Computer Networks Security System A Multilevel Approach

In many ways, we used to worry much less about our details being utilized improperly. Decades ago while most information was transferred and then saved resting on paper, there was less threat of it becoming misused or tampered with only because fewer people had access to it. Nowadays, when everything is accomplished and stored on computers there is a chance for hackers to access details stored on the computer without, as years ago, having to go anywhere a hardcopy exists.

Protecting computer networks

Protecting computer networks from this kind of attacks is most important as a lot of damage can be happened to persons as well as businesses and corporations when a reliable computer networks protection method is not in place. Technology for supplying this protection continues to upgrade, but unfortunately, so do the techniques of retrieving confidential or individual information by malicious tools and hackers.

Each computer network has established provisions made inside the infrastructure as well as policies in location to safeguard the network and resources that are accessible by it from becoming accessed by unauthorized folks or programs. This is done in many diverse ways to counteract the various threats posed to personal computer networks security systems.

Network protection could be the term usually utilized to refer to actions taken to protect a network from invasion by means of hackers or other intruders. It's usually done at the boundaries of a company, simply to prevent violence from the outside. Details security may be the term employed when it comes to protecting from malware blasts or even harmful blunders within the organization and is generally accomplished by compartmentalizing the larger network association with inner boundaries.

Step one in computer security network is to identify and confirm the user. This is achieved most often with a one aspect authentication of delivering a username and password. Other layers can supply considerably more protection such as making use of a security token, similar to an ATM card or mobile phone. With three-factor authentication section of yourself is also employed such as your fingerprint or an eye scan.

While the user is legal, the firewall is used to maintain users from accessing services which can be off limits. On top of this, it's important to have anti-virus or imposition prevention software (IPS) to guard against malware including worms, Trojan horses, viruses, spyware, adware, etc.

Simply because there are numerous ways a pc network may be attacked it is necessary to have several layers of safety in place to keep info shared and employed within the network safe. Also, simply because malware is regularly being improved and changed, it's important to regularly update any safety software you have in place.

Personal computer networks security system has to constantly monitor and measure the performance of the personal computer networks connections security to be certain that it is updated and that no holes appear within the system which can be taken advantage of by hackers, who will gladly slide right through as well as snatch whatever information they can to cause havoc on folks and companies.

Maximum Transmission Unit

The Maximum Transmission Unit which is the largest possible packet size in bytes that can be sent or received over the network connection in a single physical frame.

This is one of the more popular parameters to change in the TCP/IP stack. A condition called fragmentation will occur if a frame is received that has an MTU smaller than the frame length. Because fragments need to be reassembled it can reduce the overall performance of the connection. When two hosts negotiate a connection the MTU size is determined by using the smallest of the two during the negotiation process. Problem is that if this number is still higher than one of the routers between the connection fragmentation will occur such that the router can handle the packet. In theory, if the MTU size can be adjusted optimally for the MTU size of the ISP router you can cut down fragmentation at one point where your data much always pass therefore cutting down on overall connection time as well. The default MTU is set to 1500 bytes in windows because that is the default size for a LAN (local area network) because generally, they are running much faster wire speeds than WAN (wide area network) like 1000Gbps,100Mbps and 10Mbps. Internet connections generally aren't nearly this speed and therefore will use a smaller MTU size on the WAN connections.

Common recommendations for dial-up MTU size is 576 bytes, a setting between 1400 to 1480 is recommended for DSL users running PPPoE and 1500 for all others.

Because changing the MTU size requires adding multiple keys and DWORD values I will offer only manual instructions for changing the MTU values to optimize PPPoE connections on Windows XP and 2000.

NOTE: 

If you're not an experienced user it is never a good idea to manually edit your registry. Always perform a backup prior to any edit.

In Windows XP and Windows 2000 go to the start menu and click on run and type in "regedit" at the prompt, then press ok.

NDIS

In the registry editor click on the + next to HKEY_LOCAL_MACHINE to expand.

HKEY

Then click the + next to SYSTEM and then click the + next to CurrentControlSet to expand these.

Control

Then click the + next to Services to expand a long list, you will be looking for NDIS, when you find it click the + next to it.

NDIS

Now click on the word Parameters and you will see a list of settings appear to the right.

Protocols

Click Edit from the top menu, click New from the drop-down menu, and click Key from the side menu. Type in 0 and press enter.

0

Click Edit from the top menu, click New from the drop-down menu, and click DWORD value from the side menu. A new setting will appear at the bottom of the list on the right with the name "New Value #1" in the field, change this value to "ProtocolType".

Protocol Type

Now, double-click on the Parameter ProtocolType and it will pop up an edit window, change the value to 800 and press ok.

800

Click Edit from the top menu, click New from the drop-down menu, and click DWORD value from the side menu. A new setting will appear at the bottom of the list on the right with the name "New Value #1" in the field, change this value to "PPProtocolType".

PPP Protocol Type

Now, double-click on the Parameter PPProtocolType and it will pop up an edit window, change the value to 21 and press ok.

21

Click Edit from the top menu, click New from the drop-down menu, and click DWORD value from the side menu. A new setting will appear at the bottom of the list on the right with the name "New Value #1" in the field, change this value to "ProtocolMTU".

Protocol MTU

Now, double-click on the Parameter ProtocolMTU and it will pop up an edit window, change the value to the decimal value you wish to change the parameter to (In this example we used 1450) and press ok.

1450

You should benchmark your speed before changing the setting and then benchmark the speed again trying different settings. If you have any problems or it just doesn't benefit you the new keys and DWORD values that you added can simply be deleted.

Speed up your Internet with TCP/IP "tweaking", fact or fiction?

With tons of advertisements out there promising better Internet connection performance by "tweaking TCP/IP" its hard to know what is real and what isn't. In this article, I will briefly discuss some methods of changing the core settings in the TCP/IP protocol stack and what if any benefit that you will get from doing so.

First off TCP/IP means anything and everything related to the two protocols (TCP Transmission Control Protocol) and IP (Internet Protocol). Per RFC 1180 (A TCP/IP Tutorial) "It can include other protocols, applications, and even the network medium. A sample of these protocols are: UDP, ARP, and ICMP.  A sample of these applications are: TELNET, FTP, and rcp.  A more accurate term is "internet technology".  A network that uses internet technology is called an "internet"." So this is the protocol stack that makes communications over the Internet possible. That being said it would make sense that being able to "tweak" such a stack for your specific connection and the newer technologies would speed up your connection right?

Let's take a look at some of the common parameters of the TCP/IP stack that some claim can make a difference:

Receive Window Size: The receive window size is the amount of data in kilobits that is received before an acknowledgment (ACK) must be sent back to the other side of the TCP connection to verify that the data was sent successfully. If the sender doesn't receive an acknowledgment in the designated interval the data must be retransmitted. This is one of the reasons that TCP is considered a connection based reliable protocol.

