Slashdot Mirror

However, I did like the Pencom guys back in the day, and an ex-pencom guy did find me my current job. Course, I was also a CT person but not anymore. I can say that a guy nicknamed Chilly was a good recruiter, but he's no longer one anymore.

However, I can't say anything about the companies now, but I'm sure others can. I do get a lot of recruiter email because I pop up on search engines with 'SAN', 'EMC', 'Veritas' and other popular search terms, but I'm never interested in them. But it's nice to give the emails to those who are looking for jobs. `8r)

I attended an event in November 2000 hosted by Collective Technologies called Shared Authentication Solutions. Collective Technologies developed an in-house solution permitting single sign-on and application control. The tools used were:

1. Win2k password server running Active Directory (which is really LDAP, with a twist) and the M$ bastardized version of Kerberos. Collective Technologies extended the Win2k password file with Active Directory to contain the usual UNIX password fields and the ACLs for each application.

2. Solaris and RedHat Linux boxes running Kerberos, PAM, and LDAP.

3. NT and Win2k boxes running either NTLM or the newer Win2k Authentication client.

Once a user logged into any session on the Collective Network, they had instant, secure access to all the resources they were supposed to have, and no other.

The only downsides to this entire setup I could see were:

1. The authentication server ran on Win2k and not UNIX.

2. The weak link in this chain was the Win2k authentication server. Collective Technologies suggested that their implementation relied on physically securing this one box in a locked server room.

I was unable to find information on the Collective Technologies web site about this presentation. Please contact me if you would like more information and I'll try to dig up the documentation provided by Collective Technologies.

I know that my company hires people to do linux, as we are onsite support for RedHat. Hence, we give tech talks concerning all sorts of different stuff. Recently, Curtis Preston gave a talk in Boston concerning Backup Recovery practices. I know with all the linux people within the company, we could dig someone out to talk about the place of open source systems in the corporate environment.

--
Gonzo Granzeau

As you said, see www.colltech.com for more information.

I think this type collabration is the spirit of the Open Source movement, the spirit of cooperation towards a common goal. After all, the tag line of Collective Technologies is 'The power of many minds.'

I guess I should also point out that our company is the exclusive onsite support for Redhat as well, so we have way too many Linux experts for our own good. `8r)

--
Gonzo Granzeau

What the reviewer did not mention is that all the contributors and reviewers came from a consulting company in Austin, TX called Collective Technologies. My brother was one of the reviewers :-) You can visit their site at www.colltech.com.

Nothing can replace proper Systems Administration.

As a real world example of this, I busted a TFN client that appeared on two Suns we had 2 days after they appeared (These were non-used systems, I just noticed the network traffic). The traffic was high, I didn't believe the results that the rootkit were telling me, and found the kit and client (Thank you ftp's static ls!). And this was before TFN was out on BugTraQ and other security mailing lists! I didn't know what it was, so I just cleaned up the systems, and threw a P-90 Linux firewall in between. Also notified the uplink that they were the ones talking to the client. (Strange udp packets incoming are not to be trusted!) Now that's proper Systems Administration!

Oh, and to sell people on my company, Collective Technologies, all we do is Systems Administration (and networks and DBA's now too). The best of the best sys admins out there... `8r)

--
Gonzo Granzeau

I have previously worked for Collective Technologies, a consulting company that has their own 1-800 and 1-900 number support lines that they offer to their customers. Red Hat has a partnership with CT wherein CT provides "premier support" for Red Hat worldwide.

You'll note that CT also has a partnership deal with Sendmail, Inc. During my time there, one of the serious pitches we made to Greg and Eric was that CT provide *all* the call center support for sendmail. As it turns out, although Sendmail, Inc has their own call center support team, they have actively pursued a partnership with CT in other areas, and even before that partnership was official, there was plenty of business they were sending our way because they simply couldn't handle it all.


