Articles

  • Articles

    Articles - this section includes all my articles' writings starting from 1998 till present, the section includes articles about Open Source, Cyber Security, Business, Technical, Courses and Certifications :)

    I have thousands of text files that include everything I learnt. I usually write down all the stuff that I do, starting from a small tip, specific experience, fast study till my professional work experiences and learnings and I am sharing all that articles here, I hope that stuff be useful to other people instead of just locking them in my desk.

    Your can contribute to this section and your contribution is highly welcomed and appreciated. Just pick a topic, write it in the preferred way, send it and let's share it under your name. Although all my writings in this section are in English but I am going to add Arabic content to enrich the Arabic content on the internet when it comes to Cyber Security, so no specific language for this section, you can write in العربية, English, Frankoarab or/and any MIX of them. simply write in the language you prefer and express your/my writings in the best way.

    All content in this section published under Creative Commons License, the main categories in this section as the following, please click on category link below to list all articles in specific category or use the side/main menu to navigate as well.

  • Business Articles

    This section includes all my articles' writings about business, I have been involved actively in business management, sales management, channel and ecosystem partners' management, business development, managing teams, P&Ls, budgets, targets and many other business topics.

    In this section the focus will be on those topics as it represents great part of my professional experience for the best benefit of everyone.

    Your can contribute to this section and your contribution is highly welcomed and appreciated. Just pick a topic, write it in the preferred way, send it and let's share it under your name. Although all my writings in this section are in English but I am going to add Arabic content to enrich the Arabic content on the internet when it comes to Cyber Security, so no specific language for this section, you can write in العربية, English, Frankoarab or/and any MIX of them. simply write in the language you prefer and express your/my writings in the best way.

    All content in this section published under Creative Commons License, the main categories in this section as the following, please click on category link below to list all articles in specific category or use the side/main menu to navigate as well.

  • Courses - Certificates

    I used to be certified instructor for many technology and topics related to Cyber Security products and solutions, various distributions of Linux and Open Source tools and topics, Microsoft Systems, Novell, UNIX, and others.

    All the courses that I have attended and certificates that I have accomplished fall in both technical and business categories and all of that courses and certificates I used my usual methodology to document, summarize, and write down hands-on labs along with key tips and tricks to pass certifications and ensure success.

    That includes hundreds of writings in many forms like docs, presentations, videos and hands-on examples, that content targeted all stages of work technical and business wise, as I believe that human knowledge belongs to the world I am sharing all the articles related to Information Technology and Information Security here, I hope that stuff be useful to other people.

    Your can contribute to this section and your contribution is highly welcomed and appreciated. Just pick a topic, write it in the preferred way, send it and let's share it under your name. Although all my writings in this section are in English but I am going to add Arabic content to enrich the Arabic content on the internet when it comes to Cyber Security, so no specific language for this section, you can write in العربية, English, Frankoarab or/and any MIX of them. simply write in the language you prefer and express your/my writings in the best way.

    All content in this section published under Creative Commons License, the main categories in this section as the following, please click on category link below to list all articles in specific category or use the side/main menu to navigate as well.

  • Cyber Security Articles

    This section includes all my articles' writings about Cyber Security starting from 1998 till present and where my key expertise technically, and commercially is.

    I have done thousands of engagements technical wise and business wise when it comes to Cyber Security, that involved all stages of work like technical, presales, sales, business development, technology comparisons, deployments, project management and providing support as well, I also have thousands of text files that include everything I learnt. I usually write down all the stuff that I do, starting from a small tip, specific experience, fast study till my professional work experiences and learnings and I am sharing all that articles here, I hope that stuff be useful to other people instead of just locking them in my desk.

    Your can contribute to this section and your contribution is highly welcomed and appreciated. Just pick a topic, write it in the preferred way, send it and let's share it under your name. Although all my writings in this section are in English but I am going to add Arabic content to enrich the Arabic content on the internet when it comes to Cyber Security, so no specific language for this section, you can write in العربية, English, Frankoarab or/and any MIX of them. simply write in the language you prefer and express your/my writings in the best way.

    All content in this section published under Creative Commons License, the main categories in this section as the following, please click on category link below to list all articles in specific category or use the side/main menu to navigate as well.

  • How-To: Installing eDirectory and iManager on SUSE Linux

     A step by step how to to install eDirectory and Management Tools -- iManager (Web Management) and ConsoleOne (Java) on SUSE Linux.

    1- vi /etc/sysconfig/network/routes and add multicast for SLP:
        224.0.0.0 0.0.0.0 240.0.0.0 eth0
        #rcnetwork restart

    2- It's recommended but not required to configure OpenSLP and NTPD before eDirectory
        - eDirectory uses SLP to locate services and other eDirectory services.
        - eDirectory installation will fail if server not synced with other eDirectory Servers

    3- install eDirectory
        - Ensure gettext, perl-gettext and findutils-locate packages are installed
        - Insert eDircetory 8.7.3 CD
             #cd /media/cdrom/Linux/setup
             #./nds-install - Enter - Accept License Ag.
             Enter 1,2 for components to install
             Enter license file when prompt for .nfk license file
             Update Environment Variables:
                  PATH=/usr/ldaptools/bin:$PATH
                  MANPATH=/usr/ldaptools/man:/usr/man:$MANPATH
        - Install server1 in New Tree
             #ndsconfig new -t DA-TREE -n OU=SLC.O=DA -a CN=admin.OU=SLC.O=DA
               or if add in existing tree
             #ndsconfig add -t DA_TREE -n OU=SLC.O=DA -a CN=admin.OU=SLC.O=DA
             - set the prompted password for (testpassword)
        - Eject and umount the cdrom
        - Test SLP using #slptool findsrvs service:directory-agent

    4- Install ConsoleOne
        - From eDirectory 8.7.3 CD
               #cd /media/cdrom/Linux/ConsoleOne/
               #./c1-install
               Enter 1 to choose English Language
               Enter 8 to install all available snap-ins
                y to install Java Run Time
        - Run ConsoleOne: /usr/ConsoleOne/bin/ConsoleOne

    5- Install iManager on eDirectory Server
        - Insert Novell eDirectory 8.7.3 Web Applications CD
               #cd /media/cdrom/iManager/installs/linux
               #./install.sh - Enter to begin Install
               Enter to Start Custom Installation
               Enter to install Apache, JVM, Tomcat and iManager
               Accept License Agreement
               Enter to Configure during installation
               Enter to accept hostname and ipaddress (autodetect)
               Enter cn=admin.ou=slc.o=da (Admin Name) and password testoassword
               Enter - Enter - Enter - Enter for readme file
               Enter to save installation settings in /etc/opt/novell/imanager_install.conf
       - Eject and unmount the CD
       - Verify iManager in Browser
          https://server1.value.net/nps/iManager.html and login

  • How-To: ZENworks Backend Services Installation on OES

    A step by step how to to install ZENworks v7 backend services on Open Enterprise Server and can be used for SUSE Linux too.

