Setting Windows Firewalls – An Improvement

I am a Computing Security student, so my future career should be in security. I’ve been in two security competitions so far, with a third coming up, and in all of them I have secured Windows. Within the first 5 minutes of having access to my server, I like to change passwords, disable extraneous accounts, and set up firewalls. The first two are easy, but setting up firewalls is a pain.

Windows firewalls are complex. This is a benefit, I can allow only specific applications to communicate, but it is also a bad thing because there is no quick way to set up these firewalls. Windows had a Security Compliance Manager, which I believe could make firewalls easier to implement, but they have retired it in June of 2017. It was also a massive program that I did not have time to use in the first 5 minutes of a competition.

What I need is a simple way to configure firewalls on a server that can be pulled from the cloud and run in a competition environment. This probably exists as a tool, but I have not (and will not) look for one until after trying to make one myself.

The way this process can be improved is if firewalls were configured based upon services installed and their required ports/protocols as services were installed. A tool that can do this would make the first part of competitions on a Windows device easier

~ Connor Shade

Advertisements

Account Creation Process

I currently work in the field of information technology at a help desk. Users contact us with support requests. As requests may vary, there are many different processes that are expected to be followed especially with regard to security. Some requests are simpler than others to fulfill and common such as account creations and password resets. While users may contact us for these tasks, the process could be improved if users could do them on their own. Users can already reset their own password, but they cannot make accounts. Sometimes we have to make multiple accounts consecutively with no easy way to create multiple at once. One time, a request was received for 50 accounts at once. It is a repetitive process that takes valuable time with room for error. It is not just as quick or easy as using a PowerShell script. We currently must ensure the paperwork is filled out properly, use a web interface and carefully select the appropriate account type, meet the specifications needed depending upon the account type such as the expiration date, identify the person to which the account would belong to, ensure proper permission to create the account is granted, choose a password, decide whether access to email or other services is needed, print and send the credentials, print and file the request, and more. If there was a self-service option available to users for this request, then wait time, the potential for mistakes, and response time for other requests would all decrease. While the implementation of such a feature may not be as easy as desired, it sure would be welcomed.

– Jar T

Attaching files in AVImark Veterinary Management Software

avimark

For our second blog post we were asked to discuss a process from our current or future field and then describe how we would improve upon that process.

I currently work at a veterinary hospital where we use a veterinary practice management software called AVImark.  One of the many features of this software is the ability to attach documents and other digital media to codes in the medical history section.  This allows us to electronically access things that we might otherwise only find in the patients actual paper chart, like lab work from an outside site, or discharge instructions etc.

Currently the process by which we attach these items is a bit cumbersome.  We scan the document from the paper chart to our shared network folder. We then open AVImark and find the appropriate patient, and the code that we would like to attach it too, and then go into the shared folder find the file and attach it.  Continue reading

Route Setting Process

In route setting for rock climbing, it is the route setter’s job to put up holds on a blank climbing wall designed to be fun and to not injure climbers. Sometimes that is the only guidance that is given to a setter before their session begins. Other times there are more instructions such as the difficulty they must set, the type of holds they should use, or certain features on the wall they need to avoid. Due to the freedom a route setter has, this job is considered a form of art. At RIT’s Red Barn rock climbing gym, setters typically pick out holds from buckets on the ground and lay them out on the mats. Some of these holds are for hands and others are for feet. Sometimes the holds must be used for both. Once they have decided they like the sequence they have set, they place tape on the walls where they plan to put the holds, then they bolt the holds into the wall. Once the wall is done, a group of forerunners climb the problems and decide if any changes are needed. This is a process that takes several hours. For competitions, it is important to set these problems quickly. There are several processes that I think could potentially be faster. One option is to pick out only the hand holds they plan to use. Once they go through their typical sequence and bolt them to the wall, they could decide where to put the feet and bolt these in later. This is beneficial because setters oftentimes bolt footholds that are not needed for the climb. Another option to shorten the process would be to set the crux, the most difficult part of the climb, first. If the crux was in the middle, the setter would work up and down in order to establish a flow that is both fun and difficult. This would be beneficial for competition setting because as a route setter gets ideas, he or she could bolt a few holds in and then come back to it later to finish the route and make sure it runs smoothly.

Processes in the food and beverage industry.

Within the quick service sector of the food and beverage industry, their seems to be two prevailing processes when it comes to taking a customer’s order, filling that order, and accepting payment. The order of these steps can change the way a customer perceives a restaurant and can influence revenue directly.

The most common version of this process includes recording the customer’s order, accepting payment, then filling the order. This process can be seen in many major fast food chains and seems to be the most efficient way to conduct this process however there are other options that can change the tone of the order taking process entirely.

Another, slightly less popular method for this process is to first take the customer’s order, then fill the order, then accept payment at the end of the process. This is more useful in situations where an order requires a lot of customization and options that do not influence the price of a product. This can also lead to less perceived waiting time because the customer is constantly engaged in the food making process thus, making the time seem to pass more quickly.

Each of these methods has their strengths and weaknesses in certain situations which are why there is no single best method for this process. The main tradeoff seems to be in the amount of perceived waiting time versus the actual waiting time where the first method usually has less actual waiting time and the second method usually has less perceived waiting time.

– Thomas Skowronski