I disagree with the use of Apple tech to solve corporate problems. I work with protected information and use standard tools every corporation should be using. The problem with Macland is that Apple does not support secure computing. Try writing email to their HIPAA support address. So far they have not responded to a single one of our emails in the last 3 years. They don’t exist. Apple has no FIPS-140 support. They do not have a single certified device on the NIST FIPS 140-2 list.

 Apple is like a gold hammer if home computing is a kind of nail. Works pretty well together and looks nice. But the hammer is expensive and has to be replaced pretty quick. When you smack the business screw with the gold hammer, all kinds of crap goes wrong. Eventually when your business puts a heavy load on the screw, everything will fall apart.  I’m looking for the right tools to go in my toolbox. Not the one the popular comedian on TV uses. I’m a professional IT person, not a comedian.

I’d like to start a table to show a comparison of just Dell laptops with Windows, Red Hat vs Apple full OSX and iphoneOs. I’d like to stick to features useful to a medium to large business, not a group of 10 developers. Over time I’ll add links to each item to show a source for data directly on a government site. For the most part this is a cheat sheet for myself but if anyone else finds it useful let me know.

To the apple fanbois who will find this site, if you have helpful comments to keep this accurate, fire away. Just keep in mind that I’m in the big kids playground where Ford vs Chevy doesn’t matter. Individual products that meet government requirements matter. FIPS 140-2, HIPAA, HITECH, FDCC, USGCB are the types of regulatory issues I have. If you don’t have emails coming to your inbox every day with compliance reports… well just keep your flamebait to yourself please. You can’t learn about this stuff overnight. It takes years and a decent size staff. Until you have lived in that world, you don’t shed bias to examine this rationally.

I believe this is accurate as of March 2011.

Unless you have HIPAA, PHIPA, SOX, CISSP, work for DoD, or just a company who values privacy. Then you get a Blackberry and download the right apps. There should be no such thing as an iphone or droid at a company who has security requirements. Please tell me I’m wrong with citations of how an iphone or droid is fully compliant with FIPS140-2 and is listed on the appropriate NIST site so I can show my attorney. Then I will snuggle up in my happy google cloud or let my coworkers get all happy in their iphone cloud.

I do envy you people who are arguing about megapixels and screen size. Not becuase your petty arguments have merit, just because I want the happy ladder instead of the Escher staircase.

One side note- I still challenge anyone to show me an iphone app with a real business use for me that can’t be replicated by blackberry or droid. So far it doesn’t exist. I think these are all fairly equal platforms and just flavors, not fat vs carbs.

netsh ipsec static add policy description=”ossec block list”

netsh ipsec static add filter filterlist=”ossecfilter” srcaddr= 69.89.20.50 dstaddr=me protocol=tcp mirrored=yes

netsh ipsec static add rule policy=”ossec” filterlist=”ossecfilter” filteraction=block desc=”list of ips to block”

netsh ipsec static set policy assign=y

This blocks windowsnerd.com

Add another entry for slashdot. Ipsec doesn’t like having an empty entry so leave an addy in there to seed it for a delete in another step:

netsh ipsec static add filter filterlist=”ossecfilter” srcaddr= 216.34.181.45 dstaddr=me protocol=tcp mirrored=yes

Now if you open the ipsec MMC, you will see an applied ipsec policy, crack it open and you will see both entries for each IP.

Try going to windowsnerd.com, slashdot.com and another page. The first two will not work. All traffic has been blocked

Unblock -

netsh ipsec static delete filter filterlist=”ossecfilter” srcaddr= 69.89.20.50 dstaddr=me protocol=tcp mirrored=yes

Repeat – now you can block and unblock by running the static add and static delete command over and over. It will update the policy you created in the first step. Not quite as cool as adding to hosts.deny and firewall, but the same end result.

This example is for use on an application like OSSEC. If you desire, you can specify per port, IP addy, DNS name, whatever you want.

Why is it taking so long for the Apple tablet to come out? It is getting beat over and over again. The Nvidia tablet, Dell slate, old school dell xt, oqo gear. Apple does things for good reasons.They are waiting for a a perfect storm of ideas. Small light touchscreen tech is maturing this year. Battery life is better with atoms and SSDs. And-

I’m guessing the Apple tablet is running a thinned down OSX. Probably named OS 11. It will be super lightweight, just some wireless drivers, graphics, small fast storage. Exactly what the standard cookie cutter Chrome OS machine will be later this year. All the manufacturers are ramping up on the touch screen slate. Apple will be fashionably late as usual (like on the current lack of security patches,) and dazzle us with some overpriced gadget. As always, I won’t buy one because I can’t afford the lack of bang for bucks. But if someone gives me a toy that cool I’ll be ever so happy.

Where does this leave me? Errr ummmm… Yipes. MS has been working on their own cloud for a long time. I wonder if it will arrive in time before the google hurricane.

So there is my crazy prediction for 2010. Apple iSlate or whatever is running a ChromeOS style OS, on near netbook hardware, and sold at Verizon with cell service. If they don’t have a light OS, goodbye Apple, and welcome google vs MS for the next cold war.

<localfile>

<log_format>mysql_log</log_format>

<location>/var/log/yourlogfile.log</location>

</localfile>

Restart ossec and it should start reading your mysql logs now. Anyone have additional rules to add in for mysql?

After an SSH into a new Ubuntu machine, you can see that there are patches available. And not just Ubuntu patches, for all the packages you have installed.

Dear Microsoft: I wish that at the login screen to Windows, in all that empty space, you have a box that says:

XXX programs can be updated. XXX are security updates

XXX drivers can be updated. XXX drivers address critical issues

Once this is done, I would like to see Microsoft leading a charge to develop a central patch distribution service like Linux does so well. Manufacturers would be responsible for updating and uploading their latest into the system. The default action would be to install updates as a manufacturer releases them. Settings would allow you to download and notify, notify only or ignore. At that point we add to the login screen-

XXX 3rd party programs can be updated. XXX are security updates

I think it will be a pain in the ass to set up. But not as much of a pain in the ass as users who refuse to update java, flash, quicktime, acrobat and everything else out there.