How Net Anonymity Works?

In practice, most of internet anonymous services are only exposing your net identity in a different manner, even more obvious and only in a noisier way!
Tor and The Dark Net In 2018
Are You Tired of All The Spying and Lack of Privacy on The Internet?

ong story short, if your are concerned about so-called ‘Privacy‘, do not rely on popular techniques and tools of net anonymity. for example, when you connect to a VPN service to hide your real IP address, either free or paid, you just enter a private smaller, easier to monitor (of course does not necessary mean ‘eavesdropping’), easier to track part of the larger internet.

Do solutions like VPN really hide our net presence or they only make our internet footprint exposure exclusive?

Accessing The Deep Web & Dark Web With Tor
Would You Like To Learn Exactly How To Protect Your Identity On The Web?

hat means tracing back to each single of your online movement related to your identity, which is ‘your unique online presence’ and your internet footprint or online signature, is much more easier and even more precise. Even not considering the fact, that no one can stay 100% hidden forever, or being naturally born hidden, which means you already have some (a lot of) footprint on larger public internet, and now with browsing for example via a private IP, you just consciously connect the dots for data brokers. This is not a fiction and it is actually happening practically when dealing with browser cache, cookies and many other server and client-side elements of your online activity.

Net Anonymity services simply change the scope of your identity exposure to a exclusive, limited and restricted environment which leads to a highly precise identification and a better, realistic version of your internet footprint!

The real Net anonymity is not achievable via popular online services. However, there are certain techniques which can be implemented via free simple tools on a paid dedicated hosting, within an small community, for example your family, or your friends. In a nutshell, it is technically possible to have practical and reasonable anonymous internet identity only via a private entity with a limited restricted ownership:

Get a dedicated physical server online, or set it up with dynamic DNS on your current home internet connection, setup a few application to mimic a fast HTTP and SOCK proxy and then route your peers via VPN or P2P protocols to real world. in this case, the footprint would belong to only that small community, and ‘retain’ and accessible only within that P2P network. With certain techniques, you can send and receive communication completely untraceable to individuals. This can be accomplished if you have an IT guru nearby.

Naturally Secure Windows Machine

How to utilize native Windows security features to get beyond all the tools in the market?!
Windows Security Monitoring: Scenarios and Patterns
Dig deep into the Windows auditing subsystem

Most of the times ‘extra tools’ are just for doing things in a different way, perhaps more convenient, but not necessary in a better way, or more effective, cheaper or faster way and Windows is not an exception. Speaking of Windows security features, all the features we need are already part of operating system, they are either initially included or later provided by Microsoft. There are exceptions, but only when we are looking for a totally different structure, a very unique extraordinary situation, and that is where what we want is behind the Windows native features and capabilities, so we have to add something to the kernel or expand the API.

Windows 10 for Enterprise Administrators
Enhance your enterprise administration skills…

Windows Firewall and power of Micro Segmentation, EFS and power of Windows native file-level encryption, basic Access Supervisory via powerful native to kernel, Windows Event Monitoring and Sysmon, Group Policy and world of unlimited capabilities, PowerShell and unexpected security administration possibilities… and many more unleashed Windows features are already there, you just need to utilize them before thinking of buying a new tool!

In following articles I will explain how to unleash Windows native security features before shopping for a tool. Even though tools might be free, why add anything to Windows when it is already packed with most of the necessities? Let’s get through the basics briefly:

Zyxel ZyWALL (USG) UTM Firewall
Perfect for small offices…

Windows Firewall provides all you need as the cheapest and fastest host-based firewall for Windows. It does not matter if the target machine is part of a corporate network or small office or home computer. Most importantly, it is very easy to utilize it as part of your micro-segmentation and see how you can reach the effective filtering and totally eliminate lateral propagation of malware in a large scale network. But if you ask me why administrators ignore Windows Firewall, I have no explanation unless admitting that beauty of third-party firewalls totally blinds them!

Encryption in a Windows Environment
encryption is nothing new to Windows…

Encrypting File System (EFS) is a powerful file encryption which surprisingly has been ignored among new generation of IT administrators. Perhaps ‘encryption’ is enough scarry for most of IT staff to deal with so they decide to rely on third-party colorful tools, but I will show you later how to use EFS as the integral part of ACL and take your access supervision to next level!

We will deep dive into one of the most effective monitoring extensions of Windows, Sysmon, and see how a couple of extra megabytes can change the scope of Windows Event audit trial, needless to say Windows event log is a quiet piece of intelligence where all those shinny system and network monitoring tools are relying on, and if we add a little bit of AI to it how a free SIEM could evolve from it!

Master PowerShell Tricks
41 chapters of intense PowerShell learning…

The point is, Windows has enough native tools to touch almost anything you want in terms of security, and for some hidden tiny tweaks we could always get into Registry, at least we won’t be worried about extra security vulnerabilities result of introducing new tools to environment, so why not get more familiar with the operating system and get maximum benefit from its native security features and capabilities? Then some day if you had a very specific requirement which Windows was not capable of providing it, you could consider using third-party tools or even switching to a whole new operating system!

Security Program: How To Thrive?

From struggling or hardly surviving, to a fully supervised and manageable security program…
Cybersecurity Program Development for Business
what cybersecurity risks are and the decisions executives need to make…

Most companies are struggling with running an smooth security program. No matter how much they are spending on that, the difference is really not that much. From zero budget to million dollars security budgets, they still do not have enough trust in their security program. Regardless of how much they are spending on security initiatives, they never really have confidence and are not expected to see positive and reliable result of their investment.

