Introducing Varonis Data Transport Engine

For years, Varonis customers have been using Varonis DatAdvantage and the IDU Classification Framework to find data sets that they want to move or delete—stale data, active data, sensitive data, data belonging to department X or Y. Being able to easily find data based on permissions, activity, content, and other metadata accelerates lots of common IT data projects like migrations, mergers & acquisitions, archival, and disposition.

What would make it even easier? What if you could automatically copy, move, or delete data once you find it, without downtime, across domains or across platforms? What if you could automatically translate and optimize the permissions during a move, and simulate the move to see and edit the new directory and permissions structure before executing?

Now you can. Check out the new Varonis Data Transport Engine.

Find out more!

Put Data Migration on Your Fall IT To-Do List

In the US, Labor Day weekend is the traditional dividing line between end-of-summer vacations and the start of serious back-to-work initiatives. With 2012’s final quarter fast approaching, you’re no doubt adding a few discussion items for the next IT management meeting. Here’s a bullet point we think you’ll want to look into: start planning for that data migration project you’ve been postponing!

IT pros know that moving or migrating large amounts of critical corporate data is never a simple procedure if your plan includes—and it should—minimal or no disruption to current operations. Even in the simple case of replacing an aging file server with a newer model, data administrators have quite a few things to take into account.

To begin, they’ll likely want to streamline directory hierarchies and clean out stale files while maintaining the existing permission structure for their users. There’s also the job of choosing the best time slot to cutover to the new servers—which would, of course, require knowing how much time to allocate for transferring terabytes of data.

We could go on because we’re just only touching on the considerations in this base scenario. For example, if you’re archiving data for compliance reasons or transferring data between domains, you’ll have even more challenges to take into account. Have you really thought through, say, the implications of moving data and permissions between NTFS and SharePoint?

No wonder why you’ve been finding excuses to not retire old servers or perform extensive housekeeping on your company’s files.

At Varonis, we build data management solutions that focus on the data about the data—the metadata. Check back in with us tomorrow to see how our Metadata framework technology will be extended to untangle the complexity involved with planning, testing, and executing a successful migration.

So push that data migration project back to the top of list of projects you’ll want to take on this fall.  We’ll make it an easy one for you to check off.

Image credit: courtneyrian

What IT Really Does

Unfortunately, not many people really understand all the amazing work that goes into systems administration, network engineering, technical support, computer security, and all of the other IT related disciplines.

Businesses these days are extremely reliant on technology, and most people take for granted that they can show up at the office in the morning and their email Just Works™.  But beneath the covers there are so many little things that need to be impeccably configured in order to make everything seem simple.

And the infrastructure that keeps everything running smoothly is becoming increasingly more complex.  With each day that passes there are more platforms to support, more devices, more software, more employees, more hackers, and most importantly more data.

More data, more problems, right?

Every day we create 2.5 quintillion bytes of data that we have to process, manage, protect, backup and move. In our recent data and domain migration survey we compiled some fascinating results that we’ll be sharing very soon about how much time and effort IT pours into migrations alone.  If you’re in IT, you might not be shocked because you live it every single day, but CEOs will probably be floored.

Luckily, there are people in the business world that appreciate IT.  Some might even celebrate Systems Administrator Appreciation Day.  For the rest, well, rather than give you advice on how to explain what it is you really do, I offer a bit of comic relief. Enjoy!

 

Case Study: City of Buffalo

Located in western New York, Buffalo is the second most populous city in the state of New York (after New York City) with a population of 261,310, according to the 2010 census. Its municipal government provides network resources for the 8,000+ employees, encompassing various departments, from its emergency services including the Police and Fire Departments, to its Municipal Housing Authority.

In the words of City of Buffalo’s systems administrator for network security and communication, the challenge it faced was not dissimilar to any other organization, “We have too many windmills and not enough Don Quixote’s. As far as our network security went, we were hard on the outside and soft on the inside, and this needed to change.”

The IT team refers to City of Buffalo’s Active Directory as a ‘bit of a basement and that, since using DatAdvantage, they’ve managed to turn it around into a very effective, efficient and intuitive warehouse. He adds, “The thing with Varonis is it gives you that stand off capability but then allow you to almost instantly come in and work to a fine gradient of detail that, without the product, would take hours and hours.”