The default receive window size in Windows 9X and Windows NT is 8K and the default in ME, 2000 and XP is 16K. If you have a broadband connection you could change this setting somewhere between 32K to 64K and clock your results. It could increase the speed of your broadband connection slightly when a lot of data is being transferred because it wouldn't have to send so many acknowledgments. The problem that you might run across in doing so is that if an ACK doesn't get received by the sender for some reason you have that much more data that will need to be retransmitted. Therefore if you're connection experiences a lot of latency already chances are this will cause you more problems than it will help due to the amount of transmission errors and data retransmission that is already chewing up your current bandwidth. In some cases, you can level this problem out by enabling Selective Acknowledgements or SACK. With SACK enabled the receiver can confirm the reception of certain specific non-contiguous packets in a data stream and force the sender to only resend the dropped packets instead of the entire stream of data since the last good ACK was received. What does this mean to you? Well if you're running a dialup connection forget it, 16K would be the max receive window size you would want to do to and chances are you already have such network latency and so many retransmission errors that it would likely slow you down even more. Some people running satellite fed Internet connections with high latency transmissions due to small upload bandwidth most likely won't benefit either. If you do have a high bandwidth, low latency DSL or Cable connection you might try to adjust the settings listed above to see if you get any difference but I wouldn't expect your speed to increase significantly if any.

• NOTE: If you're not an experienced user it is never a good idea to manually edit your registry. Always perform a backup prior to any edit.

• In Windows XP and Windows 2000 go to the start menu and click on run and type in "regedit" at the prompt, then press ok.

• In the registry editor click on the + next to HKEY_LOCAL_MACHINE to expand.

• Then click the + next to SYSTEM and then click the + next to CurrentControlSet to expand these.

• Then click the + next to Services to expand a long list, you will be looking for Tcpip, when you find it click the + next to it.

• Now click on the word Parameters and you will see a list of settings appear to the right.

• With the word Parameters still highlight click Edit from the top menu, click New from the drop down menu, and click DWORD value from the side menu. A new setting will appear at the bottom of the list on the right with the name "New Value #1" in the field, change this value to "GlobalMaxTcpWindowSize".

• Now, double-click on the Parameter GlobalMaxTcpWindowSize and it will pop up an edit window, change the value to 00007FFF for 32K or 0000FFFF for 64K and press ok. If you changed it to 64K you should see the Parameter below after clicking ok.

• You should benchmark your speed before changing the setting and then benchmark the speed again trying each of these settings. If you have any problems or it just doesn't benefit you this new DWORD value that you added can simply be deleted.

Configuring Windows Server 2003 for a Small Business Network, Part 3

Step 9:

Next, you will see a screen that looks like Figure 1-7. We want to configure the network settings here, so choose the Custom Settings radio button and click "Next."

Step 10:

When you see the screen in Figure 1-8, click on the line for "Internet Protocol(TCP/IP) to highlight it, and click the "Properties" button.

A window like a Figure 1-9 should pop up after you click "Properties." A full treatise of the TCP/IP protocol suite is beyond the scope of this document, but I will hit the highlights here. A basic "IP Address" consists of 4 numbers, each no more than 254, separated by periods. 192.168.1.200 for example. What you really need to know about IP addresses here is this: There are "public" IP addresses and "private" IP addresses. "Public" IP's are used on the Internet, and "private" IP's are used in private networks. It is the job of a firewall to translate your private addresses into public addresses for communication on the Internet. You want to use a "private" IP address range now to avoid headaches later. The private ranges that you should use in your own network are 10.X.X.X, 172.16-31.X.X, and 192.168.X.X (the X's here mean you can use 1-254). In this example, I have used 172.31.0.5 with a mask of 255.255.255.0 and a gateway of 172.31.0.1. Use settings that are specific to your existing network if you already have one. If you have no preexisting network, these settings will be fine. If you have an Internet connection, you can put in the DNS addresses that your Internet Service Provider gave you or put in 127.0.0.1. 127.0.0.1 is a special address that refers to the local computer. So with this setting, the server will ask itself for DNS information. We will be setting up a DNS server on this server for use with Active Directory. Click "Ok" when you are finished putting in the TCP/IP settings. Then click "Next" to continue.

Step 11:

The next screen you should see is shown here in Figure 1-10. You can just leave this at the default workgroup of "Workgroup." After clicking "Next" the installation will continue on its own and reboot. Bringing you to Figure 1-11.

Step 12:

Now you are ready to log in to your server for the first time. The login screen is shown in Figure 1-11 Log in as "Administrator" and use the password you chose in Step 7.

Step 13:

When you log in, you will probably see a window pop up about "Windows Server Post-Setup Security Updates." Don't worry about it right now. We want to update our server, but we need to configure a few more things first. What we need to do now is click on the "Start" menu, then right-click on "My Computer" and choose "Manage" from the context window that comes up. That should bring you to the "Computer Management" window shown in 

Expand the "Storage" tree in the left pane of the window, if it isn't expanded already, by clicking the "plus" sign next to it. Click on "Disk Management" marked by the numeral one in Figure 1-12. The right-hand pane should display your disks in the top and the partition information below. Right-click on the unformatted D: drive in the bottom-right pane and choose "Format" as illustrated by the numeral two in Figure 1-12.

A dialog window will pop up to allow you to format the D: drive. Name the Volume something descriptive like Data or whatever you want. Choose "Perform a quick format" and hit OK. Say OK to the warning here about erasing all Data on D:. After formatting, it will say Data (D:), the size of your partition underneath that, and "NTFS Healthy". Now close that management window

Step 14:

Please note: You may skip Step 14 if you were able to create a 15GB C: drive in Step 2. If you have a 6GB C: drive, then continue with Step 14.

Now we need to change the paging file arrangement on the server. The paging file is a file on the disk that acts like extra RAM for the system. When the server runs a program, that program takes up some system RAM for it to use. When that program is not doing anything, the server can "swap" the real RAM the program is using for virtual ram in the page file. This clears up real RAM for other programs that need to run. When a server doesn't have enough RAM, the server will have a problem called "excessive swapping" where the server spends most of its time reading from and writing to the paging file. We want to move the paging file to the D: drive so drive C: isn't so cramped.

Now click on the "Start" menu, then right-click on "My Computer" and choose "Properties." A window will pop up called "System Properties." Click on the "Advanced" tab shown in Figure 1-13.

From the Advanced tab, click on the "Settings" button in the "Performance" box. A new window will appear labeled "Performance Options." From here, click on the "Advanced" tab, and then choose "Change" from the "Virtual Memory" box shown in Figure 1-14.