I can tell you from personal experience that unless you're a professional support organization (such as a consulting company) and you can focus exclusively on providing technical support (including 1-800/1-900 support), you simply *cannot* provide that support at a sustainable cost that you can charge to your customers.

This is why more and more businesses are out-sourcing their entire support operations to dedicated support and consulting companies, such as CT.


The advantage that CT has is that they can provide far more than just standard 1-800/1-900 support, and if a customer has an in-depth problem the call center folks can pass the issue over to the appropriate regional sales representatives, and they can actually put a warm body on-site for that customer.

Companies like Red Hat and Microsoft can't do this. They instead rely on companies like CT to provide those additional consulting services. Even companies like Sendmail, Inc. have a hard time doing this, even though they've managed to snap up virtually every sendmail or SMTP-knowledgeable person whose name I've ever heard (and who could be stolen away from their current endeavours), and a lot of guys whose names are completely unknown to me.


Anyway, my point is that Red Hat can't possibly charge a fee that would be high enough to actually pay for all the potential sendmail support calls that they might get, and therefore it's in their best interest to pay big money to Sendmail, Inc. to become a preferred corporate customer, and get a lot more attention paid to their own agenda, in terms of bug-fixes, etc....

I have previously worked for Collective Technologies, a consulting company that has their own 1-800 and 1-900 number support lines that they offer to their customers. Red Hat has a partnership with CT wherein CT provides "premier support" for Red Hat worldwide.

You'll note that CT also has a partnership deal with Sendmail, Inc. During my time there, one of the serious pitches we made to Greg and Eric was that CT provide *all* the call center support for sendmail. As it turns out, although Sendmail, Inc has their own call center support team, they have actively pursued a partnership with CT in other areas, and even before that partnership was official, there was plenty of business they were sending our way because they simply couldn't handle it all.


I can tell you from personal experience that unless you're a professional support organization (such as a consulting company) and you can focus exclusively on providing technical support (including 1-800/1-900 support), you simply *cannot* provide that support at a sustainable cost that you can charge to your customers.

This is why more and more businesses are out-sourcing their entire support operations to dedicated support and consulting companies, such as CT.


The advantage that CT has is that they can provide far more than just standard 1-800/1-900 support, and if a customer has an in-depth problem the call center folks can pass the issue over to the appropriate regional sales representatives, and they can actually put a warm body on-site for that customer.

Companies like Red Hat and Microsoft can't do this. They instead rely on companies like CT to provide those additional consulting services. Even companies like Sendmail, Inc. have a hard time doing this, even though they've managed to snap up virtually every sendmail or SMTP-knowledgeable person whose name I've ever heard (and who could be stolen away from their current endeavours), and a lot of guys whose names are completely unknown to me.


Anyway, my point is that Red Hat can't possibly charge a fee that would be high enough to actually pay for all the potential sendmail support calls that they might get, and therefore it's in their best interest to pay big money to Sendmail, Inc. to become a preferred corporate customer, and get a lot more attention paid to their own agenda, in terms of bug-fixes, etc....

• Using CT, how easy or otherwise is it to bring down or attack vital systems?

  It really depends on how the system was devised. There are a couple factors here, a who is attacking, a why, and a how.

  There has been a recent profiliation of machines that are 'automagic', where the user plugs the machine in, and it works. As this becomes more common-place, there will be more attacks of the 'script-kiddie' mentality. These are the more common-place, and usually more destructive attacks. A good example would be the Cold-Fusion exploit released not too long ago. It was written up into a nice package that someone could give to a 13 year old kid. That 13 year old could go burn down a machine in some place he's never heard of, and he wouldn't care. Someone who researched this exploit might actually have some ethics about destroying someone else's virtual property.

