AzureAD and shares
-
@Dashrender said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@Dashrender said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
The more OSS you have, the lower your score will be.
Then it's an anti-audit. I mean it's that easy. If they are specifically penalizing security, that literally makes these guys social engineers / hackers. Instantly, you have a requirement to ban them from the company. Financial regulations actually makes that criminal.
Not to derail this thread, but I deal with this every year. These auditors come in and HAVE to find something "wrong" even though what they find are not actual problems. It just justifies the money spent for the audit. I know there are others on here who deal with these auditors. They know exactly how bad it is.
Right, so you have a criminal activity going on for personal gain. The bank needs to understand that the auditors are being paid to put them at risk, because that's how they get compensated. Doesn't change that it's illegal.
This is clearly totally the wrong mind set for both the auditors and the audited. If anything both should be hoping that they don't find anything.
Auditors do what they are paid to do. If they are paid only to scam people, they will scam them. Only those being audited forcing that to happen can be at fault in a free market.
We don't have a free market - not when you are required to have audits, and often required to have audits by a special list of auditors.
It's a free market here given the case of the auditor selling a fake issue to convince them that it is valuable . That doesn't exist when required.
-
@brandon220 said in AzureAD and shares:
@Dashrender said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
My best option IMO is to spin up 3 new VMs - 2 AD/DNS and 1 file server.
Where are you planning on hosting this? I have to assume you don't mean to buy two servers, and setup AD/DNS on each of them, plus then setup a file server on one of them as well? That would be hardware overkill for something like this.
So assuming you did go with a single server - then you're down to two VMs - 1 AD/DNS and 1 file server.Another option would be 1 NAS, and simply map it to everyone's computer.
You mentioned managing local user accounts - do users move around and use other people's computers? or are they mainly only on their own? If they are mostly single use, a NAS is likely the best option. You'll build the users on the NAS and be done with it.
Nothing has to be purchased as there are 2 Hyper-V hosts running and are less than 6 months old.
Users only use 1 machine each. No roaming.Why? And they have spare Windows licensing, too?
-
@Dashrender One has 2 Server 2019 VMs running databases and the other has 3 Fedora30 VMs.
-
@brandon220 said in AzureAD and shares:
@Dashrender One has 2 Server 2019 VMs running databases and the other has 3 Fedora30 VMs.
Do you know why they have two servers instead of one?
-
@brandon220 said in AzureAD and shares:
@Dashrender One has 2 Server 2019 VMs running databases and the other has 3 Fedora30 VMs.
So likely they still need a lot of licensing for AD.
-
@Dashrender The original was intended to just run databases and did not have enough horsepower to run the other applications. A second was purchased and the plan is to migrate everything to it.
-
AD + SMB.... it's like designing for ransomware.
-
Less than desirable internet service is a large factor in having things in-house versus hosted. It is a big factor that cannot be overlooked.
AD does not have to be implemented. That is why I'm here discussing it. -
@scottalanmiller said in AzureAD and shares:
AD + SMB.... it's like designing for ransomware.
What does AD have to do with ransomware?
-
@brandon220 said in AzureAD and shares:
Less than desirable internet service is a large factor in having things in-house versus hosted. It is a big factor that cannot be overlooked.
AD does not have to be implemented. That is why I'm here discussing it.Nothing wrong with in house. File serving over the Internet is basically always bad, regardless of the tech used. WANs just aren't fast, and files are very speed sensitive.
-
@Obsolesce said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
AD + SMB.... it's like designing for ransomware.
What does AD have to do with ransomware?
A ton. AD and SMB shares authenticated through it are the primary attack vector for ransomware. While AD itself is not a huge vulnerability, it ties many systems together so that a single compromise easily turns into a big one. It's like the authentication equivalent to a LAN. It magnifies exposure and discovery.
-
@scottalanmiller said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Less than desirable internet service is a large factor in having things in-house versus hosted. It is a big factor that cannot be overlooked.
AD does not have to be implemented. That is why I'm here discussing it.Nothing wrong with in house. File serving over the Internet is basically always bad, regardless of the tech used. WANs just aren't fast, and files are very speed sensitive.
Yes there will be places that just can't do it until internet speeds are faster and cheaper than local/onprem.
-
@Obsolesce said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
@brandon220 said in AzureAD and shares:
Less than desirable internet service is a large factor in having things in-house versus hosted. It is a big factor that cannot be overlooked.
AD does not have to be implemented. That is why I'm here discussing it.Nothing wrong with in house. File serving over the Internet is basically always bad, regardless of the tech used. WANs just aren't fast, and files are very speed sensitive.
Yes there will be places that just can't do it until internet speeds are faster and cheaper than local/onprem.
And more importantly.... low latency. It is latency, more than bandwidth, that kills files and databases over the WAN.
-
@scottalanmiller said in AzureAD and shares:
@Obsolesce said in AzureAD and shares:
@scottalanmiller said in AzureAD and shares:
AD + SMB.... it's like designing for ransomware.
What does AD have to do with ransomware?
A ton. AD and SMB shares authenticated through it are the primary attack vector for ransomware. While AD itself is not a huge vulnerability, it ties many systems together so that a single compromise easily turns into a big one. It's like the authentication equivalent to a LAN. It magnifies exposure and discovery.
So if you take away AD, nobody gets ransomware?
I would say it's an issue of old outdated SMB versions with bad access and authentication practices.
-
@Obsolesce said in AzureAD and shares:
So if you take away AD, nobody gets ransomware?
Being a primary vector, and the only vector, and totally different things.
If you have four attack vectors, three that are 24% of the time, and one that is 28% of the time, that one is the primary, but the other three make up 72% of attacks.
So the leap from feeling something is primary, to all, can be astronomic.
But yes, if you remove AD, a massive percentage of people getting ransomware, or getting it across systems rather than isolated to one system, drops dramatically.
-
@Obsolesce said in AzureAD and shares:
I would say it's an issue of old outdated SMB versions with bad access and authentication practices.
That is a factor, too, of course. Anything outdated ups the risk. But for systems properly maintained, those things don't exist.
-
If you had a client/friend/relative and needed a file server for 'reasons' and they only knew MS since birth - would you still install a samba file server if licenses were not a factor?
-
@scottalanmiller said in AzureAD and shares:
@Obsolesce said in AzureAD and shares:
I would say it's an issue of old outdated SMB versions with bad access and authentication practices.
That is a factor, too, of course. Anything outdated ups the risk. But for systems properly maintained, those things don't exist.
Bad things happen with good solutions when they are not implemented and maintained correctly.
-
@brandon220 said in AzureAD and shares:
Here is an example from the FFIEC Cybersecurity Assesment Tool:
The more OSS you have, the lower your score will be.I'm not defending or even sure this is what they are talking about, but they may be looking at the risk of the licensing. It can be tough to keep track of all of the licensing of open source tools and making sure you comply with them.
-
@brandon220 said in AzureAD and shares:
If you had a client/friend/relative and needed a file server for 'reasons' and they only knew MS since birth - would you still install a samba file server if licenses were not a factor?
Honestly, yes. For the very reason you mention.... someone who "only knows one thing", don't actually know that thing and are the most dangerous of people. Making it easy for people who don't understand to break things is really the worst option, IMHO . It's costly, and risky. Making IT "seem easy" is one of the biggest mistakes of the MS ecosystem.