The next window will be labeled "Virtual Memory." Our goal here is to move the paging file from the C: drive to the D: drive. To do this, we need to click on the C: drive in the upper portion of the window, click the "No paging file" radio button, and click "Set." A warning will likely pop up about not having a paging file. Just click "Ok" on that warning. Now click on D:, choose "Custom Size". Enter in a range for your paging file. The normal guidelines are your memory times 1.5 up to your memory times 3. Now click "Set." Now your paging file resides on the D: drive and you have freed up space on drive C: Your window should look similar to Figure 1-15 except the sizes will probably differ. Now you can click OK to close all 3 windows and reboot the server.

Now you have a stand-alone server ready to be made into a Domain Controller or whatever you want. Part 2 of this series will focus on configuring Active Directory and setting up network services on your newly installed server.

Configuring Windows Server 2003 for a Small Business Network, Part 2

Configuring Windows Server 2003 for a Small Business Network, Part 2

2003 for a Small Business Network" series. If you've conquered Part 1, then you should have an essentially useless, but ready-to-be-configured, Windows Server 2003 installation. Now it's time to teach it some tricks! Part 2 will help you get Active Directory installed and configured. Along with that, we'll set up DNS, DHCP, and WINS to help everything in the network get on the same page, so to speak.

By the end of this article series, we'll have a network like a Figure 1-1.


When we finish Part 2, our server will be ready to have workstations join the domain and start sharing files. Now here we go!

Step 1:

Click the "Start" button, and choose "Manage Your Server" shown in Figure 1-2.

You will probably see a "Windows Security Alert" pop-up similar to Figure 1-3. Windows firewall keeps track of programs trying to open network connections. The "Configure Your Server Wizard" should be safe to allow, so click "Unblock."

Step 2:

Now you are presented with the "Manage Your Server" window. Using this handy program, you can configure your server to do many different things. The first of which will be setting up Active Directory. From this screen, shown in Figure 1-4, click "Add or remove a role" so we can add the Domain Controller role.

Windows Server 2003 improved on the security of its predecessors by not enabling any services out of the box. If you only enable services you need, you don't have any potential "backdoors" into your system unknown to you. "Adding roles" to a Windows Server 2003 essentially just enables services for network clients.

Step 3:

Next, the "Configure Your Server Wizard" presents two options: "Typical configuration for a first server" or "Custom Configuration." Since this is our first server, we will choose the first option, as shown in Figure 1-5.

Now we choose a domain name for our Active Directory tree. A little planning here will definitely pay off later. If you have a domain name for your company now, that's great. You have the option of using your own domain name here. The directions on the screen recommend keeping your domain separately, but I have never had a problem keeping them separate. I will tell you how to do that in later articles when it becomes necessary. Ok, if you don't want to use your own domain name here, you can choose whatever name you want and put .local on the end of it. I recommend keeping it lowercase and less than 15 characters (not including the .local part). I've used testdomain.local in Figure 1-6. If you have any questions about this step, ask in the forums. So enter your domain name and click "Next".

Now you are presented with the NetBIOS domain name selection(Figure 1-7). The NetBIOS domain name is used primarily for compatibility with older operating systems, but it is still integral to the function of Active Directory. If you took my advice in Step 4 about keeping your domain name 15 characters or less, than you should just take the default suggestion here. The example NetBIOS domain name here will be TESTDOMAIN. Click "Next" to continue.

After configuring the NetBIOS domain name, you will come to the "Summary of Selections" window. This window lists the actions that the wizard will perform. It will automatically install a DHCP server and configure a basic scope. I highly recommend using the Win2k3 server for DHCP address assignment on your network. Keep in mind that you only want one DHCP server in most cases. If you have a broadband router or another server doing DHCP, then make sure to disable it. Click "Next" to continue.


The server will now set up DHCP, DNS, and Active Directory automatically. You will see a popup box like Figure 1-8 informing you that the server will reboot after performing the installations. Just press the "Ok" button. If you don't have your Windows Server 2003 disk inserted in your CD-ROM drive, you will get prompted to insert it, so make sure you still have it handy. Next, the server will go through several screens that don't require you to do anything. Just wait till the server finishes and reboots itself. This takes a while, so go get a sandwich or something.

Configuring Windows Server 2003 for a Small Business Network, Part 1

Configuring Windows Server 2003 for a Small Business Network, Part 1

Many small businesses want to take advantage of the benefits of file sharing for their employees, but they don't have the on-staff expertise necessary to get a server off the ground properly. While a server and server, the software may be in the budget, paying a consultant several thousand dollars to set up and configure the server may not be. This article is the first in a series of articles aimed at a somewhat computer savvy user who wants to set up a network based on Windows Server 2003. The process doesn't have to be a nightmare, and this article will serve as a step by step HowTo for setting up a Windows Server 2003. A major goal of this series is to set up a network that can grow easily. Following this document, your network can expand and grow as your business does.

I will assume here that you have your server hardware in place, hooked up, and ready to go. There are many brands of servers out there and some may require configuration of their hard disk drives. Configuring the disk array is outside the scope of this document, but go ahead and post your questions on the forums. We'll help you as much as possible. For this article, I will assume that you either have one large disk drive or disk array which we will "partition" into two separate drives.

Step 1:

Find your installation CD(s), power on the server, and insert the installation CD. If your server doesn't boot up from the CD, you may have to press a certain key to enter a boot menu or to enter your BIOS to tell the server to boot from CD. The server should come to a black screen with "Press any Key to boot from CD... at the top. Go ahead and press a key. The screen should turn blue and things will flash along the bottom. The only thing of interest here is that if you have a special disk controller that Windows doesn't have built-in drivers for, then you will need to have a disk for it. Just press F6 when you see the server prompt for it along the bottom of the screen. You will come to a screen that says press "ENTER" to set up Windows now. Go ahead and do that. On the next screen, you will need to press F8 provided that you agree to the license there. Of course, if you don't agree, you don't install Windows. So it is a no-brainer... Next, you will come to the partitioning screen.

Step 2:

Select the Unpartitioned space, and press "C" to create our system partition. Next, enter the size of the partition in MB. I recommend using at least 6000 MB for the system drive. If you have lots of room to spare, say 70GB or more, then make your system partition about 15GB. Then select the unpartitioned space again, and create another drive. This time you can use the remaining available space. In my case, I only have 2GB to assign to it, but you will probably have much more. It doesn't matter. This will be your D: drive. Now your screen should look like Figure 1-1.



Partitioning

Step 3:

Now select the C: drive line like in Figure 1-1 and press "ENTER." You will come to a screen that looks like Figure 1-2. I recommend using NTFS over FAT every time in a server environment. The reasons are too numerous to mention. Select the "Quick format" option in Figure 1-2.

