Frictionless Email Security: The Solution to Onboarding Email Security

In the race to stay ahead of the latest cybersecurity threats, email security is more important than ever. However, traditional methods of onboarding email security solutions have been slow and costly, preventing many businesses from implementing these vital protections. CyberCision from FirstWave changes all that with Frictionless Email Security. This innovative new approach removes the barriers to onboarding email security, making it easier and faster for service providers and telcos to add these essential protections to their customers’ networks. With Frictionless Email Security, you can be confident that your business is protected from the latest threats!

Email is one of the most important communications tools for businesses, so it’s essential to have a secure platform in place. However, onboarding customers to an email security platform can be time-consuming and fraught with potential for human error. In the past, service providers have had to dedicate significant amounts of time, often after hours, from senior technical staff to make manual changes to DNS and MX records. Even with the best intentions, there’s always the chance that something will go wrong.
Between the finite ‘change windows’ available after hours for service providers to lean on their senior staff before burning them out, and the additional cost this incurs and will almost certainly need to be passed onto their customers, traditional email security onboard is full of barriers.

That’s where FirstWave’s Frictionless Email Security comes into its own. With automated activation, not beholden to manual DNS and MX record changes, as well as API integrations to enable the ability to deploy at scale, FirstWave empowers service providers and telcos to deploy world-class email security to their customers with ease.

Finally, service providers and telcos can onboard email security customers at scale, at speed, and with minimal effort, opening new channels to market.

Uncategorized

Finding Devices With Custom Queries in Open-AudIT

When considering what a typical network is and what is monitored in it, a few devices usually come to mind; Switches, Routers, HUBs, etc. With the advent of the Internet of Things (IoT) the variety of monitored devices is increasing even further, adding IoT devices such as thermostats along with the devices that regulate them (Microcontrollers, Single-Board-Computers, etc.). 

Without having inventory management software, it becomes challenging to keep track of where and what devices are on your network. Opmantek’s Open-AudIT software not only provides in-depth network auditing; it is also easy to create custom queries with this information. These queries allow you to find and organize devices in whatever manner you or your team find best.

Open-AudIT used as a configuration management database system (one of its many uses) ships with 33 pre-built queries to assist in finding and organizing devices. These queries range from what memory and processors are used, what software is currently installed, to what IP addresses are consumed on the network. 

Understanding that no two networks or organizations are alike, there is a need to have the ability to customize queries to fit your team’s needs. Open-AudIT accomplishes this through the use of Custom Queries. A query is essentially a SQL statement that runs against the database to only display the requested filtered items the user has permission to view. 

A query can be created in Open-AudIT by navigating to the menu -> Manage -> Queries -> Create Queries. 

The SQL query can be broken into three parts:

1. The SELECT statement is used to select the data from a database.

The SELECT section of the query should use full dot notation and also request the field with its full dot name. For example;

SELECT system.id AS `system.id`,

system.name AS `system.name`,

`system.os_name` AS `system.os_name`

This would cause the query to display the system id’s, system name, and operating system.

2.The FROM clause lists the tables, and any joins required for the SQL statement.

The FROM clause will decide what database you are getting these specific system id’s and should only contain the tables with the attributes you need.

For example – FROM system specifies which table the system.id and system.name is coming from.

3. The WHERE clause extracts only those records that fulfil a specified condition. For Open-AudIT to apply user permissions on items, we mandate the use of the WHERE @filter. If you do not use this format, the query::create form will show a warning.

Only users with the Admin role are permitted to create queries that lack this attribute. Continuing using our earlier examples we can add the clause WHERE @filter AND system.type = ‘computer’.  Specifying the type to equal computer will only display devices that are computers quickly allowing you to filter out all other irrelevant devices. The query has now reached its final form:


SELECT system.id AS `system.id`,
system.name AS `system.name`,
system.os_name AS `system.os_name`
FROM system
WHERE @filter
AND system.type = ‘computer’


This will result in displaying only the system names, id’s, and operating systems of devices that are the system type of computer.

NOTE – You are free to select any attributes desired when creating your custom query. To further help in creating queries it is a good idea to use the menu -> Admin -> Database -> List Tables to view the specific table structure. This provides a valuable resource for finding the attributes necessary when creating any custom query.

Open-AudIT grants you the ability to scan your entire network for devices and organize them in ways that make sense for your team. Inventory management is a breeze with the ability to find, filter, and group any device using custom queries. The growing number of different devices added to networks makes having tools like Open-AudIT in your kit more valuable than ever.

For more information on FirstWave’s Open-AudIT, other FirstWave solutions, or to schedule a demonstration, please visit our website at www.firstwave.com. You can also email us at contact@firstwave.com.