    1- Pre-Installation Tasks

    • HW: 290 M on HD for 100-500 Users with 512 RAM (1 G Ram for 200 Users.
    • SW Requirements: 
      • eDirectory v8.7.3 and LDAP Configured and running.
      • Statis IP configuration and Samba updated to v3.0.9-2.6
    • ConsoleOne installed with ZENworks Snap-in.
    • Quit Sybase DB if it's installed and running on the server.
    • Administrative Workstation (Windows) -- Optional
      • Win2000Pro-SP4, WINXP-SP1, Win2000Server-SP4, Win3002.
      • Novell Client v4.9 SP1a or later installed.

    2- Determine the required services to install from ZENworks Backend Services.

    3- Install ZENworks v7 Desktop Management

    • Login as root, insert and mount ZEnworks v7 DM Linux CD.
    • Change directory to CD mounted directory and execute ./setup script.
    • Press 3 Enter(s) for Introduction, Prequisties Info and License Agreement.
    • Choose the Install set: Enter 2 to install ZENworks Desktop Management.
      • Note: we can select 1 to install all features on the same server.
    • Enter TREE information: ValueSYS and provide administrative account.
      • Administrative User: admin,valuesys (Notice Comma) and enter password
    • Enter License Code or Press enter to use evulation for 90 days.
    • Press (Y) for Installation of Inventory Standalone Server.
    • Inventory Standalone Configuration: Enter (Y) to create Server Package and Database Location Policy Objects with Server Package.
    • Inventory Proxy Configuration: Press Enter to accept default proxy port.
    • SSL Configuration: Enter (Y) to enable secure LDAP between Inventory and eDir.
    • NETBIOS Configuration appears if Netbios entry is not specified in smb.conf (Accept Default or enter Unique Netbios name)
    • Review Summery and press Enter to start Installation.
    • Skip Readme file by entering (2) to reach Installation Complete Page.
      • Check displayed log file for errors.
      • proxydhcp service is not started by default (if you need it start using rcproxydhcp start)
    • Press Enter to exit Installation.

    4- Post-Installation Tasks

    • Ensure eDirectory Schema extended: ConsoleOne - Tools - schema Manager - check for (zenlocZFD7Installed).
    • Create Search Policy to reduce Tree Walking. (Check Policies)
    • Modify DHCP settings (if needed) to specify that Middle tier is DHCP and DHCP Proxy by adding host entry for it.

    5- Verify ZENworks v7 DM is Installed

    • Check Daemons: novell-zdm-awsi, novell-proxydhcp, novell-tftp .. etc in /etc/ini.d/
    • Check ZEN Files: under /opt/novell/zenworks/*

    6- Proxydhcp Service configuration

    • Disable or Ignore Local DHCP service through /etc/opt/novell/novell-proxydhcp.conf
      • LocalDHCPFlag = 1    (Change this entry from 0 to 1)
    • Start the service and activate it across reboots
      • service novell-proxydhcp start; chkconfig novell-proxydhcp on

     

    ZENworks v7 Middle Tier Installation

    1- Preinstallaion Requirements

    • Apache2 on Linux or ISS on Windows
    • Enable Clear Text Password through LDAP in eDirectory or export SSL certificate and associate it with installation.
      • iManager - eDirectory Administration - Modify Object - Select LDAP Group Object
      • Deselect (Require TLS for Simple Binds with Password).
    • Extend eDirectory Schema Extensions (From Windows Administrative Workstation)
      • Insert ZENworks v7 Desktop Management CD - when autorun select Desktop Management
      • Select English Language - Schema Extension and Product Licensing
      • Accept License Agreement then NEXT to continue
      • Select TREE: VALUESYS and Ensure Extend Schema Option is selected - YES - Finsih.
    • Create Middle Tier Proxy Account has read right for CN attribute and write right to zendmWSNetworkAddress on Users Context.
      • ConsoleOne on Administrative Workstation - Create New User under ZEN.Valuesys container
    • Username: ZDMMidTierUser - Surname: ZENworks - Password: novell
      • Edit Rights for ZDMMidTierUser as follows:
    • Add this user trustee to ValueSYS organization.
    • Delete [All Attribute Rights] using Delete Property
    • Select [Entry rights] and select Supervisor and Inheritable rights.
    • Click ADD PROPERTY and select Show All Properities checkbox and add (CN, zendmWSNetworkAddress)
    • Ensure both previous rights has Write and Inheritable rights - Ok twice.
    • Make aaziem trustee of ZDMMidTierUser
    • Add Property - Select Equivalent to Me - Select Write, Read and Compare rights
    • Now aaziem capable of administrating ZENworks MiddleTier Server.   


    2- ZENworks Middle Tier Installation

    • Ensure The eDirectory server is restarted after extending the schema.
    • Login as root, insert and mount ZEnworks v7 DM Linux CD.
    • change directory to CD mounted directory and execute ./setup script.
    • Press 3 Enter(s) for Introduction, Prequisties Info and License Agreement.
    • Choose the Install set: Enter 3 to install ZENworks Middle Tier Server.
      • Note: we can select 1 to install all features on the same server.
    • Enter eDirectory Server IP Address: 192.168.10.254 then Enter to continue.
    • Proxy User: admin.valuesys or ZDMMidTierUser.ZEN.ValueSYS and password then Enter to continue.
    • Users Context: valuesys then Enter to continue
    • Review Summery and press Enter to start Installation.
    • Skip Readme file by entering (2) to reach Installation Complete Page.
      • Check displayed log file for errors.
    • Press Enter to exit Installation.


    3- Verify ZENworks Middle Tier Installation

    • Launch: http://oes-sp1.valuesys.com/oneNet/xtier-stats for MiddleTier status.
    • Launch: http://oes-sp1.valuesys.com/oneNet/xtier-login for Login using aaziem.
    • Launch: http://oes-sp1.valuesys.com/oneNet/wsimport
    • Launch: http://oes-sp1.valuesys.com/oneNet/zen

    ZENworks Desktop Management Agent Installation on Workstations


    1- Preinstallation Requirements

    • Win2000Pro-SP4, WinXP-SP1 and Win98SE.
    • Workstations' NIC PXE enabled if Preboot Services are used.
    • MSI v2.0 and optional Novell Client v4.9SP1.

    2- Manual Installation

    Insert ZENworks Desktop Management CD - English - Desktop Management Agents

    • Next and Agree to License Agreement - Select the required components (all)
    • Enter IP Address of Middle Tier Server: 192.168.10.254 - Next
    • Check both Display ZENworks Middle Tier Authentication Dialog and Allow Users to Change MT address - Next
    • Startup Options: Select Application Explorer or Application Windows at startup. - Next
    • If needed: Select Limit Application Launcher to One Tree Only and specify the Tree - Install - Finish.