Step 4:

Now the server will copy files for a while and then reboot into a more graphical environment. You will come to a welcome screen that you can just click "Next" to go on through. The next screen allows you to choose language settings other than English, so unless you want your server to use a different language, then choose "Next."

Step 5:

The next screen allows you to "Personalize Your Server" so just choose an arbitrary name. I recommend refraining from funny or questionable names. Normally, I would enter the company name twice. In this example, I've used "Admin" and "Example Company." See Figure 1-3.

Step 6:

Enter your Product Key in the next window which looks like Figure 1-4. The product key should be on your CD case somewhere or on a certificate depending on how you acquired your copy of Windows Server 2003.

Methods of securing BGP:

Based on Version 4 and Cisco systems IOS:

Border Gateway Protocol is generally used when routing a very large interior network, binding multiple interior networks together or for interdomain routing across the Internet because of its robustness and scalability. Because of the size and importance of the networks generally interconnected with BGP securing the protocol from attacks is always a good idea. There are many ways of securing BGP on many different platforms. Because of the popularity of Cisco routers on the Internet I will be using their command line for any configuration examples.

Port filtering: 

Since BGP peers communicate over TCP port 179 its always a good idea to filter communications over this port to your trusted peer addresses only over the interfaces they will be communicating across. The filtering can be done on a firewall or perimeter router.
Authenticating peers: One of the most basic forms of security with BGP is peer authentication. You can simply configure an MD5 key in your neighbor statement causing each segment sent on the TCP connection between the two peers to be verified.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123

Hard code the BGP version: 

The most common version of BGP running today is BGP version 4, however by default BGP will negotiate BGP version with their peer. If you are already sure that the router(s) you will be peering with will be running BGP version 4 it's easy to set this option with a neighbor statement and it can save some network recovery time if your router did fall under attack.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123
        neighbor 132.45.78.3 version 4

   

Route filtering: 

With the size of Internet routing tables it's particularly important to make use of route filtering on BGP speaking routers. Incoming routes on external BGP speaking routers are the most important but it can also be important to filter incoming routes on your internal BGP networks as well as outgoing routes on both. This can control the spread of any routing anomalies from one network to another. With BGP you can make use of both the distribute-list or prefix-list in your neighbor statement but not both for the same peer. You can also make use of both access control lists or prefix lists although the better alternative as far as CPU usage goes would be the prefix list. In this example we will create a prefix-list that will only accept routes with a prefix greater than /8 and less than /16 and then apply this to our neighbor as an inbound distribute-list.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123
        neighbor 132.45.78.3 version 4
        neighbor 132.45.78.3 distribute-list netpolicefilter in
        !
        !
        ip prefix-list netpolicefilter seq 10 permit 0.0.0.0/0 ge 8 le 16

Null0 (pit bucket) routes: 

Previously we showed an example of route filtering using neighbor statements and prefix lists but sometimes the same thing can be accomplished with a less CPU intensive process. Null0 routes will drop any traffic matching the route and not having a longer (more specific) match in the routing table into the pit bucket immediately. This process is called "Black Hole Filtering". The example below would ensure that any traffic destined for network 131.50.24.0/24 was sent directly to the pit bucket unless a longer match is found in the routing table.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123
        neighbor 132.45.78.3 version 4
        neighbor 132.45.78.3 distribute-list netpolicefilter in
        !
        !
        ip prefix-list netpolicefilter seq 10 permit 0.0.0.0/0 ge 8 le 16
        !
        !
        ip route 131.50.24.0 255.255.255.0 null 0

Logging neighbor changes:

Although things like connection, hardware and bandwidth problems can cause frequent up/down conditions with a BGP peer it could also be a sign of a DoS attack on the network. Changes in BGP neighboring router status can be logged with a simple neighbor command if you have logging setup properly in your router. It's always a good idea to timestamp logs and check them frequently.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123
        neighbor 132.45.78.3 version 4
        neighbor 132.45.78.3 distribute-list netpolicefilter in
        neighbor 132.45.78.3 log-neighbor-changes
        !
        !
        ip prefix-list netpolicefilter seq 10 permit 0.0.0.0/0 ge 8 le 16
        !
        !
        ip route 131.50.24.0 255.255.255.0 null 0

Border Gateway Protocol

Border Gateway Protocol is generally used when routing a very large interior network, binding multiple interior networks together or for interdomain routing across the Internet because of its robustness and scalability. Because of the size and importance of the networks generally interconnected with BGP securing the protocol from attacks is always a good idea. There are many ways of securing BGP on many different platforms. Because of the popularity of Cisco routers on the Internet, I will be using their command line for any configuration examples.

Port filtering: 

Since BGP peers communicate over TCP port 179 its always a good idea to filter communications over this port to your trusted peer addresses only over the interfaces they will be communicating across. The filtering can be done on a firewall or perimeter router.
Authenticating peers: One of the most basic forms of security with BGP is peer authentication. You can simply configure an MD5 key in your neighbor statement causing each segment sent on the TCP connection between the two peers to be verified.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123

Hard code the BGP version: 

The most common version of BGP running today is BGP version 4, however by default BGP will negotiate BGP version with their peer. If you are already sure that the router(s) you will be peering with will be running BGP version 4 it's easy to set this option with a neighbor statement and it can save some network recovery time if your router did fall under attack.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123
        neighbor 132.45.78.3 version 4

   

Route filtering: 

With the size of Internet routing tables it is particularly important to make use of route filtering on BGP speaking routers. Incoming routes on external BGP speaking routers are the most important but it can also be important to filter incoming routes on your internal BGP networks as well as outgoing routes on both. This can control the spread of any routing anomalies from one network to another. With BGP you can make use of both the distribute-list or prefix-list in your neighbor statement but not both for the same peer. You can also make use of both access control lists or prefix lists although the better alternative as far as CPU usage goes would be the prefix list. In this example, we will create a prefix-list that will only except routes with a prefix greater than /8 and less than /16 and then apply this to our neighbor as an inbound distribute-list.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123
        neighbor 132.45.78.3 version 4
        neighbor 132.45.78.3 distribute-list netpolicefilter in
        !
        !
        ip prefix-list netpolicefilter seq 10 permit 0.0.0.0/0 ge 8 le 16

Null0 (pit bucket) routes: 

Previously we showed an example of route filtering using neighbor statements and prefix lists but sometimes the same thing can be accomplished with a less CPU intensive process. Null0 routes will drop any traffic matching the route and not having a longer (more specific) match in the routing table into the pit bucket immediately. This process is called "Black Hole Filtering". The example below would ensure that any traffic destined for network 131.50.24.0/24 was sent directly to the pit bucket unless a longer match is found in the routing table.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123
        neighbor 132.45.78.3 version 4
        neighbor 132.45.78.3 distribute-list netpolicefilter in
        !
        !
        ip prefix-list netpolicefilter seq 10 permit 0.0.0.0/0 ge 8 le 16
        !
        !
        ip route 131.50.24.0 255.255.255.0 null 0