FirstWave Extends and Expands Contract With Telstra

FirstWave Cloud Technology Limited  (ASX: FCT) (FirstWave), the global cybersecurity technology company, announces the extension and expansion of its contract with key customer Telstra, Australia’s largest telecommunications company.

The contract has been extended for an additional two years with a further two-year option, and the scope has been expanded to include additional cybersecurity services provided through FirstWave’s CyberCision platform.

In FY21 approximately $6.5m revenue was generated from the Telstra agreement with over 95% being recurring revenues.

FirstWave CEO Danny Maher said ”We are pleased to deepen our longstanding relationship with Telstra, our largest customer. The expanded scope of our extended contract reflects Telstra’s increased focus on its cybersecurity offerings and confidence in FirstWave’s capabilities to provide its customers with best-in-class cybersecurity technology.”

Telstra CEO, Andy Penn recently noted the significant increase in malicious cyber activity Telstra has seen across its networks and the deteriorating threat environment being faced by its customers. We look forward to protecting more Telstra customers from cyberattacks and growing our revenues together with Telstra through the wider implementation of our CyberCision platform.

In addition to the extended agreement, FirstWave and Telstra have commenced a collaborative marketing campaign to strengthen the marketing and sales of the contracted products through Telstra’s sales teams and channels. The joint effort, led by FirstWave Chief Marketing Officer Ehsan Jahandarpour, is expected to deliver an enhanced customer experience for Telstra customers and increase revenues for both companies.

Following its recent restructure driven by the acquisition of Opmantek, FirstWave is prioritising Telstra as a key account and is focused on improving its sales enablement process with key account management to open significant new revenue streams.

Download the FirstWave ASX announcement here

 

Supplementary notice – Telstra Contract Renewal FirstWave Cloud Technology Limited (ASX: FCT)

(FirstWave), the global cybersecurity technology company wishes to provide further information about its extended and expanded contract with key customer Telstra.

Telstra has been a key client for FirstWave throughout FirstWave’s history. Revenues from the contract comprise of recurring fees to FirstWave from Telstra for administrative, support and infrastructure services of around $2m per annum with the remaining revenues being derived on a per-user fee for licensing and support from Telstra’s resale of FirstWave’s security services to Telstra’s end customers.

Telstra’s end customer contracts vary in length from one to five years and hence in some instances are longer than the current FirstWave / Telstra agreement. These contracts would survive termination generating future revenue and requiring continuing licensing and support even if the Telstra agreement was not renewed in the future and these contracts were still current.

Under the terms of the reseller agreement with Telstra, FirstWave retains exclusive rights to FirstWave’s intellectual property. This contract renewal also provided an opportunity to define and agree to additional new security products and services aligned with Telstra’s security product growth strategy.

Download the FirstWave ASX announcement here

Uncategorized

Using Configuration Management to Detect Unwanted Software

The Log4j vulnerability is the latest cyber exploit, bringing a CVSS critical score of 10. It allows attackers to execute arbitrary Java code on remote computers, including accessing sensitive information.

Only a year since the world addressed the SolarWinds supply chain attack, it’s another  confirmation that network professionals must adopt long-term risk-management strategies.

Are Opmantek products affected? Opmantek does not release software written in Java or Log4J, nor do the projects we depend on directly utilize Java or Log4J. 

Leverage Configuration Data to Identify Risk

It can be difficult to identify if Log4j is being used, as it’s often bundled with other software. A configuration management system provides means to audit a resource configuration and inventory elements against a defined security policy.

Gather Configuration Data

Get data into the system through integration or direct collection

Extract Operational Information

Process the data to extract information about change and compliance

Gather Configuration Data

Get data into the system through integration or direct collection

Detecting Log4j on a Server with opConfig

Like any organization, our internal teams use a variety of third party software. In the case of the Log4J vulnerability, we needed to confirm if the library was installed on our servers, patch it, and ensure it wouldn’t then be installed in future.

Between our product, development and test servers we had about 50 Linux servers to check, so we needed to find a quick, automated solution.

Detection

Unfortunately, the software does not use a Linux package manager, so we can not use RPM and APT commands.  There is a simple way to verify if the software was installed, look in / (root directory and all child directories) to see if there were any files containing the name log4j.

The Linux command we needed was:

  • sudo find / -name “*log4j*”

We wanted to run this command quickly and easily on 50 Linux servers.  A new command set was needed which we called “Linux_Log4j”. We created a new command set file for this and similar things called “Linux_Software_Installed.nmis”.

Linux_Software_Installed Command Set

Command sets in opConfig are stored in /usr/local/omk/conf/command_sets.d by default.  We copied an existing one and edited it to make it reflect what we needed. ​​This change could also be made in the GUI, editing an existing command set and adding a new command collection.  Most importantly, this needed to have os_info matching Linux only and we needed to change the two commands. In the most recent version of opConfig for NMIS9 these files are JSON.

