I.T.HINK …So you don't have too…

10/4/19

After many, many months of studying, labbing, making a complete inside/outside zone network with OSSIM SIEM and OSSEC, deploying as many of the concept required in the lab I finally passed.

My journey started after the CySA+ and after reaching out to Teresa Varela, (Director of IT Workforce Solutions/Skills Certification) about help with the CASP+, she put me in contact with Patrick Lane.

Patrick Lane (Director of the cybersecurity program), he’s the creator of the cybersecurity program in recent years with the CySA+, PenTest+, and CASP+. He felt inspired by my drive and determination to pass the exam and blessed me with a sponsorship thru the CASP+ certification program. 

Patrick hooked me up with study material, CertMaster sims, and the best part, exam vouchers. I felt it was my purpose to live up to his vision of me as a CASP. But along the way, he was right there with me helping me in whatever way he could. He couldn’t really help me cause he made the program. BUT…he did one better…

He put me in contact with a industry leader, Anthony Sequeira, (CCIE No. 15626), who mentored me and helped me get the knowledge gaps that I was having, but in the end I just was determined to pass the exam. 

I took the exam, the 1st attempt on June 26th, and I felt confident but the exam was a fail. I felt demoralized, deflated, but I was more determined to pass it. For 3 months I spent more time than I care to admit, my parents saw me less and less, the significant other was getting upset I wasn’t spending time with her, my dog started to rebel, my living space started getting messy, I was only sleeping 5 hours a day in the final weeks; I was utterly determined to pass! – cause I knew this material after reading the entire NIST SP 800 series numerous times.

In the final hour, in the last 3 weeks before the 2nd attempt the ITPro.TV just released an updated CAS-003 video series by Adam Gordon and it was rock solid. I finally understood the content I was missing. I spent over 50+ hours to study for 3 weeks, yes this meant less sleep.

I felt much more confident after doing that video series, and using the CASP Prep App, and lots of practice tests. When I sat the exam on October 2nd I felt much better.

Got to the exam about an hour early and took a nap and then went in 20 minutes earlier and had a good conversation with the proctor who was also a MCSE and then I was off.

I felt the exam was much easier now that I had time to review some weak points, for 3 months, lol. I went to the extent this time to setup a 3 tier PKI, setup a SSO with Federation Services with a token, Setup an inside and outside firewall setup in the home-lab, also setup a SIEM with log monitoring, deploy a Kali Linux box to be used as a penetration testing tool. I went all out…it paid off…

Now I’m going to finish up the MCSE: 2016, move onward into the CompTIA PenTest+, CompTIA Server+ (just so my server knowledge is neutral) then do another VMware VCP, and go for a VMware VCAP. Someplace in there I wanna get my CCNA renewed and then go for my CCNP: R&S to round out the mix. WE don’t use Cisco really, but I want to learn the advanced level networking that Cisco is really good at teaching you. 🙂

If anything this obvious, I WILL get all these, as I have the persistence, motivation, and determination to achieve. 

Cheers!

-Trevor

4/4/19

Finding that using these commands on a daily basis help me troubleshoot issues and just wanted to share:

netstat -f = this command tried to resolve every connection to their FQDN

netstat -r = this command show the local routing tables on the PC

netstat -a = show all active TCP/IP connections on the PC

netstat -e = this shows any errors on the network adapters or lost packets

ping -t = this allows for a constant ping of an address

ipconfig = this show basic network configuration of the local adapter

ipconfig /all = this shows every detail about all network adapters on the local PC

arp -a = this show the mac address table on the local machine for the devices it’s “talked” to on the network and has saved in memory. Once you reboot this table clears.

nslookup [internal IP or external IP or FQDN] = this commands allow me to resolve internal or external dns names to see what address come back, if the response on local addresses comes back with a :unknown: this means that reverse DNS lookup is not setup.

Useful command on checking to see if a networks DNS server is secure:

1. type ‘nslookup’
2. type ‘DNS servers IP address]’ and press enter – cheat: do a nslookup [name of the local domain if you hover over the network adapter on the Windows desktop and this will reveal the local DNS server IP address]
3. type ‘set type=any’ and press enter – note: notice no spaces
4.  type ‘ls -d [domain name] – [domain name is the name of the domain that you found in the hint in #2 above or any public domain like google.com as an example]
5. If this comes back with the SOA, NS, A, and MX records then this domain is allowing zone transfers and this is BAD! – it means I could redirect DNS to a rogue DNS server

Below is an example of  what a blocked zone transfer looks like in a mock DNS server in the lab.