Logging neighbor changes: 

Although things like connection, hardware, and bandwidth problems can cause frequent up/down conditions with a BGP peer it could also be a sign of a DoS attack on the network. Changes in BGP neighboring router status can be logged with a simple neighbor command if you have logging setup properly in your router. It's always a good idea to timestamp logs and check them frequently.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123
        neighbor 132.45.78.3 version 4
        neighbor 132.45.78.3 distribute-list netpolicefilter in
        neighbor 132.45.78.3 log-neighbor-changes
        !
        !
        ip prefix-list netpolicefilter seq 10 permit 0.0.0.0/0 ge 8 le 16
        !
        !
        ip route 131.50.24.0 255.255.255.0 null 0

Speed up your Internet with TCP/IP "tweaking", fact or fiction?

With tons of advertisements out there promising better Internet connection performance by "tweaking TCP/IP" it's hard to know what is real and what isn't. In this article, I will briefly discuss some methods of changing the core settings in the TCP/IP protocol stack and what if any benefit that you will get from doing so.

First off TCP/IP means anything and everything related to the two protocols (TCP Transmission Control Protocol) and IP (Internet Protocol). Per RFC 1180 (A TCP/IP Tutorial) "It can include other protocols, applications, and even the network medium.  A sample of these applications is: TELNET, FTP, and rcp.  A more accurate term is "internet technology". So this is the protocol stack that makes communications over the Internet possible. Is that being said it would make sense that being able to "tweak" such a stack for your specific connection and the newer technologies would speed up your connection right?

Let's take a look at some of the common parameters of the TCP/IP stack that some claim can make a difference:


Receive Window Size: The receive window size is the amount of data in kilobits that is received before an acknowledgment (ACK) must be sent back to the other side of the TCP connection to verify that the data was sent successfully. If the sender doesn't receive an acknowledgment in the designated interval the data must be retransmitted. This is one of the reasons that TCP is considered a connection based reliable protocol.

 The default receive window size in Windows 9X and Windows NT is 8K and the default in ME, 2000 and XP is 16K. If you have a broadband connection you could change this setting somewhere between 32K to 64K and clock your results. It could increase the speed of your broadband connection slightly when a lot of data is being transferred because it wouldn't have to send so many acknowledgments. The problem that you might run across in doing so is that if an ACK doesn't get received by the sender for some reason you have that much more data that will need to be retransmitted. Therefore if you're connection experiences a lot of latency already chances are this will cause you more problems than it will help due to the number of transmission errors and data retransmission that is already chewing up your current bandwidth. In some cases, you can level this problem out by enabling Selective Acknowledgements or SACK. With SACK enabled the receiver can confirm reception of certain specific non-contiguous packets in a data stream and force the sender to only resend the dropped packets instead of the entire stream of data since the last good ACK was received.
What does this mean to you? Well if you're running a dialup connection forget it, 16K would be the max receive window size you would want to do to and chances are you already have such network latency and so many retransmission errors that it would likely slow you down even more. Some people running satellite fed Internet connections with high latency transmissions due to small upload bandwidth most likely won't benefit either. If you do have a high bandwidth, low latency DSL or Cable connection you might try to adjust the settings listed above to see if you get any difference but I wouldn't expect your speed to increase significantly if any.


NOTE: If you're not an experienced user it is never a good idea to manually edit your registry. Always perform a backup prior to any edit.

In Windows XP and Windows 2000 go to the start menu and click on run and type in "regedit" at the prompt, then press ok.

regedit


In the registry editor click on the + next to HKEY_LOCAL_MACHINE to expand.

system edit


Then click the + next to SYSTEM and then click the + next to CurrentControlSet to expand these.

CurrentControlSet


Then click the + next to Services to expand a long list, you will be looking for Tcpip, when you find it click the + next to it.

Parameters


Now click on the word Parameters and you will see a list of settings appear to the right.

GlobalMaxTcpWindowSize


With the word Parameters still highlight click Edit from the top menu, click New from the drop-down menu, and click DWORD value from the side menu. A new setting will appear at the bottom of the list on the right with the name "New Value #1" in the field, change this value to "GlobalMaxTcpWindowSize".

Global Max Data


Now, double-click on the Parameter GlobalMaxTcpWindowSize and it will pop up an edit window, change the value to 00007FFF for 32K or 0000FFFF for 64K and press ok. If you changed it to 64K you should see the Parameter below after clicking ok.

Finished Edit


You should benchmark your speed before changing the setting and then benchmark the speed again trying each of these settings. If you have any problems or it just doesn't benefit you this new DWORD value that you added can simply be deleted.

Border Gateway Protocol

Border Gateway Protocol:

Border Gateway Protocol is generally used when routing a very large interior network, binding multiple interior networks together or for interdomain routing across the Internet because of its robustness and scalability. Because of the size and importance of the networks generally interconnected with BGP securing the protocol from attacks is always a good idea. There are many ways of securing BGP on many different platforms. Because of the popularity of Cisco routers on the Internet, I will be using their command line for any configuration examples.

Port filtering: 

Since BGP peers communicate over TCP port 179 its always a good idea to filter communications over this port to your trusted peer addresses only over the interfaces they will be communicating across. The filtering can be done on a firewall or perimeter router.
Authenticating peers: One of the most basic forms of security with BGP is peer authentication. You can simply configure an MD5 key in your neighbor statement causing each segment sent on the TCP connection between the two peers to be verified.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123

Hard code the BGP version: 

The most common version of BGP running today is BGP version 4, however by default BGP will negotiate BGP version with their peer. If you are already sure that the router(s) you will be peering with will be running BGP version 4 it's easy to set this option with a neighbor statement and it can save some network recovery time if your router did fall under attack.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123
        neighbor 132.45.78.3 version 4

   

Route filtering: 

With the size of Internet routing tables it's particularly important to make use of route filtering on BGP speaking routers. Incoming routes on external BGP speaking routers are the most important but it can also be important to filter incoming routes on your internal BGP networks as well as outgoing routes on both. This can control the spread of any routing anomalies from one network to another. With BGP you can make use of both the distribute-list or prefix-list in your neighbor statement but not both for the same peer. You can also make use of both access control lists or prefix lists although the better alternative as far as CPU usage goes would be the prefix list. In this example, we will create a prefix-list that will only accept routes with a prefix greater than /8 and less than /16 and then apply this to our neighbor as an inbound distribute-list.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123
        neighbor 132.45.78.3 version 4
        neighbor 132.45.78.3 distribute-list netpolicefilter in
        !
        !
        ip prefix-list netpolicefilter seq 10 permit 0.0.0.0/0 ge 8 le 16

