Tag Archives: information

Perdemia's Permission Analyzer: How to get an overview of access rights

Perdemia has released Permission Analyzer 2.1, a Windows application that lets network administrators manage NTFS permissions. The software eliminates the mystery – and the dangers – of adding permissions that allow contractors and users to access the proper data stores.

Recent news stories about Hillary Clinton’s email server and the breach of the Pentagon’s servers might lead network managers to believe that most security threats are external. Security experts tell us, however, that most data breaches happen because of activity within an organization. Permission Analyzer 2.1 provides the tools that business people need to keep their servers safe and secure. By running Permission Analyzer 2.1 regularly, the management team can effectively control employee access to company data.

Unlike other programs that help manage permissions on a network, Permission Analyzer 2.1 scans an entire network and builds a database that can then be used by network administrators, chief information officers (CIOs), systems auditors, or any authorized employees who need to manage the network. Multiple users can use the database to perform queries and to show results in seconds, without scanning the network for every overview that is being built by a user. This design eliminates unnecessary network traffic, and dramatically reduces network load.

Permission Analyzer 2.1 can scan an entire network, or focus on specific computers and directories. You can even analyze nested group information by selecting LDAP organizational units to scan. Once the database has been updated with the current information, users can run reports or query the database by creating filters that include or exclude members, permissions, files, or folders.

A unique feature of Permission Analyzer 2.1’s design is its ability to work with all of the members from an Active Directory group or Organizational Unit. With competitors’ software, if a user wants to ensure that nobody in the Consultants group had access to the Personnel Department’s folder, it would be necessary to inspect every member in the Consultants group individually. With Permission Analyzer 2.1, the user could use a single query to ensure that no members of the Consultants group has access to the Personnel information. In just a few minutes, network administrators could ensure that only the proper people have access to personnel folders, the legal department’s confidential information, top management’s planning directories, and other sensitive data.

It is easy to save selections of filters, exports, and policies and run them automatically using Windows Scheduler. Many network administrators, for example, schedule a daily network scan as well as HTML/CSV exports and policies that will send an email notification when unwanted permissions are found.

The software lets you drill down into the database and trace the origin of any group of permissions. Unusual permissions could be inherited from a direct or indirect group membership or from a parent folder. Or such permissions may be indicators of a security breach.

Permission Analyzer 2.1’s internal database can support the largest networks that an enterprise might run. In addition, the Enterprise and Consultant Editions of the software work with Oracle, DB2, MS SQL, MySQL, and other popular databases.

Whether you’re a network administrator who needs to manage NTFS permissions, a security officer who needs to be sure that every employee and consultant has the proper access and permissions, or a line manager who wants to streamline and automate permissions information, Permission Analyzer 2.1 has the tools that you need.

Permission Analyzer 2.1 runs under Windows Vista or higher. Prices for the Basic Edition begin at $299(US), with affordable Standard, Enterprise, and Consultant Editions available. A trial version is available online, as well as time-limited versions of each of the Permission Analyzer 2.1 editions

Perdemia's Permission Analyzer: How to get an overview of access rights

Perdemia has released Permission Analyzer 2.1, a Windows application that lets network administrators manage NTFS permissions. The software eliminates the mystery – and the dangers – of adding permissions that allow contractors and users to access the proper data stores.

Recent news stories about Hillary Clinton’s email server and the breach of the Pentagon’s servers might lead network managers to believe that most security threats are external. Security experts tell us, however, that most data breaches happen because of activity within an organization. Permission Analyzer 2.1 provides the tools that business people need to keep their servers safe and secure. By running Permission Analyzer 2.1 regularly, the management team can effectively control employee access to company data.

Unlike other programs that help manage permissions on a network, Permission Analyzer 2.1 scans an entire network and builds a database that can then be used by network administrators, chief information officers (CIOs), systems auditors, or any authorized employees who need to manage the network. Multiple users can use the database to perform queries and to show results in seconds, without scanning the network for every overview that is being built by a user. This design eliminates unnecessary network traffic, and dramatically reduces network load.

Permission Analyzer 2.1 can scan an entire network, or focus on specific computers and directories. You can even analyze nested group information by selecting LDAP organizational units to scan. Once the database has been updated with the current information, users can run reports or query the database by creating filters that include or exclude members, permissions, files, or folders.

A unique feature of Permission Analyzer 2.1’s design is its ability to work with all of the members from an Active Directory group or Organizational Unit. With competitors’ software, if a user wants to ensure that nobody in the Consultants group had access to the Personnel Department’s folder, it would be necessary to inspect every member in the Consultants group individually. With Permission Analyzer 2.1, the user could use a single query to ensure that no members of the Consultants group has access to the Personnel information. In just a few minutes, network administrators could ensure that only the proper people have access to personnel folders, the legal department’s confidential information, top management’s planning directories, and other sensitive data.