    3- Verify Installation

    • Check Add/Remove Programs and Check Services in Control Panel for WS Manager, NAL and RM.
  • Linux Firewalls: SELinux and Novell AppArmor

    A fast look with some information and tips about SELinux "Security Enhanced Linux of NSA" and Novell's Open Source "AppArmor" - the future of the Linux firewalls in most of the linux distributions. the below include a briefed comparison between the two open source firewalls.

    NSA's Open Source "Security Enhanced Linux"

    • SELinux consider the future of the Linux OS but it's very complex and suffer lack of documentation.
    • It's reommended to not use X on SELinux working Servers. (Problems with granted access control in X server)
    • Security Policies are difficult to be created from scratch, Use the security policy come with the distributor.
    • Has bigger performance impact than AppArmor (nearly 7 Percentage) Of perf.
    • Both SELinux and AppArmor utilize the Linux Security Modules (LSM) framework,which provides security hooks for operational control of certain Linux kernel objects.
    • SELinux is based on Flask Security Architecture.
    • Processes are represented as domains, and objects represented as Types.
    • SELinux Control processes interactions (Domain to domain)
    • SELinux Control access to objects (domain to type)
    • SELinux Control any entry to the domain.
    • SELinux has tools such as SETools and Slat for Policy Analysis, Audit Analysis, and User management.

    Novell's AppArmor:

    • Original developed by ImmUnix Company. (Linux Security Company)
    • Provides a policy-based approach for application-behavior enforcement.
    • Automatically generating security policies through YaST.
    • Pre-built security profiles for commonly used applications, such as OpenSSH, DHCP, Samba, Sendmail and MySQL.
    • AppArmor has less impact on overall system performance than RedHat's SELinux ( 0 to 2 Percentage of Performance)
    • Easier to develop and maintain than SELinux.
    • AppArmor allow user to create a profile (Policy) to describe which files any application can use.
    • AppArmor defined profile for application specifies program capabilities (POSIX.1e) and set of files the program can access.
    • Both SELinux and AppArmor utilize the Linux Security Modules (LSM) framework,which provides security hooks for operational control of certain Linux kernel objects.
    • AppArmor comes with System analyzer called UNCONFINED (Scan open ports, listening programs, programs' related profiles
    • AppArmor comes with pre-built profiles for network input data such as docs from mails, or ssh clients.
    • AppArmor comes with pre-build profiles for local input devices such as keyboard, mouse, card reader .. etc
    • AppArmor includes a Log Analyzing program that help user to create program profile in "Learning Mode".
    • AppArmor Learning Mode allow to build the application profile by
    • Running the application and observing what it does and produce the output to log file.
    • Log Analysis Program scans the log file and prompt the user with questions.
    • Upon questions, automatically create the program's profile.
    • Learning Mode and Log Analyzer can be incrementally improved.
    • Ability to use Application profile for forked child processes of application or create its own profiles or leave it unprofiled.
    • Ability to monitored the profiled applications through severity level of events notifications, Reports, Application Audit Reports and ability to create on demand report.
    • Ability to backup built-in and defined security profiles.
    • AppArmor can monitor and profile sub-applications of parent application such as Web Application from Apache by making the application "ChangeHat Aware", so any changes in Apache by adding application will be profiled automatically.
  • LUM - Linux User Management Fundamentals

    This article summarizes the fundamentals of LUM - Linux User Management of OES Server - Open Enterprise Server and how to implement it, this is applicable to other Linux Distributions as well.

    Fundementals

    • Some Services on Linux require eDirectory users to be Linux Local users to get use of it, such as Novell Samba, ftp, rsh, login and Novell Remote Manager.
    • Linux Users and groups are managed through POSIX standard Accounts.
    • Users and Groups are managed through eDirectory Accounts.
    • LUM enables eDirectory Accounts to be POSIX accounts to enable eDirectory Users access to Linux Server.
    • POSIX Accounts has standard attributes (username, password, uid, gid, Homedirectory, shell, comment)
    • When Users become LUM enabled, PAM make it possible for eDir Users to authenticate to OES Server using LDAP.
    • Services like NCP Server, NSS, iFolder, and other Web Services doesn't require eDir users to be LUM enabled, but have some LUM Requirements.
    • If NCP Volumes point to other partitions than NSS, the user should be LUM enabled to access all features.
    • NSS: If protocols other than NCP access NSS, then eDirectory users should be LUM Enabled.
    • QuickFinder, iFolder, Web Services: These services configured to run as POSIX Accounts, If Services run on NSS volumes all users should be LUM Enabled.
    • Each LUM Enabled user should be associated with a LUM enabled Group. (eDir admin is enabled by default)

    Implementation

    • Decide which users will be LUM enabled based on access services through users.
    • Installing all OES servers in the tree prior enabling Users for LUM on Multiple Servers.
    • LUM enabled group associated to the UNIX Config object or individual UNIX Workstation object, must be created before enable users for LUM.
    • LUM enabled group should be associated to UNIX Config object in case of enabled LUM users on multiple OES Servers.
    • Created LUM Enabled users can be Samba enabled during the creation.
    • iManager should be used for password changes for users.

    1) Create LUM Enabled Group 

    • Create new group - iManager - LUM Category - Enable Group for LUM
    • Associate the group to UNIX Workstation if users will be LUM enabled on this server only or to UNIX Config object if users are enabled on multiple servers.
    • we can enter multiple UNIX workstation objects for the group, so that, users will be enabled on specific servers.

    2) Create Users

    • Create new user - iManager - LUM Category - Enable User for LUM.
    • Enable User for Samba if required.

     

    Cheers,

    Ashraf Abdelazim 

  • MySQL - RDBMS - Technical Overview

    A fast break into MySQL open source database that gives fast look for the syntax, example and administration interface. 


    Core Commands for MySQL:


    >> Go to MySQL Path in our PC and execute the following commands:

    MySQL                                                   // connect to MySQL Server and make the cursor mysql>
    Show databases;                                  // show all databases in our server.
    Use (DB);    ex: Show mysql;                // will change to mysql database.
    Show Tables from MYSQL;                  // Show tables from specific mysql database
    Show columns from USER;                   // Show records in User table in mysql DB.
    select * from USER;                               // Show all information from the user table.
    select USER,Password from USER;      // Show user and password columns.
    Select USER,PASSWORD from USER where user='root';
                                                                   // Show only users that exist with user name called ROOT.


