Lock Down Your Switch, or Else!

Locking down your switch is one of the most important steps to do (for the network engineer) or verify (for the IT auditor). Indeed, restricting physical access to your network to only those authorized is paramount. Further, it is a requirement of PCI DSS (9.1.2. Restrict physical access to publicly accessible network jacks) and ISACA (P8 Security Assessment—Penetration Testing and Vulnerability Analysis - 6.1 Rogue Access Jacks)

Looking at this from both an operational and assurance mindset, it is equally important to ensure physical access control. But, as I am sure you are aware, importance is relative. How often is PCI DSS 9.1.2 given a checkmark for compliance on either your Self-Assessment Questionnaire or on-site assessment?

From an audit, and even an engineering perspective, it is really a best practice to lock down your switches and disable any ports not in use, especially those going to areas where people may have easy, unattended access to the network.

Of course, for those in site support who may have to set up new user connections, it is quite cumbersome if the ports they need to plug their patch cables into are disabled. Indeed, instead of patching their cable and being on their merry way they now need to create that dreaded change request!

When you are on the operational side - and are feeling the pain - it is hard to see the merit of going through these processes. But, when you realize that there is a reason why the change request asks for business impact and, in many cases, will need business approval you start to see a pattern. The work we do is not in a vacuum - it supports the business. To that end, we need to be cognizant of what we are doing and what the risks are to the business.

So, the next time you need to patch in a new user and the port is disabled. Don't get mad (and, please, don't get even!) - just be glad that someone out there is doing what he/she can to keep your business secure. Now it is your turn.

More on Locking Down Your Switch.....

In my last post I talked about the importance of locking down (disabling) physical access on your network switches to only those with authorized access. I discussed how, along with being a best practice, it is also a requirement of such standards as PCI DSS and ISACA.

Let's add another standard to that list today and that's NERC. Indeed, NERC CIP 007-1: R2 states that "The Responsible Entity shall establish and document a process to ensure that only those ports and services required for normal and emergency operations are enabled."

More to come.....

Locking Down Your Switch.....Cont'd

I have been talking here and here of the importance of locking down your switch (indeed your network in general) and why this is so important. It seems to me that the most basic controls are often the most overlooked. It is not surprising that most best practices call for basic network physical security and, on the same note, it is not surprising that basic security is often overlooked.

Looking through PCI DSS, for example, you will see a requirement both for WAFs (Web Application Firewalls), which operate at Layer 7, and for restricting physcial access at OSI Layer 1. Indeed, it doesn't make sense to put 3 deadbolts on the front door if the back door or a window is still open.

Shared Assessments is a member-driven industry standard used to "inject standardization, consistency, speed, efficiency and cost savings into the service provider assessment process." This standard also requires that physical ports be locked down (disabled) as referenced in:

I.3 Secure System Hardening Standards: Unnecessary physical access ports disabled or removed.

On another note (and I will discuss in another post), it is interesting to note that both PCI DSS and Shared Assessments include OWASP Top 10 as requirements.

Some Tips for Insured on Keeping Your Auto Insurance Premium Rates Down

Tips you can use car insurance rates comparison
There are so many ways that you can use to keep your auto insurance rates down and some of them you can use at the same time as other discounts to maximize your savings.


Here are some things that you can ask your auto insurance company for:

- Ask if you can receive a discount if you have more than one type of insurance with their company. For instance, you may find that you can have your auto insurance and your homeowner’s insurance with this company and they will provide you with a combined discount. Carry all of your insurance policies with them, such as auto, home, and life and you may find that you can get even more money off.

- If the driver of the car is a student or is listed as a driver on the car, you may find that you can get a good student discount. This is where the student maintains at least a B average on their report card. You may be required to take that report card to the automobile insurance company each time it comes out, but it really pays off. If grades go down, the discount may disappear until the grades go back up.

- See if there are any safe driver discounts available. When you haven’t had a ticket or an accident, you may find that there are discounts available for you.

- If you are a senior citizen and you’ve not had any accidents in a specific amount of time, there may be discounts available to you.

- You can always raise your deductible to cheaper car insurance premium online from auto insurer. However, you need to keep in mind that doing so will result in a higher out-of-pocket expense if an accident does occur. The standard deductible is 0, but some individuals will go as high as ,000 to save some money on their premium. If you can pay ,000 if an accident occurs, then that will work fine. Just make sure your deductible is not higher than what you can afford in case damage is done to your car and you need to pay it.

- You may wish to shop around. You may find a company that offers the same coverage for a lower price. You always want to compare before you make a commitment.

You want to use all of these tips so that you can save yourself quite a bit of money.
How you can compare auto insurance quotes online?

When finding the right company to do business with, it is very important that you compare. You can do this by calling companies and recording the different rates that they quote you. You can also do this by going to their websites and filling out the forms on their websites to receive quotes for the auto insurance you want. This allows you to compare in a much easier way. Take all of that information and make an informed decision.

I Have Bad Credit and I Need a Legitimate Car Loan Online With No Down Payment!

Smoke and mirrors. That's what I think of when I look at some websites on the internet. When you've got bad credit and you're looking for a real car loan without hassles and gimmicks, it's tough sometimes knowing where to turn. It seems like there are thousands of websites on the internet and it's just tough knowing what is real and what isn't.

Well, you'll find that there are some good companies, but it's like trying to find a needle in a haystack, as the old saying goes. Here's a few tips that will help you in being certain that a company that offers bad credit auto loans is legitimate and isn't just trying to snag your wallet.

1) Make sure you only deal with a company that is listed with the Better Business Bureau Online (BBB Online) Phone or check online to ensure that they are registered and that there are no complaints filed against them.

2) Track record is everything. Be sure to check that they have been in business for several years and that they have successfully helped hundreds of people get approved for loans. Online review sites are great for this.

3) Are they a real lending agency or are they simply trying to generate leads for a car dealership? This is a common problem which can easily be avoided by following the first two steps. Who wants a call from a dealership trying to sell them a car? Not me!

4) Can they truly offer a no money down auto loan package, or is that just another advertising gimmick? Always read the fine print.

If you keep these tips in mind and do some research, you will have no problem finding the best auto loan even if you have no credit at all.

Thursday afternoon, winding down in LDN...