To understand the contents it is quite straightforward, os_info means only run these commands when these os_info conditions are met.  Each of the command sections are simple and the tagging system is powerful:

  • privileged: means does this require elevated privileges to run, e.g. sudo access
  • command: the command you want to run, which is also how the data is saved into the system
  • exec: optional if you want to save the command as some other name, use the exec as the command which is actually executed and the command item will be the name of the command to run.
  • tags: HOURLY means this will automatically run every hour, Linux and operations are handy for finding the command, detect-change and report-change means that opConfig will monitor this command output for change and if a change is found raise an event.

Linux_Software_Installed.json

The final command set looks like this:

{

“Linux_Log4j” : {

“commands” : [

{

“privileged” : “true”,

“command” : “Log4jSearch”,

“exec” : “sudo find / -name \”*log4j*\””,

“tags” : [

“HOURLY”,

“Linux”,

“operations”,

“detect-change”,

“report-change”

]

}

],

“scheduling_info” : {

“run_commands_on_separate_connection” : “false”

},

“os_info” : {

“os” : “/(Linux|CentOS|Ubuntu)/”

}

}

}

Running the Command Set

Because it is tagged with “HOURLY” the command set will run automatically every hour.  If you want to run it manually for testing, you run the following command:

sudo /usr/local/omk/bin/opconfig-cli.pl quiet=1 nodes=NODE-TO-TEST-WITH act=run_command_sets tags=HOURLY debug=true

Check for any errors, if all good, run manually for all nodes or wait an hour or so.

You may need to increase the timeout if you see the console lines as below.

[2021-12-22 03:58:48.21513] [23682] [warn] failed to make session privileged: read timed-out

[2021-12-22 03:58:48.21573] [23682] [warn] Failed to run command Log4jSearch: Could not make session privileged: read timed-out

[2021-12-22 03:58:48.21587] [23682] [warn] Command timed out – partial response was: “”

The /usr/local/omk/conf/opCommon.json file can be edited and the value for opconfig_command_timeout increased to a suitable number of seconds.

Running as Non-Privileged

You may not have (or want to use) the privileged user (using sudo). In this case, a more suitable exec string is below (and remember to set “privileged”: “false”).

“exec” : “find / -name \”*log4j*\” 2>/dev/null”,

Diagnose

Now we can go to the opConfig GUI and find the matching nodes.

Access the Commands Overview

From the opConfig menu, select “Views → Recent Commands” and you should see a screen which looks like below.

First we can see how many instances of “Log4jSearch” we have collected.In the box enter “Log4jSearch” change the select to “Command” and click “Go”. You will have a list of nodes and the command name.

Next, click on the “Advanced” button on the right.

Click on the Node Name to see the command output.

Here we can see this node has some possible files of concern.

Remediation

In this case remediation requires one of the operations team to install updated versions of Log4j or the packages from vendors using it. The Opmantek development team use Vagrant to automate this kind of activity and the issue was quickly resolved.

Conclusion

Using the Operational Process Automation methodology of detect, diagnose and act, Opmantek was able to identify which of our servers required change within 15 minutes.

Ready to see what opConfig can do for your organization?

Get in touch to speak with a network engineer. We’re a technically led team, so prepare for a conversation about solutions, not sales.

Or, get started straight away with a time-unlimited 20 node license.

Uncategorized

How to Stabilise & Audit Using Network Configuration And Compliance Monitoring

What is Network Configuration and Compliance Monitoring

Network Configuration and Compliance Monitoring (or NCCM) is a system that works closely with all devices in a set network, transmitting and receiving data from a wide range of devices to ensure that everything is acting in a compliant manner. In addition to this, NCCM can ensure that your devices are configured correctly, and in the case that they are not, can schedule reconfigurations at a time that is convenient to the user.

Automating NCCM processes is often required because companies often have thousands of devices that cannot be handled manually, making the entire process far simpler and more accurate through automation. One example of an NCCM is Opmantek’s “NMIS”, a network management system designed to offer comprehensive information to network engineers to assist in the diagnosis and resolution of network problems.

Change detection and rectification

When dealing with a device configuration, there are relatively few commands that you need to be aware of to know exactly how it is set up. In theory, by remembering these and applying them to a new device, it should act identically to the previous one. When these configurations change and nobody is informed, however, it can become incredibly difficult to replace the device should it become faulty.

By implementing effective change detection, which discovers any configuration adjustments in a device, you can stay on top of all of your device configurations and replace them with ease. Additionally, you can receive alerts to let you know of every configuration change, and how many times the configuration has changed. This change detection can be used with products such as “opConfig”, which processes and records configuration changes across entire networks.