    Commands Related with Databases and Tables:

    >> Create Database with name Mydb. so in DOS under MySQL\bin

    Create DATABASE nameofdatabase;      // create nameofdatabase DB.
    DROP DATBASE nameofdatabase;          // delete the name of database DB.
    Create Table TableName ( Attributes );    // Create table with attributes in DB
    DROP Table Tablename;                           // Drop table from the database.   
    Insert into Tablename (no,name,gride) value (1,'Hayba',95);


    Example

    >> To Create Tables, Specify their attributes and Insert data through dump file.

        mysqladmin -u root create Mydb

    1) Will create file called File.dump as most of php scripts do.
    2) Put the SQL Command without enter key such as:

    CREATE TABLE employees (  id tinyint(4) DEFAULT '0' NOT NULL AUTO_INCREMENT,  first varchar(20),  last varchar(20),  address varchar(255),  position varchar(50),  PRIMARY KEY (id),  UNIQUE id (id));
    INSERT INTO employees VALUES (1,'Bob','Smith','128 Here St, Cityname','Marketing Manager');
    INSERT INTO employees VALUES (2,'John','Roberts','45 There St , Townville','Telephonist');
    INSERT INTO employees VALUES (3,'Brad','Johnson','1/34 Nowhere Blvd, Snowston','Doorman');

    3) then use the comming command to import the data from the dump file.

         mysql -u root mydb < file.dump


    - Another Example:

    CREATE TABLE user ( ID INT PRIMARY KEY AUTO_INCREMENT, userid VARCHAR(100) UNIQUE NOT NULL, password VARCHAR(50) NOT NULL, confirmpassword VARCHAR(50) NOT NULL, firstname VARCHAR(50) NOT NULL, lastname VARCHAR(50) NOT NULL, email VARCHAR(100) NOT NULL, address VARCHAR(255) NOT NULL, city VARCHAR(50) NOT NULL, zip INT(15), country VARCHAR(50) NOT NULL, notes TEXT);


    >> PHPMyAdmin Configuration

    1- Unzip and copy the folder to the htdocs in apache server.
    2- modify config.inc.php if you want to change host or user or password.
    3- fire the browser with http://localhost/<pHpmyadminfolder>/index.php

  • Open Source Articles

    This category "Open Source and Linux", includes a lot of articles about FOSS, OSS, FLOSS, LAMP and maybe any open source related software. I am a RHCE (RedHat Certified Engineer) ,NCLE/NCLP (Novell Certified Linux Engineer/Professional) and these certifications are the highest ones in Open Source and Linux world. As a result, the articles in this category is highly related to my professional work as Technical Engineer and I used to use them as a guidelines during my professional technical services to enterprise customers.

  • Review: OES - Open Enterprise Server

    Review for Novell's new operating system release: OES - Open Enterprise Server that can be based on Netware or SUSE Linux, the review will include "From My Point of View" OES benefits, OES Components and how OES extends Linux capabilities.

    Why OES ?

    • Linux servers are ideal for running web infrastructure and third-party applications such as Oracle.
    • Linux based services such as Openldap, SAMBA, CUPS are exhausted in complex networks.
    • Novell Enterprise deliver Linux felixability of Open source with Commercial network services to serve complex networks.
    • Novell OES add significant value in complex networks where open source capabilities are exhauted.
    • Novell OES can lower the cost of deploying and managing servers by lowing the ongoing system management and decrease hardware cose by depending on Intel x86 platforms.
    • No vendor lock-in for software or hardware.

    Novell OES Components

    • NetWare 6.5 Kernel and Services along with additional enhancements that are in development.
    • SUSE LINUX 2.6 kernel and all services that are in SUSE LINUX Enterprise Server 9.
    • Advanced Linux services and future services that are in development
    • Integrated common management tools to allow coexistence and management of platforms

    Novell OES entexds linux capabilities by providing:

    • Workgroup networking services for end users such as iFolder and iPrint
    • Easy installation and service configuration via centralized directory (eDirectory).
    • Identity-driven security on a global scale to ensure policy enforcement and data privacy.
    • Robust management tools for lower cost of ownership such as YaST
    • Support industry standards such as CIM and OpenWBEM
    • Novell Network Attached Storage Protocols such as (AFP,CIFS, NFS, NCP & Internet Protocols)

    OES - The Good

    • LUM - Linux User Management that lets eDirectory users funtion as local POSIX users on linux servers. (Unique)
    • OpenWBEM - Set of web based management standard technologies. (Unique)
    • QuickFinder - Search utility that indexes what user has right to see.
    • Novell Client can map drivers to locations on OES/Linux Server running Netware Core Protocol (NCP) on linux.
    • iManager 2.5 supports non-IE platforms, including Firefox (such as adding drivers to iPrint Driver Store)
    • iPrint is now supported on linux both client and server sides.

    OES - The BAD

    OES lacks some important features found in his older brothers:

    • Lack of Dynamic DNS Support
    • OES/Linux supports bind, but it's not backed by eDirectory.
    • OES/Linux supports DHCPD, but it's not backed by eDirectory.
    • NSS on Linux doesn't support User Space Restrictions at the volume level, but User Directory Quotas at the directory level are supported. also, installing NSS on eDirectory can cause some UIDS Conflicts so nssid.sh must be run on each OES subsequent server after installing the first server. in addition NSS recognize only EVMS and doesn't recognize LVMS.
    • Lack of an eDirectory-backed SLP DA ( OES/Linux uses OpenSLP)
      • DA- Directory Agent, UA- User Agent, SA- Service Agent
    • Lack of AFP Support (Apple Filing Protocol is used by Mac Clients to access files shared on linux Machines.)
    • ZENworks for Desktops server-side agents are not supported on linux at this time. but hopefully will be soon.
    • Encryption File System, DFS, IPX, Novell Licensing Services, Nsure Audit, RAID5, Time Sync and Netware Traditional File System are not supported on OES/Linux
    • Samba not support on OES/Netware
    • eDirectory on OES/Linux doesn't support management of server resources such as manage files and folders on netware volumes, purge deleted files, allocate volume space .. etc.
    • Welcome page functionality in linux doesn't support installing products and authentication to eDirectory which both are available in OES/Netware.

    Conclusion

    Valuable networking services that improve the productivity of end users
    Centralized control and management over essential networking services
    Identity-driven security on a global scale
    Enhanced scalability and high-availability features
    Robust management tools for lower cost of ownership
    Easier setup and installation provided by pattern-based deployment features

    References

    • Novell Website
    • Novell Online Published Documentations
    • My technical demonstration
    • Some third party websites

     

  • Review: RSA SecurID - Authentication Manager 8

    RSA SecurID and Authentication Manager is the main player in the area of tokens and Two Factor Authentication for a long time, still even after the breach, RSA SecurID demonstrates outstanding growth and enjoys ~70% market share**, over 40 million authenticators world-wide and just won “The Best Authentication Product” by SearchSecurity for 2012.

    RSA just announced good news about RSA SecurID and Authentication Manager Products, RSA new version for Authentication Manager “v8” will be released within H1 – 2013 and it will include unique essential features to provide greater protection to IT infrastructures and environments and also minimizes TCO.

