Scorpion Software Blog

AuthAnvil Testimonial: Working World

When I was in Ontario presenting my Hack and Defend seminars for Microsoft, I had a chance to stop by some of our customer sites for a visit. I really enjoyed the opportunity I had to hook up with the staff at Working World to see just how they use AuthAnvil, and to give them a private demo of our new Kaseya AddIn functionality.

In the testimonial below, you can listen to some of the staff members at Working World discuss how they use AuthAnvil with Kaseya and ConnectWise to deliver secure remote access to customer sites, while delivering unprecedented audit controls for their business. Hear in their own words what they think of the new AuthAnvil AddIn for Kaseya's K2 platform, offering integrated management and control of AuthAnvil right in the console.

  You can also watch this testimonial and others in the Video Success section at our website, if you can't see/play the video above.

AuthAnvil Best Practice: Locking Down Web Services

For part two of the AuthAnvil Best Practices series, we’re going to look at the AuthAnvil web services. In version 3.0 and later, AuthAnvil installs four new directories to your IIS web site of choice:

• AuthAnvilSAS: This directory holds the AuthAnvil strong authentication web service. This is what all of the AuthAnvil agents authenticate to.
• AuthAnvilAdmin: This directory holds the Admin web service, which is the backend service used for managing AuthAnvil. The AnvilManager Web interface uses this service to perform its management, and management tasks can also be performed by scripting languages that support web service calls, such as PowerShell. An example of using PowerShell to manage AuthAnvil can be found here: Using PowerShell to change a User’s PIN.
• AnvilManager: This contains the AuthAnvil Manager web interface. The AnvilManager is used to do all of your regular day to day AuthAnvil management.
• ManageToken: Introduced in AuthAnvil 3.0, the Self Service Portal allows users to do some management of their own tokens, including activating their tokens, testing their tokens, and changing their PINs, without requiring any administrator intervention.

If you are using AuthAnvil:

• On your internal network only;
• On a server that cannot be accessed from the internet;
• You don’t need any remote users to be able to authenticate; and
• You are not concerned with remote management

... then you can lock everything down to the internal network by blocking it at either the server or firewall level. That’s it, you’re good to go. If you have remote users that need to log on, or you want to manage AuthAnvil remotely, then read on.

For remote users, of the four directories, the only one that *needs* to be accessible to the Internet is the AuthAnvilSAS virtual directory. This is all that AuthAnvil agents require in order to authenticate to the server. If you want to allow remote management of the AuthAnvil server and to allow remote users to manage their own tokens, then the AnvilManager and ManageToken directories can be exposed to the Internet. If not, then they can be restricted to the local network. The AuthAnvilAdmin web service does not need to be exposed to the Internet, and unless you want to be able to perform management tasks via scripts, can even be restricted to the local machine only. Note that if you do restrict the AuthAnvilAdmin web service to the local machine, you may need to use the instructions in Appendix C of the AuthAnvil Install Guide to change the server name on the Admin URL to one that is correctly resolvable and reachable from the AuthAnvil server.

You can lock these directories down at the IIS level, following the instructions in Appendix D of the Install Guide for Windows Server 2003. For Windows Server 2008, it’s a little more complicated:

1. If necessary, add the IP and Domain Restrictions Role Service to the IIS Role
   1. Open Server Manager
   2. Expand Roles and Web Server
   3. Scroll Down to Role Services and click the “Add Role Services” button.
   4. Scroll down to the “Security” section and click the check box beside IP and Domain Restrictions.
      
      
   5. Compete the wizard.
2. Open the IIS Manager
3. Navigate to the directory that you want to protect.
4. Double click “IP Address and Domain Restrictions” in the IIS section.
   
   
5. Click “Edit Feature Settings…” and set Access for unspecified clients to deny.
   
    
6. Click “Add Allow Entry…” and add entries as appropriate.
   
   
7. Repeat steps 3 - 6 as required.

In this area too, AuthAnvil is flexible, helping you harden your servers by allowing you to expose only as many services as your needs require. This is something to take into account and take advantage of when planning your network and Internet services policies. Check in again next week for more AuthAnvil best practices. If you have a question that you would like to see addressed here, please send it to support@scorpionsoft.com.

Flashback: VarVid interviews Dana Epp

Wow. I was surfing the net and came across this old interview that Aaron Booker from VarVid did with me back at SMB Nation in 2008. Looking back to that interview, it's so interesting to see how much has changed, and yet how much is the same. Aaron did an excellent job to draw an interesting conversation out of me in the middle of the conference.

Check it out below.

Kind of nostalgic to come across this video years later. Thanks for a great interview Aaron! 