Zone Transfer Blocked!

Useful Website for looking up the security of a public website:

https://tools.pingdom.com/#5a7a0a61d8000000

I hope this little write up is helpful to some. 🙂

Always-be-Labbing!

~Trevor

2/5/19

SIEM systems are something more and more people are adopting to use with defense-in-depth and its a good move.

The company I work for partners with a SIEM solution provider called SocSoter and they have these affordable units that you deploy on a network and it has an interface in every network device you desire.

These device come in a few flavors, a VMS and SMA to name a couple. The SMA proactively monitors the network that it’s mirroring and allows for syslog monitoring of switches and storage appliances including taking Windows Server Event logs. On the flip side the VMS does proactive vulnerability scans of the network to find problems with the network/systems and provides steps on how to fix them.

These devices, when used in conjunction with directory services like Active Directory, Edge Firewalls, Next Generation AV, auditing policies, 802.1X, routing cryptography, and inline/at-rest encryption enables the deployment of a very comprehensive defense-in-depth approach to security. 🙂

2/5/19

I’d like to discuss a few things around the classification of data types coming thru a firewall or security device. I think pretty much even know the slang of false positives, but there is in-fact 4 types.

1. True Positive – means an action was taken, that was true and accurate
2. True Negative – means it has not acted, because there was no activity
3. False Positive – means a security control acted based on a threat but it was a error
4. False Negative – means the security control didn’t act even though there was a threat

11/28/18

As a form of motivation and because I’m finding with work being so crazy busy I’m having less and less time to devote to studies. But I’ve made a plan for me (been working this plan for about a month now) to read 2 hours every day either in the morning or at night (considering most nights I don’t go to bed til 11 pm for either work projects or reading) and then wking up at 4 to 6 am to study takes it’s toll on me.

But I’m on the last 5 chapters of review with the CompTIA CASP+ exam and I plan on taking the exam in the last weeks of January, so I’m committed to this journey, not stopping now!

I know this has been a 5+ month charge but I had no idea the CASP book, CAS-003, would have so much technical knowledge in it, moreso than the CompTIA CySA+. I love reading the book but my brain feels like it’s going to explode.

I do feel more relevant and useful in my day-to-day though after reading, labbing, and studying the material and it’s funny all three of those doesn’t even touch that I do use 60% of the CASP’s content daily at my job. So that right there just goes to show how much of it is relevant information.

Recently went to a CompTIA CIO Roundtable discussion in NYC, yesterday in-fact, and it was very interesting to hear CISSP’s talk about cybersecurity and how I don’t really want to be in management-level cybersecurity but actually in the trenches doing the 1’s and 0’s and that is where the CompTIA CASP+ shines. I look forward to the journey in the technical side of cybersecurity.

-Trevor

Hey peeps,

So just want to share some things for you to make sure you have enabled to ensure the best possible security posture on your network, just a few tidbits.

1.  Ensure in Windows Server DNS under Zone Transfers that you define your DNS Name Server that are allowed to make transfers and set it to allow only those servers. This way rogue attackers can’t seize your DNS records. Once you do with open up a Linux machine and type “dig afxr [your DNS server].yourdomain.com yourdomain.com” and see if you can or can’t get a zone transfer, the goal is for you to not have one. 😛

2. Make sure that your firewalls on the WAN/LAN ports block ICMP requests. This way when someone does a tracert of your DNS servers or network they can’t resolve any of your servers. Example: if you did a tracert of domain, typically the last two addresses are internal resources. if you do a tracert and then comes back with a * * then this means ICMP is blocked; this is what you want!

3. Make sure on routers that you have CHAP authentication enabled for all routers and L3 switches that share routing typically the command to enable this (like on Cisco) is “encapsulation ppp” and then the two modes are PAP which send the password in cleartext or with CHAP (the preferred method) which doesn’t send the password in the clear but instead salts the password so that routers and L3 switches with the CHAP can validate that the device is authorized to update the routes and routing tables, this way you can prevent routing tables from being poisoned with false routes from rogue routers and man-in-the-middle attacks.