Find out how Varonis® DatAdvantage® is helping the City of Buffalo clean-up their permissions and audit access activity efficiently

Click here to see the complete case study.

 

Near-Field Authentication over Avian Carrier

I read about “chirp” the other day – a new iPhone app that lets you share pictures andChirp
links from your phone with an audible tone that sounds like—surprise—a bird chirp.

Here’s how it works:

  • You open up the chirp app on your iphone or ipad
  • You select a hyperlink, a note, or a picture that you want to share
  • The item is uploaded to chirp’s servers (somewhere in the cloud)
  • You hit the chirp button
  • Anyone else whose phone/tablet: 1) is within audible range, and 2) happens to have the chirp app open – will receive the chirp
  • If they’re online, chirp will automatically download your item for them to see
  • If they’re not online, they can download it later

Chirp starts “listening” for other chirps as soon as you open the app, so if you have a bunch of people chirping away in the same place, you should see a stream of shared items.

It seems like an easy way to share digital items with one or more nearby people, and only those that are physically nearby (as opposed to on a network together). Not that people will be sharing sensitive things necessarily, but it’s an interesting form of authentication – only phones in an audible range with the chirp app open will be able to receive the chirp.

From a functionality standpoint, there’s no need for an email distribution list, no need to pair with Bluetooth or “bump” your phones together, no GPS or cellular location awareness required.  It’s also more aesthetically pleasing and takes less coordination than a QR code.

If your phone is within “earshot”, you can share stuff.

Be careful whose chirps you choose to receive though—it’s conceivable that a chirp could deliver a link to a hijacked website that delivers malicious code to your device. Right now it looks like it’s up to you to authenticate the sender.

Musing a bit on what could come next by extending the idea…

First, a future version of the app could (conceivably) become persistent, meaning your phone might be listening for chirps all the time, and there would be a little queue of chirps waiting for you when you decided to look. Perhaps there will be an app that can merge chirps with tweets.

With a persistent chirp app, you’ll be at a party where people are taking pictures with their phones and they’ll chirp them as they take them so you can view them later without having to be their Facebook friend.

You’ll be walking down the street and stores will chirp you coupons. When everyone starts wearing Google glasses later this year your chirp feeds will fill up with localized information like advertisements, landmark descriptions, public service messages, and a million other things you probably won’t want.

Sounds noisy.

Next innovation:  make chirps inaudible to humans, and/or to people older than 20 (e.g. Stealth Tone). We won’t scare birds, we might stay a little saner, and it’s more mysterious.

If you’re a spy, or doing a scavenger hunt, when you get to your secret drop thingy or have scavenged the right area you’ll just open up chirp to get the next clue.

So next we’ll need little battery-operated chirpers that can be hidden under a park bench or placed on top of a statue somewhere. They’ll either chirp when you press a button or chirp intermittently every few minutes.

For a more practical use, what if the police need to find someone in a busy train station or airport and Eagle Eye is down? They could just chirp a photo or a description over the loud speaker—everyone in the station might aid in the search.

What’s clear is that there is still a lot of innovation going on to share content, as quickly and easily as possible, with the people you want to share it with. In a business meeting in the future, someone might just chirp you a copy of their presentation. Careful though—others might be listening.

Vote Now on the Finalists for the 2012 Varonis Data Governance Awards

In May 2012, Varonis launched its first customer awards program – the Varonis Data Governance Awards. Entry has now closed, and we are delighted with the response we received and the outstanding strength of the different entries. We have reviewed the entries and selected our shortlist.

The judging panel is made up of independent industry experts and Varonis executives who will be meeting over the coming weeks to review the shortlist and decide the winners. We also want to give visitors to our website the opportunity to have their say by casting their vote for the entries they feel most deserve success.

Vote Now!

Social Engineering in the Enterprise

Spy vs. SpyIn light of Mat Honan’s harrowing story, where both Apple and Amazon fell victim to social engineering attacks attributable to profound weaknesses in their identity verification processes, the billion dollar question becomes: how vulnerable are your company’s internal processes to social engineering?