  Then there is the why question. In the beginning, cracking was mostly used as a 'I was interested in how it worked' explination. In the future, I think we will see more infiltration attacks, where people just want to get onto the system to listen, gather, and desiminate information. This could be to gather personal information, financial information, share a virus, or to expose your political views. The system will continue to work, but an incorrect manner. As these become more sophisicated, I think they will become harder to detect. It's only when we relax our guard do we get hurt by an attack

  Then there is a how. The discussion of potentially harmful weapon systems is a matter of exposure. Networking is a useful thing, but think of it in another light. You have a gun cabinet in your office, forget why, but would you really want this expose? So you put it behind a secret door, only certain people know how to go up and press on the door in the right way to open it. But someone visiting might press all your walls in several ways, and still find it. Security via oscurity does not work. So you put a master lock on it. However, a nice pair of bolt cutters work quickly. So you put it in a true safe, making it difficult to get to. People complain, so you are forced to make the combination something simple like '1 2 3'. This again, breaks the system. You run into the common brick wall of security versus ease of use. As our society seemed centered on easing our lives, we tend to focus more on the ease of use. Good example are the web forms out on the web, to make our lives easier, but could also break our security policy.

  So you are looking at more information is being distributed, it is becoming easier to find this information to infiltrate a host, and we are moving towards a looser definition of neccessary security. Is it easy to attack systems? Yes, and it's becomign easier all the time.

• What sort of skills would be needed to do so, and are they common/teachable?

  Many of the skills can be learned from reading on the web. Most are commonly found out. But the most useful are taught in a student/mentor relationship. While root exploits can now be thought of as easier to figure out on your own, it usually takes an experienced person to point the newbie in the right direction, to wade through the bullshit. As we migrate to a more networked envirionment, these requirements will become less, and become a more 'click here!' security risk.

• Commercial-off-the-shelf software: can it really do CT?

  Two issues, the offense versus the defense. As far as products go, COTS will never be as good as what can be obtained by an experienced professional. and all experienced professionals have a cost. Also, would you include COTS to have web-based and free software? Because it's all out there for the taking. Remember that COTS lag behind the speed of the rest of the world, especially security related products. For instance, ISS security product still checks for certain accounts when trying to check a unix system. However, ISS knows nothing about nmap and it's use as a port scanner. (well, last I checked)

  On the defensive side, with proper design COTS can protect your data.. Many companies think of security last, it's an afterthought of a 3rd level VP who says 'BTW Bob, is this system secure?' 'No it isn't Ted, You said you didn't want to put in your password on every new screen' 'Well make it secure, mmmkay?' However there are some products that are designed off the shelf with security in mind, these would be more of the unix systems as they have a better chance to mature. Just the fact that there is a root account where a user can do anythign they want has to remind the designer not to let people get there. For an example, the BSD security audit that took 10 people a year and a half is what I would considered to be an ideal.

• Which systems are actually attackable?

  All networked systems are attackable. You must assume that. Just as no fortress can be completely safe, no data can truely be secure. There is a sliding scale of usabilty versus security, so set your thresholds high.

• Can a recovery be made from such attacks?

  This is why backups and data integrity plans are a must. Everyone should have a buisness continutity plan. This can also be associated with an extended cracker attack. If a weapon system is compromised, we will simply have to face the consequences of that weapon being used on ourselves. Some philosopher once stated that man will not be happy until he has devised a weapon that is able to scare even himself.

• Is it likely to improve/get worse?

  It is most likely going to get only worse, until a light turns on in the mind of software developers that it is bad to have a product that a 13 year old can walk in and take over at any time. Those types of attacks are the true threat in the growing sea of information.

• What sort of preventitive work would you recommend them to carry out?

  Get the best people you can to manage your systems and your software. The risk of having a new administrator to manage your credit-card-number-heavy network is much higher than the price to find a good administrator. While you can never bank on the security of your software, your security is only as good as your administrator. An aware adminstrator will be able to fix the major flaws in your security.

Feel free to publish any of this, I do work for Collective Technologies, but these are my own opinions.
--
Gonzo Granzeau