Видео

😂 no comment

Without knowing more about the request, this can be a bit vague. But basically which organisations will be using, processing or sharing the information to hand? It is clients, Microsoft 365, Google, suppliers?

When it comes to the self-assessment the majority of the answers will be a yes or no depending upon the requirement. Make sure for the endpoints you list the operating system version, the edition of windows, and that its supported. Also for mobile phones. Make sure web browsers are all up to date.

@@Isgovern thank you very much

Hello, sorry about the delay replying. If you are not excluding anything from the assessment. Saying "Whole Organisation" would be the best option.

Happy we can help 😁

Glad it was helpful!

Hello, SSLv2 and SSLv3 are now deemed obsolete and insecure as defined by the industry. TLS 1.2 and above is now recommended to be used.

Not that I've seen, I'm afraid, but if you find out, do let us know.

You can use software restriction policies, set de default level as user-level and then add the paths you allow as unrestricted, dont's forget to exclude or add the file types you want to whitelist.

Glad you liked it!

Yes it does, ISO 27001 is a lot more indepth and is a information security framework. But it also requires a lot more attention to upkeep and cost.

Not a problem

Our pleasure!

Yes, you would have to manually set this on each device.

glad you like, check our website blog site for more info, if needed.

it's not really a vulnerability, you could recommend to them that they disable it and use tls 1.2 or higher instead and see what happens

Congrats on the new job. Glad we could help.

hi there, unfortunately we're a Microsoft house so haven't tested this on macOS, but will have a play around and see if we can get to the bottom of it.

Yeah that's the problem with registry based systems. You may be able to try restarting the Web server service, but that Will also impact service. If it's production ideally you will have load balancers in place and multiple Web servers to keep service up during maintenance windows.

It basically depends upon how you build out your AD and group structure. By default it wont be that granular as you have to define and basically assign permissions to groups against OUs. So if you are looking for flexibility you may be better off looking for a third-party solution.

No it won't. even using ftps over ssl on newer systems won't cause any issues.

@@Isgovern I was audited and these were open how can I test on a windows server since sslscan doesn't work?

@@reneekoebler663 Hello, if you have a look in the registry and check the values. This website can help you learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/manage-ssl-protocols-in-ad-fs

hello, yes it should, those older weaker protocols won't impact any communication on newer browsers/systems. unless your application is designed for those older protocols.

Hello, if you are looking in the the Control Panel section, this is mainly for support for web browsers. The changing of the registry key is separate to this and will disable TLS on the actual machine. If you wanted to disable TLS support in the browser as well (which would stop the browser accessing any old sites with TLS 1.0/TLS 1.1) you can disable this option.

Hello, if you would like to check that TLS 1.0/TLS 1.1 has been disabled you can either run another vulnerability scan report via something like OpenVAS, Nessus Essentials, or via a OpenSSL command such as "openssl s_client -connect www.myhost.something:443 -tls1", however you would have to download and install OpenSSL on a Windows machine.

Hello, have you disabled the client and server sections? Has the machine been rebooted? Check the results from Nessus and try and compare with your results.

Definitely, you need to know what you have first, usually done as an Audit process of some sort.

Hello, yes it will, disabling these older SSL and TLS protocols will apply to everything that uses secure connections on the Windows device.

Indeed, use a password manager to generate a strong unique password. Even use two-factor authentication as well, this will stop this type of attack.

I don't have this list of pass or of users can send me God bless u

Not a problem, the IASME website - www.iasme.co.uk have a lot of information now, especially within their Blog area.

Hello, Microsoft laps is a free download and can be used on any machine. The only licensing you need is a valid active directory license for your server.

Glad we could help

for this question you need to list how many servers you have and their OS version, for example 2 x VMWare ESX 7.0, 3 x Windows Server 2019. Does this help? feel free to get in touch with us at info@isgovern.com

Not a problem, glad this helped.

You're welcome!

Hello, when it comes to server and client. The server part is used when used with a web server or some kind of software which will be presenting information to the web browser (the client). Whereas the client part is used to tell the operating system or web browser what security ciphers/protocols can be used and accepted from the web server. Regarding your webservice, we can't really support you on this, but if its exposed on the internet you could test it against www.ssllabs.com/ssltest/ to see if it highlights anything

Hello Marc, in the video we were using Kali Linux and using the tools 'sslscan', its primarily designed for Linux based systems, but you can also get it working on Windows. You can find their GitHub page here: github.com/rbsec/sslscan

@@Isgovern Thanks. I got the Kali Linux box setup, but now I get a connection refused, I assume it is firewall blocking, I setup a rule to allow, but doesn't seem to be working as the connection is still being refused or rejected

@@marclewis6799 weird, not seen that before. Can you browse the site with a web browser over ssl?

@@Isgovern there is no site just trying to check a windows 10 machine and disable old protocols, once I verify it works I will implement the disablement of the protocols via group policy as you recommended. just trying to verify the disablement is working.

Hello, thanks for the feedback, we've recently improved the audio and will look at the captioning process to ensure this doesn't happen in the future.