    In total, the new version includes around 40 new features that lowers the cost of ownership TCO, adds the flexibility of RBA – Risk Based Authentication and special support for virtual environments, here’s a summarization for the first look on version 8 of RSA Authentication Manager:

    Risk Based Authentication:

    Risk based Authentication provides greater flexibility and protection through multi-factor authentication techniques that depends on measuring a series of risk indicators behind-the-scenes to assure user identities, the system will offer the choice of using RBA or SMS in a single authentication method.

    Virtual Environments

    The new version will include a VMware Virtual Appliance that will allow taking advantage of VMware ESX and ESXi virtualization in your organization. The virtual appliance is already certificated VMware Ready and will entitle the system to get benefit from all the Virtualized Environments’ benefits.

    Enhanced Console

    The console will includes new features such as:

    • New user dashboard that provides a convenient single-pane view for administrators.
    • Mobile Platform Profiles, which allows rapid deployment of RSA SecurID Software Authenticators.
    • Consolidated System Settings that reduces system management time
    • Scheduled backups and critical system notification

     

  • Review: Tripwire Enterprise

    Tripwire is known as a leader in Change Auditing and FIM area helping organization to achieve compliance and enhanced security, in this article we will summarize the deployment options for Tripwire Enterprise, and in another article we will review the advanced features and capabilities of Tripwire Enterprise. 

    Tripwire announced another product called Tripwire Log Center that capable to collect, store, index and correlate logs –Log and Event Management capabilities – Tripwire combined both products in our suite called Tripwire VIA and they say that the two products are integrated and they are able to integrate the change, log and event into one single view to identity threats! It will be really interesting to see this in action!

    In this article, we will focus on Tripwire Enterprise and its capabilities for Change Auditng and File Integrity Monitoring and how it’s deployed.

    Most organizations face a problem to maintain a complied status after achieving the first compliance, Tripwire Enterprise highly integrates its Change Auditing component with the Policy/Configuration Assessment components to ensure Continuous Compliance by completely automating the process of detecting changes and reflecting it on policies/reports without any interaction from the system administrator, which provides REAL TIME view for changes and current compliance status.

    Tripwire can be deployed in three different scenarios on monitored machines:

    Agentless (Network Devices, Linux and UNIX systems)

    Agent  for Windows OSs

    Agentless for Windows OSs by using another deployed agent on any other machine

    Benefits of using Agent technique:

    Avoid “Mega-scans” over the network and the systems which include complete assess, gather, analyze for the compliance information for the machines/systems in scope.

    Provide a very detailed level of compliance information that can include “contents, authorized or not authorized and who did it”

    Avoid providing system administrative credentials of your machines/systems to make the remote “Mega Scans”

    Using agents, Tripwire keeps a cache of compliance information on each machine, so only new changes are monitored against the compliance policy and the machine baseline to ensure continuous compliance and minimal impact on network/systems performance

    Provide REAL TIME monitoring/compliance information instead of performs mega-scans on big intervals like a month/2weeks.

  • Review: ZENworks 7 Suite - Detailed

    This review includes detailed overview of ZENworks Desktop v7 (Desktop Management Product). the overview will include features, components, new competitive features, design guidelines and access methods.

    ZENworks v7 General Overview

    • ZENworks is a Resource Management Solution for automating the management of network resouces.
    • ZENworks uses eDirectory as a Backend for handling it's policies, applications, workstations through objects.
    • ZENworks access time depending on how eDirectory objects are placed, so good designing is required for better performance.
    • ZENworks has 3 tier architecture (Backend services, middle-tier services and Workstations agents)
      • Back-end Services (servers which run Core ZENworks services)
      • Middle-tier an intermediate between Backend-Services and Workstation Agents and serve their requests through http and https.
      • Workstation Agents: which installed on Client Workstations and Novell Client not required.
    • ZENworks Middle Tier Services can be on the same server of Backend Services or on a separate server.
    • ZENworks Objects
      • Application and application folder (User access to applications)
      • Group objects, Workstation objects
      • Policy package object (Rules and group of policies in one package)

    ZENworks v7 Suite Components

    1. ZENworks Desktop Management:Manage Windows Laptops and Desktops to provide services such as Application Distribution, Imaging, Remote Management, Workstation Inventory, Policies.
    2. ZENworks Server Management:Manage Netware, Windows, Linux and Solaries Servers to provide services such as Application Deployment, Update Server Configuration, Server Inventory (SW and HW), Policies, Server Processes Management and Real Time Monitoring.
    3. ZENworks Handheld Management:Manage Palm, Windows CE, BlackBerry and Pocket PC handheld devices to provide Application distribution, HW and SW Inventory, Data Compression for Bandwidth, Remote Management, Access Points Management, Install, Delete and Uninstall SWs remotely.
    4. ZENworks Linux Management:Centralized Control for Linux Servers and Workstation to provide User and Group management, Software-Providers Integration, Roll Back Software Update and Automic Solve for Dependencies.
    5. ZENworks Asset Management:Centralized Management of HW and SW by Control how data organized, Schedule when to collect data, Roles assignment for users for access control and provide Inventory Analysis, Quiers and Reports.
    6. ZENworks Data Management (iFolder):Store and Access Users' Files from anywhere anytime, online or offline, through Web Access, Internet or Platform-specific clients.
    7. ZENworks Instant Messenger (GroupWise Instant Messenger v1): Provide Secure Communications for conversations, Policy Based Management through eDirectory for Users administration and more.
    8. ZENworks Software Packaging (InstallShield AdminStudio ZENworks Edition):MSI Packages Management through Creating MSI, Converting Legacy-based install to MSIs, Customizing MSIs and Automate creation and distribtion ob eDirectory objects.
    9. ZENworks Personality Migration (Unicenter Desktop DNA from Computer Associates): Migrate System settings, Desktop Settings, Application Settings, Folder and Files, Backup and Restore Desktop Env and Automate Migrations from computer to another.
    10. ZENworks Patch Management (PatchLink Update):Software Update and Patch Management for Windows and Netware by providing Vendors' Software Update such as Symantec, Schedule Updates, Review Patch Info and Generate Patches Reports.

