and dictionary attacks to protect their data. You will also , sooner or later, be faced with questions of reporting of these attacks and to be able to gather various reports of when and from where a specific user was logged in,

Remember that you customers have moved from an inhouse hosted environment where they had the ability to gather this intel themselves and they will be expecting to be able to get it from you. They also had the ability to use Syspeace to protect them but once they’ve shifted to your services, they have absolutely no idea of what security mechanisms you have in place for them and these questions will start to come around.

Historically, it’s been very difficult to handle these situations (feel free to read earlier post on this blog to see what I’m getting at for instance  http://syspeace.wordpress.com/2012/10/21/securing-your-webmailowa-on-microsoft-exchange-and-a-few-other-tips/ and http://syspeace.wordpress.com/2012/10/16/various-brute-force-prevention-methods-for-windows-servers-pros-and-cons/ ) so many sysadmins have just more or less given up but when we’re moving to Cloud Services and Cloud Computing, people will expect that also these matters should be sorted. The issue is “why should we move our data to something we can’t even control or know how the security is set up or verify it easily ? ”

Sooner or later, the end users and customers will start testing how your response really is and verify if there are any mechanisms in place (sometimes out of curiosity and sometimes due to internal processes and audits).

Is their attacked account locked out ? For how long ? Is the attacking IP locked out ? Can you as a Cloud Service provider contact the user and let them know that someone tried to user their account from an IP address in China , although you know the customer has no business in China? Do you alert you customers about it ?

No, probably not and it’s easy to understand why.

Because all of this has required  a lot manual work so most service providers and outsourcing companies just don’t want to deal with the problem and tend to not talk about the actual problem, being basically, they have no idea on important stuff such as from where a login attempt was made, what username was used and how was it handled? Was it successful or a failed attempt and how many times did the attacker actually try ?

If you are a Cloud Computing Service provider I highly suggest you have a look at Syspeace to enable you to add this service for your customers and protect access to your Cloud services preemptively and actually have these things handled automatically, without increasing your workload but still tightening your security and to a very low cost.

If you’re a VPS provider, consider for instance having the Syspeace software pre installed in your images and let your customers know it’s there so they themselves can decide whether to use it or not. It’s not an extra cost for you but it does show your customers that you’re actually thinking about their security and that you’re thinking ahead.

So far, Syspeace has actually saved 4.3 M US$ in only a few months in costs for the manual workload associated with brute force attacks and dictionary attacks.

I believe that the service providers that start thinking about these things and take them seriously will have an advantage to those who don’t and quite a few will take having a system such as Syspeace in place for granted, as you would with antivirus.

Have a look at the Syspeace website and see for yourself how quickly and easily you can implement a brute force prevention system without the usual costs of appliances or costly consultants.

Downloaded Syspeace trial vs registered accounts

We had a look at the statistics for downloaded Syspeace trials and started thinking.

We have quite a lot of people downloading it every day but strangely enough, quite a few of them never register an account.

Basically, they’ve taken the time to download, probably started installing and when they’ve come to registering the account with a valid mail address to get the trial running with the licensenumber they’ve changed their mind? Even though there’a 30 day free period and everything.

It’s not a big thing of course, just
puzzled of why go through the hassle of download, start installing and then quit. When there’s no cost in trying it and getting brute force protection for free, even just for month? Weird.

Cheers Juha Jurvanen @ JufCorp


Posted with WordPress for Android.
Juha Jurvanen
Senior IT consultant in backup, server operations, security and cloud
http://www.jufcorp.com