4. A useful tool for malware sandboxing, vulnerability assessment and SIEM is a appliance provided by SocSoter and those interested should seek them out.

Just some security minded pointers. 🙂

8/11/18

So I did it, I stopped procrastinating the reading and I hunkered down for two month and passed the exam. I even cancelled my World of Warcraft Subscription that I reactivated for some reason for a month??? O.o .. maybe I was bit nostalgic of years past… 😛 — But I wanted to focus so I didn’t renew it, glad I did! 🙂

Honestly going into the exam I thought I flunked it. But after just 40 minutes I got done with all of the questions, I had all of the simulation in the beginning and from past experience flagged them all and went on-to the questions. This saved me a bunch of time, but time I actually didn’t need. They were easy simulations, I just hyped myself thinking they were harder.

I really enjoyed the prep work and exam, I feel much better about security and now being 3 years since I took the Security+, it was a nice fresher.

The knowledge gained for the prep and learning I’ve been applying in my day-to-day and I want to go onward into the CompTIA CASP and the newly drafted PenTest+ course. For now since the PenTest+ is so new, as in this month, I’m going onward into CASP. I think that cyber security is a big issue in IT and I felt the need to get my foot in the door. If I want to work in the cloud, I really need to make solutions that accomplish the results customers need and at the same time have the level of security required to protect assets from external attackers and to mitigate these threats, the CompTIA CySA+ helped me in this area.

I already have the CAS-002 and just got the CAS-003 books from Amazon. I’m already up to chapter 3 in the CAS-003 book and plan to attempt the exam the end of September. 😛

My goal for the rest of 2018 is to pass the CASP and the Microsoft 70-413 exam. This way I get a VCP6-NV, CompTIA CySA+, CompTIA CASP, and a Microsoft MCSA: 2012 for 2018. In 2019 I’ll wrap up with the MCSE: 2012 and then recertify the VCP6 to VCP6.5-DCV.

My goals for 2019 are: VCP6.5-DCV, MCSE: 2012, MCSE:2016, and VCP7-CMA. Maybe someplace in there I’ll do CompTIA Pentest+. 2020 will be CISSP, CCNA: R&S v3 and a VMware vCAP (undecided which one).

6/26/18

Hey all,

So with me taking the CySA+ exam in a little over 2 weeks after many months now of studying and bringing myself up to speed with Kali Linux, I feel the need to make a new title for upcoming pages. All pages that are Cyber Security oriented will start with the tag “Cyber Security:”.

I feel that in order for me to really stay relevant in the cloud that I really needed an intermediate to advanced knowledge of “Defense in Layers” and then how to penetrate those “Layers of Defense” so that I can provide defense from said attacks as I go about making cloud solutions moving forward.

The biggest concern of all customers and providers alike is not only the cost of the cloud, moving to the cloud but more-so than ever the security around the cloud.

3/25/18

Well I did it, passed the VCP6-NV exam. it’s been an adventure and a journey. After failing the exam in January I was to be honest very disheartened by that loss and I was slow to get back on the bandwagon. Took me nearly 3 weeks to pony up the energy to study again. But study I did, from 2 am til 7 am every morning for 2 months after working out on the Bowflex Xtreme 2 SE I would study: labs, watch Pluralsight, read VMware press micro-books on NSX, and the official VCP6-NV book over and over again. Also read all of the NSX guides on the Kindle that I could muster.

I’d like to personally thank Chris McCann who with Eva Leong at VMware the were gracious enough to provide me resources and voucher for me to take the exam, after all they did bestow upon me the VMUG NV package back in May of last year; it’s been a long journey, but fun along the way.

I plan on now finishing up my MCSE:2016 track as I got some more to take, but I’d like to pursue the VCAP6-NV track or is it VCIX? O.o dunno the names keep changing.

So my next goal is the MCSE, the the CompTIA CSA+, then back to VCAP6-NV.  I’d like to dabble into VCP7-DTM too. Maybe I’ll aim for all 4 of them. 😉

I will admit, having my Cisco background did help a little bit but more-so having an actual home-lab with Cisco and Netgear switches was even more useful, having those 10G switches and 10G CNA’s really paid off for labbing.