Have you ever called the IT help desk for a password reset?  What do they ask you in order to verify your identity?  Your name and department?  Your boss’s name?  A badge number?

Hopefully Mat’s story will prompt security teams at companies of all sizes to take social engineering very seriously.

What can we do?

One highly effective tactic to help guard against social engineering is to carry out benign social engineering and phishing attacks on staff members.  Just as we learn from being burned on a hot stove, hacking staff members in a simulation may help educate them on what to look for.

Unfortunately, because we are humans, some people will be fooled at least some of the time, so we need to make sure that we minimize the risks when that happens. That’s where the principle of least privilege helps.

One example of where organizations may be vulnerable to both social engineering and an inability to ensure least privilege is in its authorization processes. IT is often in the position of granting access to data without having the required knowledge of who really should have access.

Call your help desk and tell them you’re the new Associate Head of HR and need access to payroll data and the payroll processing application.  You might just get it. And when would that inappropriate access be reviewed, caught, and revoked?

This is precisely why Varonis is emphatic about data ownership and authorization processes.   If all access requests for HR data are routed to someone in HR, the likelihood of someone mistakenly doling out excessive or flat-out wrong permissions is dramatically reduced. If HR staff regularly reviews access (even better with the assistance of automated recommendations), the likelihood of inappropriate access drops even further.

These are just some of the precautions we can take in along the path to least privilege, and better security.

As Mat stated in his follow-up post:

“As more information about us lives online in ever more locations, we have to make sure that those we entrust it with have taken the necessary steps to keep us safe. That’s not happening now. And until it does, what happened to me could happen to you.”

This also holds true for our business data both in the cloud and behind the firewall.

Photo credit: Tony Fischer

Complete our Data Migration Survey for a chance to win a 13″ Macbook Air

You know the feeling – you get a brand new, shiny, screamingly fast NAS for your data center.  Everyone’s excited to plug it in.  Then reality hits.  Now you have to plan a migration.  Buzzkill.

Every time I talk to a sysadmin or storage pro about what their biggest headache is, the answer is almost universally: migrations.  It’s like going to the dentist – we know it’s going to be painful, but we have to do it.  And it’s a routine thing.  It never ends!  We’re always buying new hardware and decommissioning old stuff, consolidating domains (due to M&A or otherwise), archiving stale data, etc.

Our bosses think it’s easy – “just move the data” they say.  But we’re going across domains, from Windows file shares to SharePoint, and we have to complete the process within 36 hours without causing a blip on the radar.  Cue Mission Impossible theme song.

Varonis is conducting a survey to learn how you’re doing migrations today, where your pain points are, and how big a problem data and domain migrations are for your organization.  The data will help us create free resources to help you in your data migration planning and execution.  Plus, you could win a new 13″ Macbook Air (which you’ll have to migrate your personal data to!).

Take the Survey!

The Definitive Guide to Cryptographic Hash Functions (Part II)

Last time I talked about how cryptographic hash functions are used to scramble passwords.  I also stressed why it is extremely important to not be able to take a hash value and work backwards to figure out the plain text input.   That was Golden Rule #1 (pre-image resistance).

But if hashes can’t be reversed, why do we always hear about passwords being cracked?  And why the heck are people always telling us to create really complex, hard-to-remember passwords?

Does Password Size Really Matter?

In Part I, you saw that both “dog” and “the eagle flies at midnight” generated MD5 hash values of the same exact length.  What’s more, the hashes are equally hard to reverse.  So what makes weak passwords weak? Answer: Brute force attacks.

Brute Force Attacks

Brute Force

Instead of reversing the hash of your password, I can simply keep trying different inputs
until I guess one that generates a hash that matches yours.  (Remember: the hashing algorithms are public). This is called a brute force attack and it can be very effective at cracking weak passwords.  (In fact, thanks to my spotty memory, I brute force my 4 digit garage door code almost every day.)

A weak password that is just 3 lowercase alpha characters (e.g., “dog”) requires a maximum of 17,576 times to generate a match.   An attacker can further reduce the number of guesses by limiting it the “guesses” to the most likely candidates, like 3 character words that exist in the dictionary (try “dog” but don’t try “fgz”).  This variation is unsurprisingly called a dictionary attack.