Adversaries are finding new ways to hurt online businesses every single minutes while tech gurus are creating “solutions” to address today’s challenges within months, years and sometimes decades after the fact!

We simply are only trying to survive in cyberspace, but what could we do better to thrive, in a stronger position, where the security is not a hassle anymore, and it should not be the heart of the matter too. Let’s look at some practical countermeasures:

* stick to a management system

Security Operations Management
reference on corporate security management operations…

For a moment forget about technology and tools and get back to basics. A management system could totally fulfill whatever you need in terms of handling processes and not being worried about base of your operation. You can invent the wheel again or you can choose from thousands of management systems, but first ask experts which system fits your needs or bring professional on-board to implement a system fully customized to your work flow from scratch, also believe me, without a management system of any kind and approach, you will be still at the first step after years spending your precious time, which is that “surviving” approach.

* set objectives

any project has a set of goals which are measurable and achievable. Objectives are neither like: having a more secure network…or, setup RDP filtering on firewalls…there are more like reducing current number of entry points to network…or, assessing current remote protocol insecurities…

objectives help you better understand what are trying to get from your management system, and where resources have to be focused. This topic is also related to Risk approach which I think is the fundamental and background of the management system.

* constantly measure

These are checkpoints where you can tell precisely and by evidence if you are on the track, and the more you measure and automate the process, the more you get close to a proactive system and faster accomplishing each of objectives. Through measurement you can tell of direction is write or wrong, or what is wrong or right.

* plan for corrective and preventive actions

with each measurement you need to define corrective actions if the result is not expected or the pace is slow, and the plan to enforce these corrective actions is the key to a smooth security program, otherwise you will be struggling with past actions while new ones arrive.

* be responsive to facts not fictions

computer security industry is full of fictions, and we mostly spend time and money on things which are either not important or can be tackled from root, so let me give you an example:

taking Advil when
you catch flu is just a pain killer, only for passing time without
suffering from flu symptoms, just to survive, because we do not know
how to handle flu virus in 21st century (or maybe we know
but we don’t want to disclose?!), and that is similar to running a
virus scan on your network when you get a virus infection!

Cyber security facts have not been changed since the beginning of this subject in human history, so once you know about the facts you see how it is easy to address them without Advil!

Complexity: The Hidden Monster behind Insecurity

No doubt that companies struggle with information security these days. Today they spend hundreds of thousand dollars, some millions, tomorrow they realize they have done nothing! Security folks do not have peaceful night sleep, because they know what they have done during the day could easy be compromised!

Regardless of why we are spending money while we are not certain or confident to an expected outcome, why solutions really getting more and more useless and ineffective? The answer is the hidden monster behind all insecurities within information technology: the complexity beast!

Complex systems introduce complex work flows which are prone to intensive security flaws!

Complicated systems (which are also prone to insufficiency) introduce complex work flows and a model which is naturally prone to have more flaws, result of more surface for the attack and more attack vectors with combined magnitude and even unexpected new evolved way of attach. This is not fiction, this is the dynamic of today’s cyber security trend. You hire, you purchase, you train, you consult… you do your best and still you are not confident cause your neighbor company just had a breach and you will be more scared if you have pro visibility and see how malicious actors are already in-house!

Traditions have proven outcome already messaged, although market hesitate to listen, let alone to follow!

Lean Software Development: Efficient Deployment Strategies
Do you want to cut waste all across your deployment strategies?

Fancy systems are more attractive to adversaries also, and there is reason behind it because they know how the chance of finding a flaw is exponentially higher when they see a fancy colorful IT infrastructure vs a clunky system out there. The worst part of this is that, customers of that fancy information system do not necessarily get better services or goods (products) even they pay more for it, they are also prone to lose more due to a complex system as backend, but that is another story with its own sad ending.

Complex software and hardware build complex systems

Clean Code: A Handbook of Agile Software Craftsmanship
Even bad code can function. But if code isn’t clean, it can bring a development organization to its knees…

Complex systems are built around complex software, hardware and literally a complex IT setup where a given goal is accomplished through a complicated workflow, and this is either result of poor design, or just excess resource assignment where it is not needed at all. There are millions of examples you look around, or better, start by your own business or department you are managing:

  • Do you think all businesses need Windows platform to run applications?
  • Do you think you use even 20% of Outlook features and capabilities?
  • Do you think most website owners need PHP vs simple HTML?
  • Have you ever walked to your company server room and ask your IT guy why things are setup like that?
  • Have you ever tried simpler software vs the one with more features?
  • Have you ever shopped based on what you need vs what has higher score reviews?

Those are just goofy questions just to fire up the real flame inside you which makes you as yourself: should I really totally trust people that are running my IT infrastructure, or I could use my common sense and just question why I need these complex system? What workflow my business really need and then what simple system is out there to support my workflow regardless of what market is pushing me to buy.

Complex system setup puts us in more trouble when we start securing it with the consistent complicated mindset, and that’s where we could end up having more insecurities after spending and relying on sophisticated security solutions. Experience has shown and proven that the simplest way to address security is designing and implementing a simple system, an straightforward workflow is naturally secure, or easier to secure with even free or cheap security solutions which are easier to maintain, manage and run, so the outcome is more secure and cheaper and more reliable and efficient.