SECTION 9 Cyber Security

This episode is about PlexTrac, security audits and company culture. We had planned to do security audits for others as part of our business. How can we do a security audit if we can’t even produce a podcast properly? Some of our show’s have been published with the wrong information. Not a big deal, but it is a sign that we’re doing things wrong.

We need a company culture that includes things like procedures. A company culture that promotes best practice. We’re working on it.

Time to start planning for the Windows 10 certification. The modern desktop administrator associate. Why do we want this cert? What’s on the test? How do you study for it? What are some good study materials? We cover all of that. This isn’t our first cert test.

We did okay this year. Managed to take a few steps in the right direction. Automated patching with Automox was one of them. It’s now time to start planning for 2020. We have a few certs and projects we want to work on. Microsoft is pushing cloud. Looks like we’re moving in that direction.

We’re running away to Hawaii for a week. What do we do with our systems? Something to think about when you’re IT team is just two people. Just like everything else we do here at Section 9. We need to plan for this.

The Microsoft Azure tutorial we’ve been following is more work than we thought. Accessing the Windows server 2016 VM in Azure is tricky. They want this directly connected to the internet with RDP wide open. That might work for testing. That’s not going to cut it log term. We need to lock this down. Easier said than done.

Thanks to Jack, a listener of the show, we’re looking at Azure pricing. What are we paying for? We’re not sure. Microsoft says they’re being transparent with Azure pricing. I’m not sure sure about that.

More Azure! We’ve added a custom domain and configured a password rest option. We’ve also made Dorothy an owner of the Azure subscription. It took a bit of research to get this done. The tutorial is good, but it doesn’t cover everything. We still have a long way to go.

Time to learn about Azure. Last episode we talked about Azure Active Directory Federated Services. What we really want is Azure AD DS.

We’re looking into new technology like Azure AD FS. Before we can start new projects, we need to get the operational side of things in order. We’ve done a good job of clearly defining a patch management process. It’s time to work on change, incident and project management.

Are fancy security solutions like Palo Alto firewalls, ExtraHop or LogRhythm going to keep you secure? By them selves, no. It doesn’t matter what the vendor says. There’s no such thing as a security solution that magically saves the day. A good solid security process and best practice is the key to any security program.