Device configuration changes

The configuration backups are all saved without restriction, so reverting to any previous configuration is incredibly simple. Your NCCM can keep hourly backups of your configuration settings, allowing you to revert a previous device, router or switch to a previous version when the device was working as intended. This will either resolve the issue or inform you that the issue is likely with the hardware in use (in which case you can simply install new hardware with the successful configuration in place).

Servers and network scanning

In addition to tracking the configuration of your devices, it’s also possible to use an NCCM as a performance tracking tool. By performing automated network management, the system is also taking in significant amounts of data, including the levels of packet loss within servers over a set period of time. This can help you in an audit to establish whether the performance of a particular server is degrading. If the performance declines, you can compare this data with configuration changes to ensure that your network is using the optimal settings, and resolve the issue without having to go through a more thorough investigation of your network. The data is already collected and ready to be analysed.

Try Opmantek’s products

If you’re interested in Opmantek’s range of products and would like to learn more, listen to Packet Pushers’ episode with Keith Sinclair, or contact us today. We are proud to offer effective solutions to IT departments, providing meaningful and actionable data to assist in the troubleshooting process.

Uncategorized

How SMEs Can Manage Their Network Faults Using Event Actions

Fault management is the process of detecting, analysing and responding to faults in a system. It is an essential part of any IT infrastructure because it helps maintain availability and quality of service for applications.

Event actions, inside opEvents, provides your organisation with fault management visibility at the time of the event, while proactively remediating events, before they become major faults. Its ability to provide early warning detection of potential problems is more than an asset to businesses. By identifying potential hazards before they happen, signifying steps that need to be addressed or escalated before they become significant is highly desirable. You’ll be able to always see happening on your network, including; when events occur on a network, what events occur before faults, what steps were taken to remedy the faults. The combination of these factors will allow you to automatically close events and stop them from escalating to future faults.

This performance management tool will help you save time, money, resources and reputation when dealing with unexpected situations that may arise and allow you to better plan for IT emergencies.

Why Fault Tool Management is so important

The Fault Configuration Accounting Performance Security (FCAPS) framework for managing information security was developed by the National Institute of Standards and Technology (NIST) to provide a structured approach to Network Management.

It provides an overview of the capabilities required to manage networks effectively, and the F in FCAPS stands for Fault Management, including monitoring, detection and diagnosis.

This framework aims to improve the quality of service that users receive from their networks while also reducing costs associated with faults, outages, and maintenance.

How is your network performing?

FirstWave’s opEvents platform provides an automated network management solution for IT events and faults, making it easy for SMEs to monitor their networks with minimal effort. With our software, you can identify where problems are happening in real-time; without affecting your business operations and customer experience.

We offer an integrated suite of products that can be tailored to meet any business’ needs, from small and medium-sized enterprises (SME) up to large corporations. In addition, our solutions are designed to provide maximum visibility into your networks so you can identify and resolve problems before they cause downtime or financial loss.

Network management system’s like NMIS (Network Management Information System) will send fault and performance events. Increasing the breadth and depth of event management, FirstWave senior engineer Mark Henry explains this in our recent webinar ‘opEvents: All about Event Actions’.

“NMIS has a foundation escalation system that handles events singularly, however by employing opEvents you have the ability of automated event correlation”.

You can install opEvents easily as a standalone product at our downloads page, or it is available as part of our FirstWave virtual appliance package.

Why log analysis tools are essential for all businesses

Pro-consumer cyber security and privacy comparison website Comparitech has ranked opEvents in its list of 12 Best Log Analysis Tools, stating that it ranks highly because: “This centralised log and event manager reduces the impact of network faults and failures using proactive event management.”

In the article, Comparitech network administration expert Tim Keary wrote that: “Poor performance can emerge unexpectedly at any time. Network monitoring platforms like log analysis tools allow you to spot performance issues before they arise.”

Keary outlined that strong log analysers like opEvents provided users with data they wouldn’t otherwise have that included:

  • The ability to quantify the number of log messages that arrive in a given period by using statistics to understand and improve performance-related issues and optimise security measures.
  • Filtering and sorting tools that are capable of identifying and separating sources and events.
  • Correlation systems enable log messages generated in different formats to be analysed together to make sense of fragmented data.
  • A system of highlighting to make patterns in data more accessible to identify visually.
  • The ability to interpret a wide range of raw data and then present it to you through charts that make sense.

Here at FirstWave, we have seen many IT departments transformed by implementing our suite of tools to automate network Fault Management. To start making decisions through meaningful and actionable data to automatically troubleshoot your events book a demo today.

Uncategorized