mrcrazy04

I'd say it's as embedded as the command prompt, so you should be able to block it for low privileged users without issues (assuming you don't have PowerShell login scripts or similar running as those users). I've seen it disabled in quite a few environments (it's one of the first things I go for when trying to gain elevated privileges on a system) without any problems.

Protected view stops any active content, such as macros or DDE (dynamic data exchange - embedding stuff from programs or other Office documents); with the aim of reducing the risk posed by malicious Office documents sent via email or downloaded from the internet. I'm not particularly familiar with SIMS, but would clicking "Enable Content" in Word do the trick? If there are other technologies that help mitigate the risk (such as malware scanning on web and email gateways), then it might be easier to justify disabling protected view; but whether or not the risk is acceptable is probably a question for whoever is responsible for information security.

I've seen the "sign into iTunes" prompt on both DEP and devices supervised with Apple Configurator in iOS11.0, but only with third-party apps pushed by the MDM. Apple apps worked fine on the iPhone and iPad I used; and the profile I used had the app store disabled, so I didn't test whether apps downloaded on the phone would affect it. I submitted a bug to Apple for this last week, but haven't had a response yet.

There's quite a bit of money in IT security. The main areas are penetration testing, digital forensics and incident response, as well as security research. After 4-5 years I'd say salaries of £50k plus are achievable as a techy; however it's not for everyone. With penetration testing and incident response there can be quite a lot of traveling, and digital forensics can involve viewing inappropriate images as part of investigations. Most consultancies will take you on as a trainee if you have some IT experience and can demonstrate a security mindset (i.e. thinking like a hacker). Having a play on the capture the flag websites (such as hackthissite.org) can be a good way to get some basic experience :-).

I'm a penetration tester, so can highly recommend a career in cyber security :-). Penetration testing can be lots of fun as you basically get paid to break stuff; however you can end up spending quite a lot of time away from home (some of it sat on data centre floors). I've been doing it for 5 years and still love going and breaking things, and then helping customers improve their security (I even enjoy the report writing). Most employers will put you through the CREST qualifications if you need them for your job, although it might be worth getting the CPSA qualification (it's a multiple choice exam) if you're interested in penetration testing. The OSCP course is highly regarded in the industry as well, so might be worth a look. Other areas within cyber security include digital forensics, malware analysis, incident response and security research; as well as more audit based roles, like risk management. If you're interested in the various options, this website looks to provide a good overview http://www.inspiredcareers.org

Do you also have separate accounts for IT staff to perform admin functions vs their day to day accounts? If not, that's probably one worth implementing (and it's probably worth only allowing the privileged accounts to logon to servers). I'd also suggest that it's worth doing a general audit of file permissions (PowerShell is probably easiest). Simple things to look for are permissions assigned to groups where there should be users or vice-versa; folders being shared with the wrong group, or things like permissions assigned to "Authenticated Users" or "Everyone" if that's not required. Nested groups is also worth a look, to make sure you haven't got a group that's in a group that's in a group that's in domain admins or similar. Lastly, it's worth limiting membership of the Enterprise and Schema admin groups to very few users (less than your domain admins), as they can do lots of damage (like change the rules of your AD environment.

There's some guidance from the National Cyber Security Centre on managing an incident, but it seems to be more aimed at managers - https://www.ncsc.gov.uk/guidance/10-steps-incident-management Technically, I think the main thing is to check logs for anomalies (such as a user logging in at 3am, or an interactive logon from a service account). To help this, make sure you have centralised logging of all your servers (so if one is hacked, an attacker couldn't just clear the logs). I think generally though, if you want a blow-by-blow account of what happened in such a situation, the advice is "call in the experts"; but that's likely to be pretty costly (involving digital forensics, detailed log analysis, etc.). In that case, your LA should have a supplier they can point you to :-). The Future Learn course seems to be more aimed at end users, but could be worth a look. Of course prevention is always better than cure, so rrrrr's suggestion of a pen test could also be an option. If you're most worried about internet-based attacks, a Cyber Essentials test that includes a vulnerability scan of your internet facing infrastructure could be a fairly cost-effective way of ensuring you meet the basic standard set out by the government. More information on that can be found at https://www.cyberaware.gov.uk/cyberessentials/.

