A Security ALERT from our Partner, Bomgar...

Thoughts on Symantec’s “Disable pcAnywhere” News

Over the last 24 hours, the marketplace has been astir with the news of Symantec officially recommending that their customers disable pcAnywhere for all but the most mission-critical applications. For many this is the first time they have considered that the remote control technology they are using could be a backdoor for hackers. What they likely don’t realize is that long before the Symantec breach, legacy remote control applications like pcAnywhere were ALREADY the #1 way hackers compromised networks. According to the 2011 Global Security Report from Trustwave SpiderLabs:

“In 63% of our investigations in which a method of entry could be determined, the attacker simply leveraged an available remote access application.”

That finding is echoed by the 2011 Data Breach Investigations Report by the Verizon Business RISK Team. Their report states:

“Remote access and desktop services are once again at the #1 spot in the list of attack pathways. A whopping 71% of all attacks in the hacking category were conducted through this vector.”

The Verizon report even specifically calls out pcAnywhere by name (along with Microsoft’s RDP) as the primary products implicated in these breaches. The calls to replace legacy remote control technology with the next generation didn’t just start in 2010 or 2011 either. In 2009, Gartner released a report titled “PC Remote Control Security: Risks & Recommendations.” The report very clearly states that legacy remote control products can have serious security issues. On top of all the security issues, the report additionally says:

“Legacy remote control tools are incapable of supporting increasingly complex environments, and companies must find new ways to provide support services to users.” 

Remote access has become an indispensable tool to a majority of companies, with the ability to increase productivity and savings in incredible ways. The question is not whether to support users and systems remotely, but how to do it correctly and securely. So what is the right way to do remote support? It really comes down to four things:

• Architecture – The product needs to be centrally administered and managed with the data in the control and oversight of the company using the technology.
• Authentication – It should integrate with Active Directory, LDAP, RADIUS, Kerberos, and other authentication mechanisms including multi-factor authentication. This eliminates the problem of everyone in IT “knowing the password” and inevitably sharing it and storing it where they should not. It also eliminates the possibility that a former employee would still have access.
• Access Controls – Very granular access should be possible around what exactly you can and can’t do with the product. Granular permissions can ensure that individuals don’t have more access than they need and are only allowed to do certain things on certain systems.
• Audit – Full session logs and even full video recordings of each session should be captured, stored, and available. The company should be able to produce reports at any moment on (1) who connected to whom, (2) what systems and IP addresses they used, and (3) what they did (including full audit trail and video recording of session).

With these considerations in mind and armed with the products that support them, IT will be able to do their job without their tools inadvertently opening up the #1 attack pathway into the enterprise. 

Posted by Joel Bomgar on Jan 26, 2012 10:24 AM CST http://community.bomgar.com/blogs/4/140

Automated Provisioning & Profile Maintenance – Third Party Access

Recently I had the opportunity to work with a couple other Fruition developers to deliver a custom Third Party Access Portal, also known as 3PA, to help an international beverage company’s third party users (e.g. customers, bottlers) effectively request and sustain access to key applications.  The 3PA portal was to replace their current solution that was not only over extended to far more 3^rd parties than originally intended, but was associated with user dissatisfaction, increased support cost, and unfavorable company perception. 

One of the main objectives of the project was to enhance the user experience through a simplified user interface.  Third party users can utilize this portal to manage their user profile, request access to applications, and manage their password.  Even though the portal is aimed for external users with the goal to “make their company easier to do business with,” internal employees can also use the interface to invite new or existing users to applications, view access reports, and manage access requests.

Click to read more ...

Fruition's Bomgar ServiceNow Integration: Explained by Senior Developer, Shane Brazeal

Scenario 1: Start Bomgar Session from ServiceNow

In this scenario a service desk representative is taking a call with an end user and submitting an incident on their behalf.  At some point the service desk rep decides to start a remote support session using Bomgar from the submitted ServiceNow incident record.

 

Click to read more ...

ServiceNow + Bomgar = Increased Service Desk Efficiency

As you may have seen, last week Bomgar and Fruition Partners announced a new integration between Bomgar’s remote support solution and SaaS for IT service management from ServiceNow! Instead of listing the features and benefits, we had a Q&A session with Boatner Blankenstein, director of solutions engineering Bomgar, and Shane Brazeal, developer, Fruition Partners, about the new integration.

Click to read more ...

ITSM Implementation Tip Series: #1 : Ok We’re Making Good Progress on Incident Problem and Change, What Next?

For most organizations the first ITSM processes they tackle are the classic Incident, Problem and Change Management (IPC) processes. Before I discuss what to do next let’s make sure we’re all on the same page on progress to date.Holistic enterprise frameworks such as ITIL which provide guidance on ITSM depend heavily on the concept of process integration to realize the full value and business benefits from a service management approach. Process integration is reached when more than one mature process shares inputs, tasks, outputs and data with another mature process. In the ITSM business there are various maturity rating schemes, typically based on the Software Engineering Institute’s (SEI) original Capability Maturity Model (CMM) and have been adapted using specific maturity characteristics for each ITIL process. More recently, SEI ‘s own adaptation CMMI is also being used.

Click to read more ...