    ZENworks v7 Suite Management - Backend Services Components

    • Application Management (Performs every thing related to applications)
      • Distribute MSI windows applications and create dependiences
      • Determine access to the application
      • Determine how distributed applications presented to users
      • Distribute applications during the imaging process of workstation
      • Uninstll any distributed applications.
    • Automatic Workstation Import
      • handle the entire lifecycle of a workstation from Import through AWI to its removal using AWR
    • Imaging Service
      • Capturing Workstations images, store them locally or remotely on imaging server and restore images to multiple workstations.
      • Images handled through eDirectory using Workstation image object
      • Can be combined with server policy and scripting to define and perform imaging operations.
      • Compress images and restore the images individually or for group of workstations using a multicast session.
      • Create, delete, activate and view partitions.
      • using Preboot Services for PXE management.
    • Remote Management (eDirectory)
      • Complete Management for Workstation locally or remotly and remote Wake up for power off machines.
      • Enables Auditing and logging, Wake up and reboot Machines at scheduled time, execute files, transfer files between remote management console and managed workstation, Diagnose workstation problem, Lock keyboard and mouse .. etc
    • Workstation Inventory
      • Don't Install Workstation Inventory with Middle Tier on Win2000 same server.
      • Gather SW and HW information about workstation and store then in database that sys admin can query, view and report.
    • Inventory Database
      • Stores information gathered by other services in RDBMS (Sybase, Microsoft SQL2000 and Oracle dbs)
    • Workstation Management
      • Complete management for workstation such as change wallpaper, install software, workstation based policies and credentials.

    ZENworks v7 Desktop Management New Features

    • ZENworks v7 can be installed on all Novell Linux supported Servers (SUSE, OES and NLSBS).
    • Policies and Applications distribution on Tablet PCs.
    • New Products bundled with ZENworks (Included in License):
      • Asset Inventory Component, Instant Messenger, IDM v2.02 with AD Driver and iManager v2.5
    • Application Management: Ability to deploy Desktop Management Agent to Workstation in Windows Workgroup.
    • Workstation Imaging:Linux Kernel v2.6 add support for a varity of cards.
    • Workstation Inventory:Ability to set and use Oracle9i and 10gR1 on UNIX server and Windows and QuickReports Tool for fast reports.

    eDirectory Design Guidelines for ZENworks

    • Tree Design Guidelines
      • Design Upperlevels according to WAN Links and Lowerlevels according to network resources.
      • Users and Workstations in the same WAN Link should be grouped together through group memebership.
    • Paritions Design Guidlines: Create paritions according to geographical locations and don't span paritions across WANs.
    • Replica Design Guidlines: Maintain 3 Replicas for Fault Torlerance and Store them locally if possible for performance.
    • Create ZENworks objects (Policies, Applications, Folder) in the same container of associated users with these objects.
    • Create ZENworks Workstation objects in the same location or container of physical workstations (Quick Login and Info Gathering).
    • ZENworks Installation in a separate TREE needed only if:
      • Prevent the need to update file, print and directory servers while upgrading ZENworks.
    • Multiple eDirectory Tree Support: During NAL and GINA Agents installation, both should be modified to support multiple trees.

    ZENworks v7 Access Methods

    • Traditional Novell Client Access Method
      • Client and Agent running on the Workstation and access ZEN Server through NCP.
      • VPN Connection can be established to avoid security problems. (Not Firewall Friendly - NCP and SMB Ports open)
      • Client Benefits: Map drives and Access to NDS based printers.
    • Web Services Access Method (Outside the Firewall)
      • Using the Client with VPN has disadvantages:
    • Not Firewall friendly (Open Ports) and Delay Login time till establish the VPN Connection.
    • Companies were not comfortable using Novell Client and VPN (No Ease of Use).
      • The need for Web services raised to aviod Client disadvantages by:
    • Access ZENworks Server through http and https through Middle Tier Server (Firewall Friendly)
    • No need for Novell Client but will lose Map Drives and Access printers benefits.
    • Works by Workstation send request (XML Files ) to Middle Tier Server which pass it to ZEN Server and send back its replay to Workstation.
    • Web Services Access Method (Inside Firewall)
      • Using Outside the Firewall method, Internal Users faced High Traffic problems while remote users get benefit from it.
      • ZENworks7 uses (ZENMUP) ZENworks Multiple UNC Provider instead of UNC in previous versions.
      • Using ZENMUP enable users (Inside and Outside Firewall) to use web services access method with no depreciation in traffic.
      • ZENMUP provide automatically configured multiple UNC paths to Middle Tier Server and ZENworks server directly (Transparent to users.)

    ZENworks v7 Desktop Management Agent

    • ZENworks DM Agent must be installed on all workstations regardless of Novell Client.
    • ZENworks Agent enable workstation to communicate with both MiddleTier and Backend Servers.
    • GINA responsible for Login Dialog on the Workstation and can be edited through /HKEY_LOCAL_MACHINE/Software/Novell/NWGINA/ Passive Mode to 0 or 1.
    • Desktop Management Agent Components
      • NAL (Novell Application launcher): responsible for Application distribution, Uninstall and Management.
      • Workstation Manager: Ability to apply user and workstation policies and any workstation based service.
      • Workstation Inventory: enables workstation inventory on the workstation.
      • Remote Management: enables Remote Management service of ZENworks7 DM.
      • Workstation Imaging: enable unique track for workstation information to be used by imaging service.
    • Agent Installation and Distribution Methods
      • Agent Distributor Utility through ConsoleOne: Require Active Directory or Windows Domain.
      • MSI NAL Application: Require previous version of ZENworks to distribute the application.
      • Login Script: Require Novell Client installed and all domain users are in administrators group.
        • msiexec /i \\oes-sp1.valuesys.com\sys\public\zenworks\zfdagent\english\zfdagent.msi
      • Website: Place the MSI file on a website accessable by all users.

    ZENworks v7 Desktop - Services Management under Linux

    • Start Service: /opt/novell/zenworks/bin/ZDMstart
    • Stop Service:/opt/novell/zenworks/bin/ZDMstop

    References

    • Novell Website
    • Novell Online Published Documentations
    • My technical demonstration
    • Some third party websites

     

  • Summarization for PHP Functions

    This is a summarization for all PHP functions with small description and the syntax required for the function and example too.

    The summerization categorized into the following:

    -PHP Functions - File Manipulation:

    >> Date Function
    Print Date("j/n/y");          >> (22/3/2002)
    print date("h:i:s A");        >> (05:11:19 AM)

    >> Basename Function
    ashraf.co/help/index.php
    echo basname("ashraf.co/help/index.php");    // Print Base name
    The Base Name Of the file will be >> index.php

    >> Dirname Function
    ashraf.co/help/index.php
    echo dirname("ashraf.co/help/index.php");
    The Dir Name OF the Link will be >> ashraf.co/help

    >> CHMOD Function    ( Modify Licences & Permission Of Files )
    Important Modes 755 for scripts & 777 for folders and files
    Chmod("test",0755);    // give mode 755 for test Folder.

    >> CHOWN Function     ( Multiple Users Own Multiple Files and Folders )
    chown( User identify , File Or Folder );

    >> Copy Function    ( Copy file or Folder )
    copy("arab1.jpg","arab1.pak");    // Copy arab1.jpg file to arab1.pak

    >> Unlink Function     ( Delete Specific File )
    unlink("arab1.pak");    // notice we put name of the file or it's path.
    if it's in another directory.

