If anyone here is a member of ISC^2, have you ever been to a chapter event?

Thinking about whether its worthwhile for me to go to such event given I am a recent member

Did you find speakers useful? How are the networking opportunities?

@HamZa lgms.nl/blog-12-plain

@TomK. damn, didn't know this was going on...

@HamZa yeah, never heard about them, but they sound like a real cool ISP

i knew they were the first one but i didn't know they were this cool, otherwise i would have switched to them :(

you gotta sign this petition ;)

well i'm not completely sure what's going on and what the impact is of all of this

i went for a week to paris and i miss something big like this already

business trip I presume?

ah right, how was it?

aaaah, speaking about trips

would you mind joining the slack for a second?

i will

worked for 3 days, visited family and encountered some "FB" friends

well without them being counted as vacation

@J.J i can imagine

how long?

aaah cool

@J.J hahahaha

Anyone around?

Just me, but I'm a bit of a poser when it comes to the subject matter ;p

Eh, we have some legacy software that is ringing all sorts of alarm bells on security scans due to insecure/weak ciphers. I don't know if disabling them would have any impact on the software/website running on the system.

Add to that, it's running on Server 2003...

@JourneymanGeek ^^

ooh

that might break things.

If you can set up more modern cyphers and the client side stuff can handle it, its probably fine

hullo

hullo

if its a webapp, you almost certainly should

need a bit more context than that @JohnP

where is that server located?

so where in your DC

also the biggest security concern right now shouldn't be the weak ciphers, it should be Windows Server 2k3

@TomK. I agree. This is part of a legacy system from a company that we bought several years ago, and promptly fired the developers associated. Since then it has bounced around from owner to owner with no updating.

I am the latest owner, and I'm getting pinged for weak/insecure ciphers in TLS 1.0 and SSL 2.

urgh

I know just enough about infosec/sysadmin to make myself look stupid.

okay, forget the ciphers for a second

this is a webserver I presume?

Yes.

production environment?

is this critical for your business?

Yes, I don't think we have a dev/qa environment for these at all. AFAIK, no dev work has occurred on these servers in quite a while (4+ years).

or in other words, how fast do you expect your phone to ring if you turn this thing off?

Ah. I would guess in the matter of a couple hours I'd have calls.

When the security certs failed I had emails within an hour, and requests for updates from clients regularly until I could get them approved and installed.

okay, hours kinda works

mmh.. this sounds worse

do you know if whatever service runs on this runs on a higher version of windows server?

if not: testing that should be your first step

@TomK. I get where you are going, but I don't think upgrading the OS is an option at this time. I can discuss that with my manager, but right now, I am about the only resource assigned to this and I (unfortunately) have the most knowledge about it. Which is to say, I've been assigned to this for about a month.

So if it goes sideways, we don't have a fallback currently.

I see

what kind of data is handled on this server?

payment data or anything like that?

don't ask. I know. :)

you should delete that message, I can probably reverse engineer where you work and what server that is with this information

Looks like eMonitor from Rockwell is running in a Citrix setup.

ah, shoot. I did that backwards., Again.

sounds like pretty sensitive data, and this is what you should tell your manager. there is a machine that is doing sensitive things and it runs on an OS that is out of support for 3 years (?) now

We are setting priorities for the group this next couple weeks, I want to press this. My immediate concern is if disabling the security ciphers appearing on the vulnerability scan would break the application.

if you are not able to handle this situation with the limited technical knowledge about this service (which is totally fine) then you should hire someone or get a contractor who is able to

@JohnP fun part is that depends on what's on the other side...

that I cannot tell you

see @JMG

the clients might also be running on older OSes/systems...

@JourneymanGeek Yeah, I saw that on some of the posts I was reading on the main site.

there's this old story about a sawmill that ran windows 98....

What I'm probably going to have to do is disable the ciphers on the server, and see if anyone on the outside screams at us. In which case, we'll have to play the "it's insecure. Update YOUR system" card.

that is probably a good first step

you should also check your firewall settings

and look for weird open ports

check the documentation of the application and look for communication that is absolutely necessary and disable everything else

check IPv4 and IPv6 rules

the caveat though: if this thing is running for 4+ years it is not unlikely that you already have someone sitting on it

@TomK. The guys doing firewall are crackers, I will run it by them. The entire group is really good, I'm a raw rookie on the sysadmin side. I was a dev/dev manager for 16 years, only recently converted.

alright

@TomK. The people that ran it were only recently let go, but there was never any upgrade/dev impetus.

I see

It was more "Well, it's running fine, just let it be for now"

pro tip: hire someone new :P

also: don't you have an infosec person inhouse?

@TomK. They did. Me. :)

@TomK. Many different teams. They are the ones nagging me about remediating this.

okay

important: if you get stuck, tell them immediately

they need to know

okay, I gotta go

good luck

Thanks for the help!

omfg... we are running asp 1.1 on this ::severedoublefacepalm::

these sorta things... happen

@JourneymanGeek yeah, but every time I have to dig into these groups at all, I want to severely beat the people responsible.

@JohnP heh

My current work place makes me feel like that ;)

My other headache is a windows server with an IIS installation whose sole purpose is to run two pages to point to a site on the same server running from a Tomcat install.

dafuq wat?

that's actually a fairly common setup

for various reasons

(port numbers, tls for non tls capable applications...)

@JourneymanGeek huh. Well, the day is not a loss, I learned something.

Ah, wait. The 2.0 framework is installed as well, so I feel incrementally better now.

It's mornings like this that have me speed eating Altoids.

hah

In my case, at this job, its either menthos or kitkat

@JourneymanGeek Well, at my last dev position we were running MS-DOS 6.2 on 486 processors for our telephony applications.

In 2017.

lol

"they still work"

@JourneymanGeek Boy did they. Never had to reboot them. Just kept cooking. But that may have had something to do with the developer that created them. :p

@JohnP well if you have limited resources...

and 486es were simple

@JourneymanGeek We didn't have limited resources, just a cost conscious company owner. Plus we had stability issues running Dialogic cards on a windows environment. Couldn't get the channel density per machine we needed.

@JohnP I mean, in terms of quality of coding

@JourneymanGeek Quality was through the roof. (I was primary dev for 5 years, sole dev for 3.)

Then he sold the company, we spent 3 years updating and replatforming to cloud based versions, and then they fired us all. :|

... ow

Not that I'm bitter. But, at least I'm back in the tech world now. Sysadmin/Devops side, but it's interesting. Just a steep learning curve for a bit.

But, I hear from the one dev that they retained that they have fired the people responsible for axing our group, are shopping the division, and forcing out the VP over it.

@JohnP I prefer 6.22. You will be pleased to know my one machine running CP/M is only doing it for fun - nothing critical lives on it.