WSUS3

WSUS (Windows Server Update Services) is a Microsoft tool that allows you to provide Microsoft updates to your computers from a single interface. The new WSUS3 that was recently released provides the administrator with an MMC Console to manage all the updates for your computers. A WSUS Server downloads updates from Microsoft Update or from another WSUS server and then the client machines are forced to download the updates from the server via a Group Policy.

The Benefits of WSUS

• Save bandwidth, because only one machine downloads your updates and distributes them instead of each computer downloading updates individually.
• Save Time, because you manage all of your computers from one place instead of going from computer to computer.
• Better Security, with WSUS your control over the updates will be vastly improved and therefore your network will be more secure.

Improvements from WSUS2 to WSUS3

• MMC console instead of Web interface
  
• Better reporting tools
• More options and settings

Drawbacks of WSUS3

• You can't sync a WSUS3 Server with a WSUS2 server
• The MMC console is terribly slow over a WAN connection.
• There is no web interface, so you have to install the MMC snap-in and the Microsoft Reporting tool in order to manage your server from another computer.
  

Critical Importance of Integration in PACS

The importance of integrating a PACS, RIS and back-office system in a Radiology department can not be understated. The benefits of having these three systems tightly integrated will make major differences to the way the business performs. The work flow of a PACS system brings major benefits to the practice and can lead to massive improvements in the turn-around time of patients. This increase in turn around times however is useless unless the back-office systems can keep up and provide the billing functions in a timely and efficient manner. Without integrated systems this becomes a bottleneck in the work flow.

Consolidating Systems
I am a firm believer in consolidating computer systems so they are more manageable in terms of security, maintenance and backup procedures. Systems that are separate and architecturally different provide problems because these systems become difficult to manage due to the fact that the computer administrators need a larger skill set and more time to manage and secure these different systems. One should stick to a standard in computing be it a standard manufacture, Operating System, Database Server, Etc.

Symantec Internet Security Report March 2007

The Symantec Internet Security Report is a good source of security related information. Some of the more interesting items that I took from this report are:

• Microsoft releases patches for its OS more quickly than any other OS.
• MSSQL 2005 has had no vulnerabilities reported for over a year an a half!
• There seems to be a massive trend towards commercial gain from the theft of confidential information, which means this crime is going to be around for a long time.

You can find the Symantec Internet Security Report report on the Here

New Phishing Toolkit Poses Danger To Consumers - Technology News by TechWeb

New Phishing Toolkit Poses Danger To Consumers - Technology News by TechWeb
I noticed this article and have become a bit concerned. It states that there is a man in the middle attack kit out on the internet for sale. Now a man in the middle attack is typically considered a rather sophisticated attack that is almost impossible for the client machine to detect.

Basically what it is is a combination of multiple attacks in order for a hacker to intercept all traffic from clients to a particular website. Typically the attack happens with 3 phases:

1.) Traffic Redirection
DNS entries on a server are modified using specially formed packets confusing the server into mapping the incorrect IP Address to a DNS name.
The attacker can also use ARP-Spoofing to confuse the client machine to send information to the attackers computer, by sending a modified packet to a machine which corrupts the users ARP table which maps MAC addresses to IP Addresses.

2.) Traffic interception
Once the traffic has been re-directed all the client machine is forwarded to the hackers IP address. What the hacker does is create a website that looks identical to the one requested and acts as a proxy between the two computers. Traffic in both directions can been seen and or modified at will by the attacker.

3.) Credential Theft
The hackers can now intercept any usernames, passwords, etc. at their will.

Why this is a problem?
The internet has become a place where all manner of transactions occur and hackers are well aware of this. The hacker kit will allow non-skilled hackers (aka script kiddies) to compromise more peoples private information such as bank details etc. This could also pose a problem if a PACS system where to be compromised in such as manner, because lots of private patient information could be leaked out if the web interface of a PACS system where to be caught in such an attach.

What to do about it?
I would start by implementing some form of secure access to the site. HTTPS connections will encrypt the information making it a little more difficult for the attacker to intercept information. I would alos implement monitoring systems that would allow you to determine source addresses and such and see if there are any anomalous IP Addresses with unusually high hits on the site.

Extra Reading
http://www.cs.umu.se/education/examina/Rapporter/MattiasEriksson.pdf
http://en.wikipedia.org/wiki/Man_in_the_middle_attack
http://www.computerhope.com/jargon/m/mitma.htm
http://blogs.ittoolbox.com/wireless/networks/archives/wireless-man-in-the-middle-attack-part-i-7422

Proxy/Firewall

I wanted to setup a proxy/firewall solution for our one branch to do the following:

1. Block hacking attempts from external sources
2. Block access to non-work related websites (i.e. porn, warez, etc..)
3. Provide access controls to throttle internet access

I found several Linux distributions that can offer such services, but the one I ultimately chose was IPCop. IPCop is very easy to setup and configure. You may need some Linux experience to do it, but for the most part you can Google what you need.

Some Screenshots of my IPCop Setup:








The setup takes roughly 15 minutes and once you have done the basic installation you can start adding third party plugins to add more security and configurability.
I loaded the following add-ons to my installation:

• CopFilter - Adds some filtering capabilities and blocks virus downloads, etc.
  
• Advanced Proxy - Adds serious configuration enhancements to the proxy.
  
• URL Filter - Adds ability to block domains and urls.

Some other tools you might need to do the installation of the 3rd party tools:

• OpenSSH - Windows SSH client to copy addons to the IPCop machine

Instructions on adding a new 3rd party add-on:

1. Make sure you have OpenSSH installed.
   
2. Download the file to your local computer.
3. Copy the downloaded file to your SSH bin directory. (C:\Program Files\OpenSSH\bin)
4. Open a command line window. (Start --> run --> CMD)
5. Move to your OpenSSH bin directory. (CD C:\Program Files\OpenSSH\bin)
6. Run the command:
   

   scp -P 222 root@:/root

7. On the IPCop machine login as root and run the following command:
   

   tar xzvf 

8. Move to the directory just created. ( CD )
9. run the ./install command

I have now setup a policy in Active Directory that points all the client browsers to go via this proxy for monitoring purposes. I have not yet setup the firewall capabilities as I do nat have a second compatible Ethernet card.

I hope this rough little tutorial will help some of you out there. Please post comments if you require more information.