Null0 (pit bucket) routes: 

Previously we showed an example of route filtering using neighbor statements and prefix lists but sometimes the same thing can be accomplished with a less CPU intensive process. Null0 routes will drop any traffic matching the route and not having a longer (more specific) match in the routing table into the pit bucket immediately. This process is called "Black Hole Filtering". The example below would ensure that any traffic destined for network 131.50.24.0/24 was sent directly to the pit bucket unless a longer match is found in the routing table.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123
        neighbor 132.45.78.3 version 4
        neighbor 132.45.78.3 distribute-list netpolicefilter in
        !
        !
        ip prefix-list netpolicefilter seq 10 permit 0.0.0.0/0 ge 8 le 16
        !
        !
        ip route 131.50.24.0 255.255.255.0 null 0

Logging neighbor changes: 

Although things like connection, hardware, and bandwidth problems can cause frequent up/down conditions with a BGP peer it could also be a sign of a DoS attack on the network. Changes in BGP neighboring router status can be logged with a simple neighbor command if you have logging setup properly in your router. It's always a good idea to timestamp logs and check them frequently.

        Example:
        router bgp 510
        neighbor 132.45.78.3 remote-as 320
        neighbor 132.45.78.3 password SecureMyBGP123
        neighbor 132.45.78.3 version 4
        neighbor 132.45.78.3 distribute-list netpolicefilter in
        neighbor 132.45.78.3 log-neighbor-changes
        !
        !
        ip prefix-list netpolicefilter seq 10 permit 0.0.0.0/0 ge 8 le 16
        !
        !
        ip route 131.50.24.0 255.255.255.0 null 0

What is a VPN?

The term VPN is very popular in the IT world today and it gets thrown around quite often as a method interconnecting data networks. I'm sure some of you have been sitting in a meeting and heard the phrase "we'll just use a VPN" and had no idea what they were talking about. To be quite frank, is a Network and Security Engineer for many years now I've heard the question "What about using a VPN?" way too often by someone that didn't really didn't even know what it was. If you do know about VPNs then this article is probably not for you. However, if you don't know what a VPN is or know very little about them then I think this article can offer you some insight into the world of Virtual Private Networking.

The most common function of a VPN is to connect multiple private networks securely across an unsecured public network like the Internet. A private network, in this case, would be a network in which the traffic is not freely accessible by the public. If we break down the meaning of Virtual Private Network in the instance explained above it would be as follows. The two endpoints of this "network" are private networks that are seamlessly connected across a public network in which neither private network knows about, creating a "Virtual Private Network" between them.

The VPN came about mostly due to companies expanding their businesses geographically. Expansion across the country and even the world made logistics a nightmare for many companies open to the global market. The need for fast, secure and reliable connectivity to maintain their business needs became greater and greater. Prior to VPN technology, internetwork connectivity had to be maintained by expensive leased lines that generally grew in cost when they grew in distance. Many companies resorted to remote access dial configurations to a central location with 800 numbers that could roll over multiple telephone lines. Of course, the cost to maintain the lines and the charge for the 800 number was also expensive. With the popularity of the Internet growing it was only a matter of time before technologies that could leverage a preexisting worldwide network and build secure network connectivity would emerge.

Since most companies already relied on the Internet for email and web access they generally had a readily available connection at most sites they could use for LAN to LAN (Local Area Network) VPN connectivity. Sometimes the bandwidth (speed) of the connection might have to be upgraded in order to carry the extra data but it would still be less expensive than having to add an extra connection for the company data alone, not to mention the extra expense of the dedicated circuit depending on where it would terminate geographically. In some cases where a remote office was too small to have its own dedicated circuit, they might have used dialup internet for these functions but that's ok, you can build Client to LAN VPNs over those dialup connections as well. These scenarios are becoming more popular and replacing a lot of older technologies like frame-relay that used to power large enterprise network WANs (Wide Area Network).

Security is, of course, a concern when private network traffic is using a public network as a transit medium so generally, VPNs are built between networks using an encrypted VPN tunnel. There are many forms of VPNs that could be classified in the layers of the OSI (Open Systems Interconnection Reference Model) but I won't go that in depth here since that is out of the scope of this beginners document.

In this document, I will classify them into two categories: Encrypted and Non-Encrypted VPNs.

Simple VPN

Graphical Example Of A Simple Encrypted VPN

 Encrypted VPN: An encrypted VPN will secure the traffic that is being sent across an unsecured public network by using various types of encryption mechanisms. IPSec is the most popular form of encrypted VPN tunnel in use today when building a secure VPN tunnel over the Internet.

Non-Encrypted VPN: 

A non-encrypted VPN would mean that either the data flowing across the VPN is not secured at all or is being secured by means other than data encryption. MPLS (Multi-Protocol Label Switching) VPNs use route segregation across a virtual connection between the two private networks to secure the routing of the traffic between only them across the public network. A GRE (Generic Routing Encapsulation) tunnel can be used as well in order to hide a global network from the private endpoints and even encapsulate multiple protocols inside of TCP/IP that normally couldn't be routed over an all IP network. This type of tunnel could actually be encrypted by a higher layer protocol like SSL (Secure Socket Layer) as well.

So we've seen that VPNs can save money by reducing circuit costs between remote offices and headquarters but VPNs can also be used by companies that have recently acquired by another company and the two networks now need to be integrated. This is particularly handy for networks that need to merge quickly or that have great geographic boundaries. Both of these types of networks would be considered an Intranet VPN. What if multiple companies form a partnership and need to share certain valuable network resources with one another? An Extranet VPN could be used in this specific type of situation. Another use for a VPN is to support mobile or home users that need to access network resources away from the office.

With the security, reliability, scalability, and ease of management available in many forms of VPNs today its no wonder their popularity continues to grow. One thing is certain, no matter how many different ways there are to set up a VPN the goal of seamless network connectivity regardless of the geographic location and the quicker return ROI (Return on investment) of the software/equipment versus traditional leased lines remain the same. Hopefully, the next time you're in a position where the term VPN is brought up as a viable solution you will have a little better understanding behind the concept of Virtual Private Networking.

DoS Denial of Service and Access attacks.

DoS (Denial of Service) attacks:

The main purpose of a DoS attack is slow down or disable a system such that the services the system offers become unavailable to its users. These type of attacks are generally caused by exhaustion of the system's resources or by exploiting a known vulnerability (bug) on the system that stops it from functioning in a normal manner. A simple example of this would be sending so much garbage traffic to a system that legitimate traffic could not process similarly to phone lines being tied up from too many telephone calls at once. More complex versions of these attacks are known as DDoS or Distributed Denial of Service attacks where multiple devices launch the attack on the system at the same time.