    >> Diskfreespace Function    ( The Free Space of the disk )
    echo diskfreespace("/");    // we can write a folder name instead /

    >> File Function    ( Read & Manipulate Result of Files )
    $myarry = file('http://www.ashraf.co/index.html');
    // read the file index and put it in myarray

    >> File_exists        ( Check if file exist (return 1) or not ( return Any )
    if(file_exists("pic.jpg")
    { echo "File is found"; }
    else
    { echo "File doesn't exist"; }

    >> Filesize Function    ( Check the size of the file we want )
    echo filesize ("pic.gif");

    >> Fopen Function     ( Open the file to can deal with it )
    $fp = fopen("File.txt", "r");
    $fp = fopen("file.txt", "w");
    $fp = fopen("http://www.ashraf.co/file.txt", "w");
    $fp = fopen("http://www.ashraf.co/file.txt", "r");

    >> Fclose Function     ( Close the file opened by fopen function )
    $fp = fopen("file.txt","r");
    fclose($fp);

    >> Fread Function    ( After Open file Read some part of the file or whole file)
    $fp = fopen("file.txt","r");
    $contents = fread($fp,20);    // read 20 bytes only from the file.
    $fclose($fp);

    >> Feof    Function    ( End of file >> Check if we reach the end of file or not)
    feof($fp)

    >> Fwrite Function    ( Write to the file specific thing )
    Fwrite($fp,"My Program");    // My Program is The text we want to write.

    >> File Function    ( Read Complete file without need for open or close it )
    file("http://www.gerainmo.net");

    >> Is_dir Function    ( Check if Directory found ( return 1 ) or not ( 0 ) )
    echo is_dir ("mydirectory");

    >> mkdir Function    ( Make new directory by name and permission )
    echo mkdir("Ashraf",0777); // create Ashraf directory with full access.

    >> rmdir Function    ( Remove Specific directory )
    echo rmdir("Ashraf");

    >> rename Function    ( Rename specific file or folder )
    echo rename ("Ashraf","Adel");     // rename Ashraf file to Adel.

    >> realpath Function    ( Complete real path for specific file )
    echo realpath("Ashraf.txt");

    -PHP Functions - Arraies Functions:

    >> Array Function    ( Create Two or Multi Dimentional Arrays )
    $test = Array("A","S","H","R","A","F");

    >> Array_count_values    ( count repeated values and non repeated
    $count = array_count_values($test);

    >> print_r Function    ( Print the array elments )
    print_r($test);

    >> array_keys        ( Get Keys or names of the elements of the array)
    array_keys($test);

    >> array_merge        ( merge 2 or more arrays in one array only )
    $test1 = array ("a","b","c");
    $test2 = array ("c","f","g");
    $test = array_merge ($test1, $test2);

    >> array_pop         ( delete laste elment in the array )
    array_pop($test);

    >> array_push        ( Add one or more elements in the end of the array )
    array_push($test, "d", "y");

    >> array_reverse    ( reverse the array from end to the start )
    array_reverse($test);

    >> array_shift        ( Del first element in the array )
    array_shift($test);

    >> array_unique        ( return the array's values distinct without any repeat )
    array_unique($test);

    >> array_values        ( return all the array values in new array )
    array_Values($test);

    >> asort        ( arrange array's elements from small to bigger )
    asort($test);

    >> arsort        ( arrange array's elements from high to low )
    arsort($test);

    >> Count        ( Return the No. of elements in the array )
    count($test);

    >> in_array        ( Check if the value if found in the array or not )
    in_array("b",$test);    // b is the value.


    -PHP Functions - Mathematical Operations:


    >> bcadd        ( add 2 numbers whatever thier datatype )
    bcadd("1.59","9.87",1);        // 1 specify how many number after ,
    Result: 11.3
    bcadd("1.59","9.87654",0);    // 0  >> will be integer number.
    Result: 10

    >> bccomp        ( Compare between 2 Numbers )
    bccomp("1","1.11111",1);    // right no. bigger and one fragment = -1
    bccomp("1","1.11111");        // 2 numbers consider equal because no frag

    >> bcsqrt        ( X power 2 >> El Gazer El Tarb3ie )
    bcsqrt("17",3);        // result will be 4.123

    >> abs            ( Return the Real Value of the No. )
    print (abs(-13));    // will print the real value will be 13.

    >> Max            ( Return the maximum value of the sent values )
    print (max(2,5,6));    // Print No. 6

    >> Min             ( the reverse operation of Max function )

    >> Ceil            ( make the floating number become the next integer number )
    print(ceil(13.21));    // result will be 14

    >> Log            ( get the log of the number )
    print(log(20));


    -PHP Functions - Variables Manipulation:


    >> doublelevel        ( convert any numerical datatype to double datatype )
    doublelevel($var);

    >> Empty        ( get sure if the variable empty or not by return t\f )
    empty($var);

    >> gettype        ( know the type of the variable )
    gettype("hello");        // String

    >> intval        ( convert the variable to intger datatype )
    intval("13.15cm");        // will be 13

    >> is_bool        ( check if the variable is Boolean or not )
    is_bool($var);

    >> is_{DataType}     ( Check according the datatype )

    >> isset        ( Check if the variable has been decalred or not )
    isset($var);

    >> Settype        ( set information type to specific datatype )
    settype($myvalue,integer);

    >> unset        ( delete the variable from the memory )
    unset($car);

    >> var_dump        ( specify the datatype and type of information too )
    $a=100;
    var_dump($a);

     

    -PHP Functions - Image Manipulation:


    >> getimagesize        ( get type and dimentions of the image )

    >> imagecreate        ( create new image and must return in variable )
    $im = @imagecreate(50,100);

    >> ImageColorAllocate    ( define the color used in paint the image )
    $colorMagenta=ImageColorAllocate($im,0,0,0);    // need image variable.


    -PHP Functions - Image Manipulation:


    >> ftp_connect        ( Establish connection with ftp server and return var. )
    $ftp = ftp_connect("ashraf.co")

    >> Ftp_login         ( login to the server )
    $log = ftp_login($ftp,"user","Password");

    >> ftp_pwd        ( where exactly i am in the path or directories )
    $dir = ftp_pwd($ftp);

    >> ftp_chdir        ( go to specific directory and need variable of connect )
    $chdir = ftp_chdir($ftp,"Ashraf")

    >> ftp_mkdir        ( make directory in the current path )
    $mkdir = ftp_mkdir($ftp,"adel")

    >> ftp_rmdir        ( remove directory in the current path )
    $rmdir = ftp_rmdir($ftp,"Ashraf")

    >> ftp_nlist         ( return list with all files and folder in array shape )
    $listf = ftp_nlist($ftp,".")