I understand from a friend who had armed police attend his filming location in the middle of nowhere that it's the film maker's responsibility to ensure the police are properly informed (once the police had confirmed they were using replica firearms and stopped pointing guns at the actors I think they were quite adamant on that front)

When you say you're still paying monthly for this with insurance; does that mean you bought it on finance? If so, you may be able to go the the finance company - there's some more info at http://www.financial-ombudsman.org.uk/publications/technical_notes/goods-and-services-bought-with-credit.html

It's probably worth ensuring users don't have the ability to gain root privileges (so they can't install software or make other changes to the system setup), and ensuring any utilities that could be used for mischief (such as nmap) aren't installed (I'm sure there'd be one who'd run nmap, list some open ports and then go round bragging that he'd "hacked" the network). You could also use AppArmor to prevent applications behaving in an unwanted manner, but it can be tricky to get right.

If you're wanting a full VPN, I've found OpenVPN to be quite easy to configure (although I've always run the server on a Linux box, so am not sure how well it would work if you need to out it on a Windows box). OpenVPN uses SSL to secure the connection, and if you run it over UDP with the ta.key setup, it won't give any handshake unless users have the key file, making it pretty much undetectable. Alternatively, if your Cisco router is an ASA or similar, that should support IPSec, so you could have that act as your VPN endpoint. If that's the case I'd advocate using certificate based authentication, ideally with AD integration so certificates can be managed from the existing domain, and you could then have users authenticate with the certificate and their domain credentials.

At uni it was our student number, which was 7 digits and began with the year of entry (e.g. 1301234). Staff had a mixture of letters and numbers (it didn't seem to be related to their initials in any way), with their email addresses being j.smith for John Smith. Another system I've seen is first 3 digits of surname, followed by first 3 digits of firstname e.g. for John Smith it would be smijoh. I think the reasoning for that was that it's easier to remember than a number, but you can't accurately determine the student's name from the username.

Hi folks, I'm trying to work out a way to have centralised logging on Ubuntu 12.04 laptops that aren't always connected to the network. The research I've done suggests this rules out things like rsyslog, as events that occur when the device isn't connected won't be captured, and the Googling and forum search I've done haven't turned up any alternatives. The main concern is ensuring that security incidents are appropriately logged and can be detected by administrators. A cron job to periodically upload the log files to a central server might do the job, but ideally there would be real-time logging when the device is online to reduce the risk of log files being tampered with by an attacker, with offline logs being uploaded once the connection is restored. Does anybody know of a solution that will provide real-time logging for online devices with caching and subsequent uploading for online devices?

Thanks for that info, I assume the "Find Printers" method would still find it though, which is rather irritating!

Probably, I was asking on behalf of a colleague. I've never actually used Win7 in an AD environment, so can't be certain. If it's the one that lets you search AD for various objects (printers, users, etc), and is the equivalent of the dialog you can get on Windows XP by clicking the "Find Printer" button in the various print dialogs, then yes.

I've done a quick search and not come up with anything, so was wondering if anybody knew if it's possible to disable the "Find Users, Computers and Groups" dialog with GPO on Windows 7. If so, how is it done? Thanks.