It is easy to save selections of filters, exports, and policies and run them automatically using Windows Scheduler. Many network administrators, for example, schedule a daily network scan as well as HTML/CSV exports and policies that will send an email notification when unwanted permissions are found.

The software lets you drill down into the database and trace the origin of any group of permissions. Unusual permissions could be inherited from a direct or indirect group membership or from a parent folder. Or such permissions may be indicators of a security breach.

Permission Analyzer 2.1’s internal database can support the largest networks that an enterprise might run. In addition, the Enterprise and Consultant Editions of the software work with Oracle, DB2, MS SQL, MySQL, and other popular databases.

Whether you’re a network administrator who needs to manage NTFS permissions, a security officer who needs to be sure that every employee and consultant has the proper access and permissions, or a line manager who wants to streamline and automate permissions information, Permission Analyzer 2.1 has the tools that you need.

Permission Analyzer 2.1 runs under Windows Vista or higher. Prices for the Basic Edition begin at $299(US), with affordable Standard, Enterprise, and Consultant Editions available. A trial version is available online, as well as time-limited versions of each of the Permission Analyzer 2.1 editions

5 Website Security Issues You Should Be Aware Of?

Technology has become more advanced, and with it, hack attacks in the online world are increasing at an alarming rate.

Hackers use known vulnerabilities in third-party softwares to target your website and web server, and use it for their advantage.

The effect of this maybe just defacing of your website, stealing your confidential client data, or even worse, use your server resources to perform illegal activities.

There are some simple tips you can leverage to strengthen your website software and sleep with peace of mind.

  1. XSS or Cross Site Scripting
  2. XSS occurs when a hacker embeds scripting code into a web form or url, and run malicious code to change your web visitor’s experience and steal passwords or other data.

    XSS can also be persistent nature, where an attacker can manipulate a specific web page and show it as a login screen to users. The recent XSS comment hack on WordPress 4.2 is an example of such permanent loophole.

  3. SQL Injection
  4. SQL injection occurs when a hacker uses a web form field or URL parameter to manipulate your database. Almost all web platforms have a database and generally open source CMS platforms maintain dynamic aspects of the website in database.

  5. DoS or Denial of Service Attack
  6. Denial of Service (DoS) or Distributed Denial of Service (DDos) attacks are by far the most notorious kinds of attacks.

    That is because, any level of hacker with a small investment can bombard a victim website, with millions of requests, and make them look like they are legit users.

    This eventually crashes the web server, and makes the site offline, requiring manual intervention to bring it back online.

  7. Weak Passwords
  8. We should all use complex passwords, because the weakest link is all it takes to break the chain. It is imperative to use strong passwords for admin areas, but equally important for all users to protect the security of their accounts.

    One account compromised can lead to another and that could lead to admin account hacked. It is recommended to have passwords with minimum 8 letters, digits and special characters to avoid quick password guesses.

  9. Brute-force Attack
  10. These attacks are trial-n-error methods to guess your username and password. Weak passwords are prone to getting hacked easily.

    Methods like temporary blocking of IP and accounts, and multi-factor authentication, help mitigating such attacks.

  11. Code Injection
  12. Websites with file upload capability, or sites missing proper client and server side form validation, can be dangerous.

    The risk is that any file uploaded, could contain a script which can be leveraged as root-kit ie. administrator access to your website.

    Lack of form validation on simple form fields could lead to malicious code being inserted into the database, and could cause undesirable results in your website.

  13. Unencrypted Protocol
  14. An unencrypted channel allows man-in-middle attack to steal information from your users.

    It preferred to use security certificate SSL, whenever passing personal information between the website and web server or database.

  15. Debug Mode on Production Server
  16. Some developers may accidentally enable debug mode on the live production server, which dumps extensive error logs to the browser.

    Thus a hacker can obtain valuable information about the softwares used by the webserver and target his attack much better. Its crucial to hide as much internal information about server to minimize and delay the attacks.

  17. Old Software Versions
  18. It may seem obvious, but ensuring you keep all software up to date is vital in keeping your site secure. This applies to both the server operating system and any software you may be running on your website such as a CMS or forum.

    When website security holes are found in software, hackers are quick to abuse them.

  19. No Backup Plan
  20. No matter how much vigilant you are, attackers can find new loopholes to doom your website. So besides prevention, you should also have a backup-restore plan.

    Just in case your site is compromised, you should have a team which can quickly restore the last known backup, and avoid reputation and sales loss.

    Coversine provides a simple affordable solution to all these problems. Your own security professional who will maintain your site’s uptime, performance and security, all-in-one for as low as $10 per month.

    The subscription takes care of performance checks, and regular updates to softwares and apps as well.