My only advice for anyone planning on taking the exam themselves: study the NSX design guide, get the 5 book bundle of NSX VMware Press mini books, watch videos on Pluralsight and then this is key, after you study take a 23 minute nap to retain the knowledge. Drink plenty of water and eat clean. 🙂

Persistence is key..

3/13/18

Decided to apply an SSL certificate, get premium DNS, and Mcafee Secure virus protection (you’ll see it in the bottom right of the page). Wanted to increase the blog security and sustainability and provide some reassurance to viewers that this site is protected. 🙂

-Trevor

Figured I’d get this up here as I’m deep in the NSX track right now. 🙂

2/18/18

So my goals for 2018 are smaller that 2017 but none the less intense.

I currently working on the VCP6-NV study, after failing the exam last month by about 20 points. So I’m working very hard at studying to pass the exam in a litter over 5 weeks.

After that I’ll be studying for the CompTIA CSA+ and MCSE: SI 2016, if I have time the AWS:SA. That’s my goal for 2018. it’s a smaller list than last year but no less focused. Once I get those 3 exams after NSX I’ll decide the path I’ll take next.

I think VCIX-NV is my next goal with VCIX-DCA shortly afterwards.

Sometime down the road CompTIA CASP and CISSP are on my roadmap but I need a few more years, for me, before I decide ot go down that path.

I’d like to make a fresh attempt at my CCNA: R&S and DC at some point and perhaps a CCNP just to have the knowledge when designing VMware infrastructures.

On a personal note, my goal fiscally is to get 30k into savings and to invest 15k. For my health, I bought a Bowflex Total Gym and my goals with that is to get into fit and trimmed shape.

I’d like to keep journaling daily, working on reading a leisure book a week, keep saving money, building my credit score upwards to 775, blogging on here more often, getting a few modifications for my new Subaru WRX, spending more time with my parents and dog, spending more time with my friends and doing a little bit of traveling. I’ve recently got into cooking, painting, and playing my grandfather guitar, so my list of hobbies just seems to keep on growing….

somewhere along the lines I hope to meet an amazing woman again after now being single for almost 2 years in April. But my goals aren’t on that part of my life as my life is very busy and focused and that’s most important to me. My goal by 2020 is to strongly consider buying a house.

But this is my outlook for 2018.

Hey peeps,

so wanted to update the blog. Passed the 70-410 and 411 recently and onward to 412, then 413 and 414 for MCSE 2012.

I felt it was needed for me to get a MCSE since I’m a VCP and they go hand-n-hand. Plus I wanted to have the credential to back me up so I can no longer have people judge me by what I say. 😛

So take that judgemental fellow IT people, take that and shove it up you a**! 😉

I know I’m kind of late with this, but better late than never. Been really busy with work, but I wanted to put this up on the blog. 🙂

I was on the VMware forums on Wednesday and one of the biggest names in Software Defined Networking at VMware made a posting about a offering VMware was giving away in regards to training for VMware’s Software-Defined Networking for the datacenter and for vCloud, the software behind what makes the ‘cloud’ a reality for MSP industry who are “in-deep” as they say, so I was like sure why not I’ll make a post about my career and see what happens…

I feel that for the MSP world to really work, there needs to be a shift from private clouds to a hybrid with a public to public IaaS fabric that solves one of the biggest problems in IT right now, Security. VMware NSX is one of the most secure public to public frameworks I have ever seen. It solves the problems we, as IT professionals face, in regards to the concerns of customers around security and this was expressed in the posting.

Well, I was a little shocked this morning, as I got selected!
Here is what the reward was and what they asked. 🙂

3/27/17

Well after a few months of studying and failing the exam the end of December I wanted to pass it this time, so I blew away my home-lab like 5 times and did it in 4 different ways to make sure I knew the content. Took the exam on March 25th and passed the exam with a score of 383.

Now onto the road towards the following exams:

1. VCP6-NV
2. VCP6-DTM
3. CompTIA CSA+
4. MCSE: 2012
5. VCP6-CMA
6. VCAP? – one of them…. to-be-determined!

Nuff said….