I've been playing with DGAV on Linux Mint 9 and from the tests I've conducted discovered it's not that effective at catching drive by downloads, as ClamAV doesn't have quite a lot of the exploits in it's virus database. I'm therefore trying to get Avast! Linux Home Edition working with DansGuardian 2.10.1.1. I've created a file called "avast.conf" in /etc/dansguardian/contentscanners and modified the contents of the commandlinescan.conf file to suit, but DansGuardian fails to load with the error message: Unable to load plugin: /etc/dansguardian/contentscanners/avast.conf cs_plugin_load() returned NULL pointer with config file: /etc/dansguardian/contentscanners/avast.conf Error loading CS plugins Error parsing the dansguardian.conf file or other DansGuardian configuration files I've had a look on Google but couldn't find anything, so does anybody know what I'm doing wrong? If I comment out the line in dansguardian.conf and uncomment the clamAV line, it works fine, so I'm pretty sure the issue is with my config file. The config file is below: plugname = 'avast' # Standard lists of file types & websites not to scan exceptionvirusmimetypelist = '/etc/dansguardian/lists/contentscanners/exceptionvirusmimetypelist' exceptionvirusextensionlist = '/etc/dansguardian/lists/contentscanners/exceptionvirusextensionlist' exceptionvirussitelist = '/etc/dansguardian/lists/contentscanners/exceptionvirussitelist' exceptionvirusurllist = '/etc/dansguardian/lists/contentscanners/exceptionvirusurllist' # Program to run & initial arguments - filename for scanning will be appended progname = '/usr/bin/avast --console' # At least one of the following three options must be defined! # They are checked in the following order, with the first match determining # the scan result: # virusregexp - regular expression for extracting virus names from # the scanner's output # cleancodes - program return code(s), as a comma-separated list, for # uninfected files # infectedcodes - program return code(s), as a comma-separated list, for # infected files virusregexp = [infected by:([ -/a-zA-Z0-9\.]+)] # Which submatch of the above contains the virus name? (0 = all matched text) submatch = 1 #cleancodes = 0 # infectedcodes = 1,2,3 # Default result when none of the other options triggers a match # Valid values are "infected" and "clean" defaultresult = infected

My 16 year old sister managed to drop her Android phone in the bath not long after getting it. I also lent the family my old laptop and after a few weeks it's missing the Z key, caused by my sister! So I agree with the teenage clumsiness factor - however my 15 year old brother seems to be pretty good at keeping his gadgets in working condition.

It was like that when I was at school in Bedfordshire. I think most kids in Dundee could walk to their local school, however Dundee City council have announced they're all closed today. Yesterday the bus company stopped running all buses at 5pm due to the weather, and aren't running some services at all today. The announcement regarding the buses in my area not running to the terminus is sufficiently vague for me to be unable to work out where they're running, and so whether it's practical to walk there or not.

Officially my uni are open, however quite a few of the lecturers aren't going in. I've looked at the road and it's pretty treacherous, even though it's a gritted route. The bus company have decided it's impassable, and I saw a couple of cars having to be dug out after getting stuck when I went to the shops. This is how it looked at about 8 o'clock this morning. And here's one of the buses before the bus company decided it was impassable, it took about 3 minutes to travel along the road about 2 houses.

My housemate is currently hoping it will rain, so he can keep using his motorbike. The gritted road is no longer clear, however the buses do still seem to be running. Here is a photo of the (gritted) road outside my house a little earlier, and a photo of the pavement tractor I took last year.

Here in Dundee they grit in advance, and sometimes several times. They also have little tractors with snow ploughs on the front they use to clear and grit the pavements. I guess that's one of the benefits of living where snow and ice are guaranteed. It's currently snowing reasonably heavily, and the roads are remaining clear. Back home in the south of England it's a different story though, only one road in the village gets gritted, meaning the bus can have some difficulties on it's route (watching a double decker bus slide was funny until it was rather close!).

I believe there is some hardware that allows a sky card to be used to gain access to any subscriptions you have. However I'm not sure if it would work with the new incarnation of the sky card as they've just replaced them.

I think for new people signing up it's all run by Student Finance England - which I think is better as otherwise the LEA and Student Finance England will blame each other for problems without fully investigating. I'm stuck with it being half LEA and half Student Finance England though (So far the LEA have lost one signed form I returned and last year didn't pay me anything until about 2 weeks into the term, after I got my MP involved.)

I've realised I left one of the computers on at my university residence, and am on my way home for Easter. I've figured I can upload an ASP page in order to run shutdown.exe, but in order to do that I need administrative privileges. Does anyone know a simple way to impersonate an account in ASP, I'm sure I recall seeing a WSH or similar object to facilitate it, but can't remember where I saw it, and can't find anything on the net.