Access attacks: 

The main purpose of an access attack is to gain access to unauthorized (protected) system resources such as data or to simply take over control of an interior network system to perform the illegal activity. An access attack can often follow a Denial of Service attack but generally attacks of this nature with reconnaissance of some type in order to expose system exploits and exploitable systems. Amazingly enough, the most common threat when considering an access attack is Social Engineering. Social Engineering is the most effective and the hardest access attack to control because it involves the manipulation of people. An example of Social Engineering would be a hacker gaining access to a system by learning a valid username and password from someone through the art of deception.

IE:

Claiming to be someone that one would trust, even though in reality they are not.
Some of the methods discussed previously can be used in order forcefully obtain access to unauthorized data and unfortunately, it could be yours. Fortunately, however, most major networks of the more prominent companies that one might do business with are generally secured from most threats that we've talked about by means of physical equipment security, monitoring, data encryption, and constant updating. Obviously, a threat to these type of systems always exists but is much less likely due to the vast amount of money and time spent by these companies in order to protect their networks and their customer's information. This should make you feel somewhat more comfortable but wait a minute, what about your system? Now, we will talk about some things that you can do in order to protect yourself a little better.

1: Perhaps one of the most important things that you should remember is to never give out any of your personal information to someone unless you have gone through means to verify their identity. This includes your email and any usernames and passwords that could lead to the discovery of your other personal information. As we discussed previously Social Engineering is the leading cause of unauthorized access attacks. Phishing, banding or carding is a very popular form of private information theft. This is when you might receive what appears to be a legitimate email or instant message claiming that you need to "update your account information" or something similar and provides a link to a site to input this data in order to steal it. The link is often masked such that it appears to come from this legitimate source and the site it sends you to also looks legitimate because they've matched the source code to the actual site in question. The best thing to do in this instance is called the customer support number that would come on your real statement. Most major organizations will never ask you this information outside of initial signup. Most companies will have a specific email address that you can forward such scams available on their website. This type of attack can also come via a phone call, so in this case, I would suggest that you disconnect the call and contact the customer support department directly with the phone number listed from a statement to inquire about the situation.

2: Be careful what type of information that you send via email. Where you send it is important but what you send is also important. Email by default is sent with clear text. An experienced hacker that might be sniffing or intercepting traffic to a service provider (man-in-the-middle attack) can easily read anything sent across standard email. There are some methods for encrypting email like Entrust http://www.entrust.com/ (digital certificates) and PGP http://www.pgp.com/ (pretty good privacy) that can be used when properly configured but your best bet is to never send any personal information via email.

3: Make sure you are doing business with a company that you know to be secure. Generally, you won't have problems when dealing with major companies like Wal-Mart or Gap but you should still read their privacy and security policies such that you have a good understanding of the information that they collect and what they do with it, as well as the means that they use to secure their transactions. If a site doesn't have this information readily available then I would not recommend doing business with them. Most private web transactions are secured with SSL or Secure Socket Layer encryption. This is the primary standard for encrypting web transactions and it is approved by the Internet Engineering Task Force. You will know that your connection is secured if you look in the address field of your browser and see https:// in front of the web address. Note: The Sin https which signifies that the session is secured with SSL.

4. Use strong passwords. Typically you will want to use at least 8 characters, use a mix of letters and numbers, do not use complete words, do not use sequential numbers, do not use your username and try not to use any personal information that could be guessed by someone like your birthday.

Here is a link to a Microsoft document on generating strong passwords complete with a link to a page to check your password strength: http://www.microsoft.com/athome/security/privacy/password.mspx

Here is a link to a document on generating strong passwords on the SANS site: http://www.sans.org/rr/whitepapers/authentication/1636.php

Its also never a good idea to store passwords or cache them on your local system. If your system is somehow compromised, then so are your account passwords.

5. If you are using a wireless network, secure it. Wireless networks can be easily sniffed out remotely by "war drivers" or even your neighbor. Change any default settings like the SSID that might be easily guessable. Disable remote administrator to the router and password protect local administration. Use MAC address filtering to only allow your trusted connections to the router. Enable the strongest encryption available on your router. Here is an article I wrote previously on securing a wireless network when using one of the more common Linksys wireless G routers. http://www.computernetworkinghelp.com/content/view/31/2/

6. Use a personal firewall to protect your computer from traffic originating from the outside world. IE: Traffic that you didn't initiate a request to come to you.

7. Use virus software and keep it up to date. Remember, if your virus definitions are old the software is all but useless. Scan your email in real-time (upon download or prior to opening attachments). Scan your drive regularly. It's also a good idea to never open attachments from unknown sources. Virus software relies on matching patterns a virus must exist before an updated pattern can be created so there is always a chance of becoming infected even if your software is up to date.

8. Use spyware removal software and keep it up to date. Remember, if your spyware removal definitions are old the software is all but useless. Scan your drive regularly. Spyware can not only be annoying but also dangerous in some cases.

If you follow the simple steps listed above you will be better protected against identity theft and personal fraud. I hope you've enjoyed the article and learned a thing or two along the way.

Hackers - Is your private information safe?

With the growth of the Internet over the past few years and the Internet shopping boom its no wonder that identity theft statistics have risen to new levels as well. Global Internet usage has grown some 182% from 2000-2005 per Nielsen/NetRatings accumulated worldwide. Between January and December of 2005 alone, more than 685,000 consumer fraud and identity theft complaints were reported to the Federal Trade Commission's Sentinel Complaint Database.

Since the database was launched in 1997 almost 3 million complaints have been registered there. In the 2005 statistics, 37% of those 680,000 complaints were said to be identity theft cases. Some of the more significant identity theft complaints included credit card fraud (26%), phone or utilities fraud (18%), bank fraud (17%), employment fraud (12%), government documents/benefits fraud (9%), and loan fraud coming in at (5%).

As you can clearly see the theft of personal information is a major problem and is getting worse every day. If you are doing business over the Internet the odds increase that you could fall prey to an Internet predator and become a victim of these type of malicious acts. There are, however, some things that you can do to protect yourself from these crimes which we will discuss later in this document but for now, we will discuss the term "hacker" and some of the methods used by these "hackers".

What is a hacker?

In the general media, the term "hacker" describes a person that thrives on performing malicious acts with computer systems in order to gain public popularity with his or her peers. This might be someone that gains access to unauthorized computer systems via their extensive knowledge of their operating systems by means of finding exploits (bugs) in the code and using them to their advantage. Perhaps a person intends to disable computer systems by means of DoS (Denial of Service) attacks such that the resources are no longer available to the users making legitimate requests to the systems. We will discuss these types of attacks later on in this document in more detail.