In contrast, if a password is 8 case-sensitive alpha-numeric characters (e.g., “d0G5Fr0g”), an attacker has to guess potentially 218,340,105,584,896 times.  No thanks!

Rainbow Tables

Generating billions of password hashes can be time-consuming and computationally expensive.  As a result, crackers sometimes use rainbow tables – gigantic, pre-computed tables of hash values for every possible combination of characters—to speed up the cracking process.

Rainbow tables take a really long time to generate, but once they’re available (e.g. at freerainbowtables.com), they can help attackers find a match for a given hash in seconds versus hours, days, or months if they have to compute all the hashes themselves.

It should be obvious by now that the more complex your password, the less likely its hash will be in a rainbow table.  Some of the most effective rainbow tables available are ones that contain hashes of common dictionary words, so never, ever use dictionary words as your password!

So, given that brute force attacks and rainbow tables exist, aren’t we all vulnerable?  Fear not, my friends.  Part III will feature a rather tasty solution (salt).

Photo credit: Jeremy Thompson

My Grandmother Uses Dropbox — Why can’t I?

My first involvement with tech occurred in the early 80s. I recall the days of modems, time division multiplexors, acoustic couplers, and dipswitches.  Most people don’t realize it, but cloud based file sharing existed in the 80s, but required an account with a major X.25 “cloud” service provider, such as Tymnet or Telenet.

At the risk of sounding nostalgic, back in the day, only people who had a keen interest in electronics (mainly, those of us under 30) were exposed to these esoteric products.  Neither my grandmother nor my mother understood technology and, frankly, I never tried to explain it to them.  It was a language that only a privileged few could understand. That has certainly changed.

Today, grandma owns an iPad, has a Twitter account, does her banking online, and knows what megapixels are. She texts, tweets, and takes pictures…lots of pictures.  She happily uses the modern cloud to post pictures on Dropbox so her niece—who is going to school for archeology in the Middle East—can see the scarf grandma is knitting her for Christmas.

So, if grandma can use Dropbox, WHY…CAN’T…I?

That’s a question that business areas are asking IT professionals on a daily basis.

In order to answer the question, we need to examine why grandma is using Dropbox.  Simply speaking – it’s easy to use.  Grandma logs in with her username and password, drags and drops her scarf photo, and voila, her niece can download and view the picture almost instantly.

Unlike previous X.25 cloud services like Tymnet and Telnet, current cloud-based file sharing services, including Dropbox, have done a fantastic job adhering to the mantra – “Simplicity as a Design Goal.”  Many other consumer-oriented services and products also have gained widespread adoption following the same blueprint – e.g., the iPod.

So, when the person who runs the HR Department comes to you and tells you that she’ll be using Dropbox to share employee information with a vendor (just as easily as she shares her family photos), what do you tell her?  And, more importantly, what alternative can you provide her for sharing sensitive information with third parties?

Here’s a list of 5 tactics you can use:

1. Explain that consumer-oriented web sites don’t provide the same level of protection as modern enterprise IT systems.

2. Explain that while protecting pictures of a scarf with a username and password may be appropriate, protecting data which contains an employee’s social security number, home address, and medical information deserve more than password protection.

3. Explain that data breaches occur on a regular basis on cloud based services and losing data can cause irreparable harm to a corporation.

4. Explain that regulatory requirements force many companies to review entitlement on an ongoing basis, to verify access by auditing data use, and to encrypt certain types of data. Most cloud-based file sharing services do not allow for these types of controls.

5. Explain that there are alternatives! Specifically, there are products that can provide similar functionality, that are easy to use, that can be used to share both employee records and pictures of a scarf, without sacrificing security.

Interestingly enough, according to a 2010 report, the fastest growth on social networking sites came from internet users 74 and older.  Enough said.  Now please excuse me while I go play Pong.

Image credit: http://en.wikipedia.org/wiki/File:Televideo925Terminal.jpg

Twitter Feed


    Follow @Varonis on Twitter