AuthAnvil Best Practice: Choosing your platform

Some of the most common questions to the sales team and the support desk involve best practices for AuthAnvil. Customers want to know where it should be deployed, how it should be secured, and what steps they should take to manage and monitor it. So, to help everyone out, we’re putting together a new feature for the tips and tricks section of the blog about best practices for AuthAnvil. We’ll try and post at least once a week, so if you have any best practices questions that you’d like to see addressed, please send them to support@scorpionsoft.com, and we’ll post the answers here.

The first question that I’d like to address is one that our sales team gets asked a lot: “What platform should I run my AuthAnvil server on?”

The answer: Our recommedation is Windows Server 2008. While AuthAnvil fully supports Microsoft server platforms based on both Windows Server 2003 and 2008, Server 2008 and it’s variants, such as SBS 2008, win hands down. Not only is it a much more modern operating system, it is far more secure and robust. It also includes IIS 7, which is a stable web platform that is far more flexible and extensible than its predecessor. Most importantly, it includes a couple cool new features, such as the ability to trigger actions based on event log entries.

The other part to this question is whether to run AuthAnvil on physical hardware or virtualized. It will run equally well on either, and has been extensively tested against virtual machines, with many customers running virtual AuthAnvil servers in the field. It all depends on what works best for your infrastructure.

AuthAnvil is designed to be as flexible as possible, even being able to run on a domain controller, or in other single server environments, such as an SBS network. To get the best bang for your buck though, the more modern the operating system, the better.

AuthAnvil Testimonial: Bulletproof InfoTech

It is always fun to visit our customers. Recently when I was touring a few cities with Microsoft I had a chance to drop by Bulletproof InfoTech, who have offices in Calgary and Red Deer, Canada. Avid fans of Kaseya and members of the HTG10 Peer Group, I have enjoyed watching them grow into one of the premium providers of IT services, especially in the energy sector of Alberta.

I was lucky enough to capture some of their comments on film while I was there. Listen as some of the staff at Bulletproof Infotech explain how AuthAnvil is a critical part of their infrastructure, and how they work with it in their business each and every day. It's a great testimonial of AuthAnvil in action in a growing MSP.

  You can also watch this testimonial and others in the Video Success section at our website, if you can't see/play the video above.

Introducing the AuthAnvil Management Pack for LabTech

Are you a LabTech administrator who is also responsible for the security of your client networks, and have deployed AuthAnvil agents to apply protection scopes to the most critical servers that you manage? Then listen up... we have an announcement for you.

Today Scorpion Software is pleased to announce the general availability of the AuthAnvil Management Pack for LabTech. It is a suite of management scripts that help to automate the deployment, management and monitoring of AuthAnvil logon agents. It helps to watch for the tampering of agent security in the field, and allows you to quickly leverage the automation functionality of LabTech to deliver agent updates, setting changes and even override password revisions by the click of a button.

The scripts include our recommendations for our best practices in monitoring and alerting on specific authentication behaviours, included failed logons, attempted bypasses, and applied overrides. It also includes service monitoring so you can alert of the health of your authentication subsystem across all your client networks that you manage.

So now you not only have the ability to secure your LabTech administrative console using AuthAnvil as before, you now can use LabTech to administer AuthAnvil in the field. For more information you can check out the documentation here.

Congrats to Kaseya on their latest hotfix... now with AuthAnvil goodness!

At Scorpion Software, one of our objectives is to make sure we deliver the right strong authentication and identity assurance solutions that the MSP space needs. As part of that, we work closely with several companies that deliver RMM tools. One of our favorite relationships though is with the folks at Kaseya.

With our Kaseya Logon Agent and AuthAnvil, MSPs can know for sure who is accessing Kaseya through the power of AuthAnvil’s strong authentication and identity assurance controls, along with powerful audit logging. In the past, this functionality was complicated a little by Kaseya’s constant update cycle, as they occasionally needed to update the logon page which would disable this. So to address this, we provided Kaseya administrators with IT automation scripts that would keep an eye on the MD5 hash of the page, so that they would know as soon as it changed, allowing them to take corrective action to re-enable AuthAnvil protection.
 
We love Kaseya for their commitment to constantly improve their product by releasing little tweaks, upgrades and other hotfixes to make the user experience better. Today, we want to shine a spotlight on a little feature that was added in the July 7 hotfix: integrated support for the AuthAnvil Kaseya Logon Agent in K2.

Kaseya, after seeing what we’ve done with our agent for their platform, was kind enough to co-ordinate with our developers and put a couple of critical hooks into their logon page that we are able to use to add onto their logon page and provide a strong, two-factor authentication mechanism that is never at risk of being modified. The result is that deploying the Kaseya Logon agent is as easy as configuring a few settings, then dragging and dropping the agent into K2’s WebPages folder. Kaseya will handle the rest for you. And its guaranteed to not disable your AuthAnvil protection scope!
 
The Kaseya Logon Agent is included with your AuthAnvil subscription, and supports both Kaseya 5.1 and K2. You can learn more about it, including how to download and deploy it, from the Kaseya Logon Agent HOWTO page in our documentation center.
 