In reality "hackers" are generally considered the good guys and would be someone that spent a vast amount of time learning about and building computer security systems. The term "cracker" would be what you would use to describe a person that would perform the types of malicious activity that we discussed previously. However, in the rest of this document, we will use the more widely known term of "hacker" as an equivalent of the real term "cracker" to avoid confusion.

One of the most famous network hacking attacks in history was the 1994 attack of Tsutomu Shimomura's computer network by the famous hacker Kevin Mitnick on Christmas day. By using various types of Denial of Service and access attacks on the network Kevin Mitnick was able to gain control of Shimomura's system. This was what you would call a "structured attack" because of the expertise required in order to perform the attack. Another type of "structured attack" that some of you might remember is the February 7-11 2000 attacks where web heavyweights like eBay, Amazon, and CNN among others drastically slowed down and even denied access completely for hours at a time by use of Distributed Denial of Service attacks.

The more common types of attacks are the unstructured kind. Often these attacks start from within a network by a person that has no idea what they've ever done. These type of attacks can also be executed by a "Script-Kiddy". A "Script-Kiddy" is a person that uses pre-made hacking scripts coded by a professional hacker and has little to no real knowledge of what they're doing. Some of these hacking tools require no more than the input of the address of the target host and a push of a button. This threat is very real due to the vast amount of hacking tools (scripts) readily available for download on the web like winnuke, SATAN, NMAP, and Naptha. More complex hacking tools like Trinoo, TFN, TFN2K and Stracheldraht (used in the Feb 2K attacks) can also be found fairly easily but require more in-depth knowledge in order to use effectively.  In order to break these attacks down for simplicity, we can put them in two main categories.

What is the Role of a Data Recovery Company in Salvaging Your Relationship with Your Customers?

In this age, the information age, data is the driving force of many businesses, especially internet-based businesses.  Data is frail as it is subject to lose due to computer viruses,  mechanical failure, back-up failure, physical damage to media storage devices, hard drive crashes, natural disasters, and human error. When these unintended and often unpreventable disasters happen, data is lost and service to your customers is compromised.  Thus, the role of a data recovery company is to salvage your data and to protect your customer relationships from being damaged as a result of lost or damaged data.

Flawed thinking amongst many business owners is that the services of a data recovery company will not be needed if a systematic back-up process is used. Some companies leave it up to individual
computer users to back-up their data on a regular basis.  Some back-up their servers periodically throughout the day, and some use automated back-up services.

While backing up data regularly diminishes the possibility that a data recovery company will be required, dependably think about the reality that even the best back-up frameworks bomb occasionally. Also, if back-ups are kept onsite, rather than offsite, the original data source and the back-ups are subject to lose in case of fires or natural disasters. While numerous entrepreneurs and PC clients know this, it doesn't generally appear to be handy to back-up information frameworks and to store the back-ups offsite.  Indisputably, storing back-ups offsite is a good idea; however, in practice, it rarely happens. More often, companies that experience crashes of data systems end up wishing they had an up-to-date back-up and they end up relying upon a data recovery company to salvage what they can.

One way to resolve the problem of impractical offsite back-up storage is to employ the services of an automated, off-site back-up a company such as backup.com. Such services generally require a
small monthly fee that is very reasonable considering that they totally eliminate the need for onsite back-up media. They enable you to choose important data files that need to be backed up
regularly and to schedule the occur automatically. Moreover, the back-ups are saved to an off-site server so they are secured in a location separate from the original data source.

The main things to consider when selecting an automated,  offsite are cost,  reliability,   accessibility,   and security. Some automated, offsite back-up services encrypt data prior to it being transmitted via the internet to a data storage center to ensure secure transmission.  passwords that authorize your access to the data which is made available through internet access twenty-four hours a day, every day of the year. Immediate, easy access to the backed up data is essential so that you can restore your data files anytime in the event of a catastrophe.

Using an automated, offsite back-up service does diminish the possibility of lost data, but it does not guaranty that the services of a data recovery company will never be needed.  Even
the best and most professional back-up services fail occasionally. For this reason, it is best for you, as a  business an owner,  to  be  forward-looking  and  proactive  by  finding  and
analyzing data recovery service providers and to identify a  data recovery company that will efficiently and effectively meet  your needs for data recovery if your business is so unfortunate as  to
experience a catastrophic event that results in lost  or  damaged data.

Do not wait for strikes to find a data recovery company. In the wake of a disaster, you will not have the time or the drive to effectively evaluate and choose a data recovery company that you can confidently rely upon.   Choosing an automated, off-site back-up service and a data recovery company should be a priority for you regardless of what phase of business planning you are in.

Copyright Christopher J. Enders. Are you at the end of your rope, fed up and confused by all the scrambled internet marketing the advice you're getting? Whether you are new to internet marketing,
or a website owner  who  wants  to  make  more  money  from  your website, learn the proven strategies that  will  sky-rocket  your

E-mail Privacy Mythology

Many people believe that e-mail privacy is inherent and guaranteed, psychologically equating it with the postal system.  E-mail systems were a crucial tool in creating the Internet, and actually, predate the Internet in existence.  While the ability to access your personal e-mail messages is secured with a password, this is insufficient to guarantee legitimate security. There are additional security considerations when using laptops to access e-mail systems.

As more people find the need to transmit sensitive information through the internet, the need for e-mail privacy becomes more apparent.

The e-mail message is perpetually exposed to unauthorized access as it travels along this unprotected Internet from the composer to the reader. If routers between the source and destination of an e-mail message are compromised, potentially any e-mail message passing through that router could be accessed.

Unencrypted e-mails should be regarded as the postcard, in that anyone who receives it can read it. Intelligence agencies screen unencrypted e-mails with ease and conduct these screens regularly.

Some e-mail you may send and receive could be considered company property. It is unwise to associate personal e-mails of any kind with a company address.

When using laptop notebooks to send and receive e-mail, you may often be using someone else’s network. You must be aware if using a wireless network if the network is encrypted. If the network is not properly encrypted any e-mail you send or receive is accessible to any skilled person within the wireless signal range. Even when using secure networks, everything you send and receive is going through their system. It is imperative that one uses TLS encryption when sending mail, and to use a send mail server other than the foreign network. When reading e-mail on someone else’s network, you must make sure your mail server supports SSL and use the encrypted access only.

If you delete an e-mail you must not have the misconception that the existence of the e-mail is gone forever. This is not the case as most electronic documents are backed up and recoverable, and most e-mails are backed up on a remote server at some point in time.

For more information about Laptop Security visit Security4Laptops.com.

Security4Laptops.com is your definitive guide to using mobile devices with the privacy and security necessary in this modern work-a-day on-the-go world.

Article Source: http://EzineArticles.com/?expert=Tom_Pitts