    >> ftp_get        ( download file from the server and need connect variable
    and transformation type < ASCII or Binary > )
    ftp_get($ftp,"/tmp/data.bin","/pub/data.bin",FTP_BINARY);

    >> ftp_put        ( upload file to the server and the same conditions )
    ftp_put($ftp,"/tmp/data.bin","/pub/data.bin",FTP_BINARY);

    >> ftp_size        ( return size of the file from the server )
    $size = ftp_size($ftp."Ashraf.txt");

    >> ftp_rename         ( rename specific file to another name )
    $rename = ftp_rename($ftp,"file.txt","fileto.txt");

    >> ftp_delete         ( delete specific file on the server )
    $delete = ftp_delete($ftp,"file.txt");

    >> ftp_site        ( send commands to the server )
    $send = ftp_site($ftp,"cd");

    >> ftp_quit        ( close the connection between the server and u )
    $close = ftp_quit($ftp);


    References:


    >> Larry Ullman's "PHP for the World Wide Web" (Peachpit Press)
    >> "Teach Yourself PHP4 in 24 Hours" by Matt Zandstra

  • Technical Articles

    Technology Articles - this section includes all my technical and technology writings starting from 1998 till present, the section includes articles about Open Source, Linux, Security, Microsoft, Networks, Applications, Systems, How-Tos, Cool Tools and tricky tips :)

    I have thousands of text files that include everything I learnt. I usually write down all the stuff that I do, starting from a small tip, specific experience, fast study till my professional work experiences and learnings and I am sharing all that technical and technology stuff here, I hope that stuff be useful to other people instead of just locking them in my desk.

    Your can contribute to this section and your contribution is highly welcomed and appreciated. Just pick a topic, write it in the preferred way, send it and let's share it under your name. Although all my writings in this section are in English but I am going to add Arabic content to enrich the Arabic content on the internet when it comes to Cyber Security, so no specific language for this section, you can write in العربية, English, Frankoarab or/and any MIX of them. simply write in the language you prefer and express your/my writings in the best way.

    All content in this section published under Creative Commons License, the main categories in this section as the following, please click on category link below to list all articles in specific category or use the side/main menu to navigate as well.

  • The SOAR Bedtime Story - Part 2

    In the first part of the SOAR Bedtime story, we briefed the initial evolution of SOAR, starting with depending on the analyst’s skills and some best practice to do IR, then over time the evolution of the usage of corporate ticking system to have consistency and collaboration, then a dedicated ticketing system for security operation center that integrated with the corporate ticketing system for more confidentiality and better handle for sensitive information that part of cyber incidents, till having a Security-specific ticketing and case management system which is Security Incident Response Platforms (SIRP) that comes with security built-in features like NIST and SANS best practice, access control, threat intelligence..etc and still integrate with corporate ticketing for collaboration, assignments, tracking ..etc

     

     

    At that stage, the market was finally having a step by step guidance within SIRP system for each incident type and big momentum and excitement started to automate those tasks with Automation Tools and Workflows to close the gap of skilled resources and to have faster response .. 

    As a result enterprises started to adopt Automation proactively BUT that momentum, excitement and proactivity ended up with big FAILURE due to the many faced challenges when it comes to Automation in real enterprise production environments, starting with enterprise processes and operations that won’t really allow automating more than 20-30% of the operation and the processes, how system owners outside security wouldn’t trust to give privileged accounts that will be stored in the Automation tool controlled by security team, and the introduced business risk like automating the isolation an infected workstation would be okay but what if the automation tool automatically isolated a business critical application due to an infection and in such case the Automation Tool would be the actual stopper for the business!

    So quickly the market evolved again to a bigger concept which is Orchestration, and unfortunately to date many doesn’t know the actual definition and role of Orchestration in incident response and what does it actually do! 

    Briefly, Orchestration is the bigger concept of Automation that acts as the connective tissue for your security technologies, people and processes; and allows three specific tasks:

    1. Automating the work with 3rd party technologies through integration use cases, but Automation became a human-centric automation in which the orchestration tool will still automate every thing possible for the analyst but the one to make the final decision is the one who understand the business context and associated risks which is the analyst.
    2. How to integrate in the enterprise processes and orchestrate it like business, legal, HR ..etc
    3. How to work with with internal and external stakeholders and orchestrate the work with them without even giving them access to any system.

    And Orchestration became the real trend and the real momentum as the focus is no longer the automation workflow to automate the 3rd party technologies for bits and pieces, the focus becomes how to orchestrate people, processes and technologies to serve the enterprise purpose of acting faster and smarter on incident response and focus on what’s really matter.

    I would quote one of the analysts in a keynote address in which he said SIEM is the heart of your SOC and Orchestration is the brain in the SOC. 

    So at that time in 2017, Gartner released the first report for Technology Review for Security Orchestration, Automation and Response (SOAR) Technologies that sum up the evolution in that area and highlighted that SOAR is SIRP + SOA (Automation Workflows) + TIP, the report that confused Adam :) — know the full story here — before confusing the market and the vendors. However many didn’t pick the clear statement that “Some vendors use the terms “automation” and “orchestration” interchangeably as synonyms, although they are not the same concept. Automation is a subset of orchestration.”

    To break down the SOAR capabilities to understand how to get the best value of SOAR and also to build the BRAIN in your security operations, the focus must be on having the following:

    1. Security Case Management (SIRP) with OOTB best practice of NIST, SANS and US Cert for step by step guidance for each incident type with automatic assignment and automatic SLA management.
    2. Automation Workflows that facilitate the automation use cases through integrations with 3rd party technologies for response actions, and/or investigation and analysis queries
    3. Threat intelligence as a central level to enrich both the detection phase and the response phase during the work on the incident automatically.
    4. Simulations and Drills to have the ability to train teams, running drills blue, purple and red teams, doing pre-audits and improve processes.
    5. Taking into consideration the regulations, standards and laws around IR to help you meet/prepare for them and avoid many associated business risks (Like GDPR or PCI DSS compliance ..etc)
    6. And finally the Orchestration itself as it’s the connective tissue for all the above as simply it links all the above in one consistent, repeatable, auditable and automated process for each incident type regardless of how simple / complex is the process.

    So to recap, Automation is really important as it helps with many challenges when it comes to cyber security and non-cyber security, but it’s just a piece in the puzzle or a single part of the brain, for small and medium organizations that would make sense to run automation to help with those bits and pieces but for many organizations like enterprises and of course small and medium organizations it’s really crucial to focus on automating the process itself through Orchestration to have that simple/complex consistent process based on the above capabilities and having automation as part of it as per your needs to allow IR teams to act faster and smarter.. 

    OK, so how can we implement the SOAR in the most effective way to get the BRAIN functioning in the security operations? 

    Does the SOAR technologies facilities the above and comes with OOTB functionalities and features for easy and smooth deployment?

    How long would it take to gain a value from a SOAR / Brain implementation? 

    All of that will be the topic of the next article on best practices for implementing SOAR and to have the brain in the security departments and operations regardless of your organization’s size .. STAY tuned .. that’s coming shortly ;)