If you want to do more with AuthAnvil and Kaseya, check out our AuthAnvil Management Pack for Kaseya, which lets you use the power of Kaseya to deploy, monitor and manage your AuthAnvil components across all the networks you manage.

So congratulations to Kaseya for an awesome hotfix. We are happy to see your commit to enhancing the security of your platform with complimentary safeguards such as AuthAnvil. We appreciate your support!

Information Security Management in a world of PSA

We work with hundreds of growing MSPs and IT providers who are automating much of their business. When you think of your favorite PSA platform (such as ConnectWise and AutoTask to name a few) what we really are talking about is the concept of Information Technology Service Management (ITSM).

ITSM in itself may be a foreign concept to you. It’s the process of improving your IT service delivery though best practices. Well, you probably understand what it's about if you have invested in a PSA solution already, but you may not know what it's officially called. In larger companies meeting the industry standards and compliance of ITSM, this is accomplished through the Information Technology Infrastructure Library (ITIL). It is typically focused on the processes and management within a single organization, which leaves service delivery through external parties across multiple business units (or entirely different companies for that matter) hard to measure. And the ideals to meet certification objectives of standards like ISO/IEC 20000 is just not practical with many of our partners.

Most PSA tools do a good job to focus on the ITIL best practices for the core competency of MSPs and IT providers. That usually covers such things as Service Management, Asset Management, Change Management, Problem Management and Incident Management. Typically though, Information Security Management (ISM) is completely missing, or woefully inadequate. Normally this is under the guise that security doesn't matter, or that service providers simply aren't big enough to need to fret about the liability they may face, or the accountability that they may not currently hold or audit.

By its very nature, the purpose of ISM is to ensure that the risks to the business are being managed appropriately. After all, that IS what security is supposed to be about... reducing risk to an acceptable level for the organization. It actually goes deeper than ISO/IEC 20000, having its own standards in ISO/IEC 27000, but has a general purpose across both standards. The ISM process is meant to align IT security with business security to ensure information security is effectively managed in all service and service management activities, such that:

• Information is kept confidential, observed and disclosed only to those people with the right to know. (Confidentiality)
• Information is complete, accurate and protected against unauthorized access or modification (Integrity)
• Information is always available and usable when it is required. (Availability)
• Business transactions, as well as all information exchanges, can always be trusted, authentic and non-reputable. (Authenticity)

If you have ever studied information security, you know this falls under the "three pillars of infosec", or sometimes referred to as the CIA triad. Confidentiality. Integrity. Availability. All three must be maintained to assure a secure system that can properly address risk to an acceptable level. Without it, you simply cannot meet the objectives in ISM.

Now back to PSA tools like ConnectWise and AutoTask. The very nature of the confidential information being stored there is so sensitive, and so vital to the business it must be protected at all times. Think about it for a minute. If a staff member was to leave your organization, are you certain he has no way to gain access back to your PSA system? Weak static passwords used to provide authentication to these systems are easy to share, steal or circumvent. Can you be sure that when “Bob” leaves the company that he doesn’t know “Alice's” typical password, giving him access to the very information ISM is supposed to protect? Can you be sure that the desktop Alice is doing work on doesn’t have malware that may collect your critical RMM and PSA passwords as she accesses the systems?

This is where two-factor authentication comes in. It provides a level of identity assurance so you can be confident that when a staff member accesses your RMM and PSA tools, they are actually who they say they are, and that they are permitted to access the information. That directly meets the goals of ISM, and therefore meets the best practice objectives of ITSM as a whole. And both ConnectWise and AutoTask support this, BUILT IN to their software. So why aren’t you using it?

The good news is that partners who have already invested in their AuthAnvil architecture can probably do this right out of the box with their favorite PSA solution of choice. There is no extra cost to gain the identity assurance benefits of AuthAnvil while reducing your business liability across all your client networks, and increase accountability of all your staff when accessing these systems and that confidential information stored in your PSA toolset we have been talking about.

So my challenge to the MSP and IT provider community at large is this... WHY don't you think ISM is important to you? Your entire business rests in the protection and safeguarding of the systems, processes and information being stored in your RMM and PSA tools, which you are willing to protect with a weak password which may very well be shared, stolen or circumvented. If you are planning to grow your business and add more clients and staff, are you really OK with that?

Want to discuss ITSM, ISM and/or AuthAnvil in more detail? Let's talk.

P.S. If you would like to pick up a good book on this, I highly recommend Information Security Management with ITIL V3. It's a hard book to come by, but really hits home if you are a progressive IT services company with growing concerns about ISM and ITIL, and needs to meet the compliance objectives as set forth in ISO/IEC 27000. This won't be a read for those one man shops managing a handful of clients. But if you have several staff members managing hundreds or thousands of endpoints across many different companies and use a PSA system that follows ITIL best practices, this may be a good read for you. Enjoy.