Most roles need to be configured, but some of them won’t like the RD License Server. By default, you’ll need SSL (x.509) certificates at every stage of connecting to a session or hosted virtual machine (VM). There are three main purposes for this: to secure communications between client and server, to confirm the identity of the server or Web site to which the client is connecting, and to sign Remote Desktop Protocol (RDP) files so your users know the RDP file comes from a trusted source and hasn’t been altered.

These are examples of how RDS uses certificates:

• RD Session Host servers use certificates to prove their identity. This is called server authentication.
• RD Session Host servers and RD Virtualization Host servers use certificates to set up a secure link between client and server with TLS 1.0.
• RD Session Host Servers use certificates for client authentication required for Network Level Authentication (NLA), Single Sign-On (SSO) and implementing Web SSO.
• RD Session Host servers and RD Connection Broker both use an SSL certificate to sign RemoteApps and VM RDP files, assuring users they’re launching a trusted file.
• RD Gateway servers use certificates to encrypt communications with clients using TLS 1.0.
• You can secure the RD Web Access site with an SSL certificate to ensure that people are going to a trusted site (HTTPS).

Enabling RDS functionality relies on specific technologies to support the use of certificates

How to Secure the Channel

TLS is the Internet Engineering Task Force (IETF) standard based on SSL version 3, published by Netscape. Some of the enhancements to TLS include new message alerts, the ability to chain certificates to an intermediary Certificate Authority (CA) certificate instead of the root CA certificate, and slightly different encryption algorithms from SSL.

Although TLS is based on SSL, the two are incompatible. TLS can, however, implement a mechanism by which it can fall back to SSL version 3 if necessary. To establish a secure communication channel between a client and server using TLS, the client and server go through a process of messaging, response and encryption.

There are two requirements for this process to work properly.

• The client must trust the CA that signs the server’s SSL certificate.
• The connection between server and client must use high-level (by default) or Federal Information Processing Standard (FIPS) encryption. Low-level encryption only encrypts the traffic from client to server, not server to client, so it’s not a secure way to send security capabilities or shared secrets.

If the connection and encryption level meets those two requirements, the client and server establish communication as follows:

1. The client sends a hello message along with a random fixed-length value. The server responds with a random fixed-length value. During this exchange, the client tells the server the compression methods, ciphers and hashes it supports. It also sends its protocol version and a session ID to the server. The session ID identifies the communi­cation channel—this is not the Session ID on an RD Session Host server.
2. The server picks the highest encryption method they both support and a cipher and hash function from the client’s list. Then it tells the client which one it has cho­sen. If there’s a minimum level set for the server and the client can’t meet this minimum, the connection will fail.
3. The server sends its digital certificate to the client. This certificate contains the server’s name, the trusted CA that signed the certificate and the server’s public key.
4. The client verifies the certificate is valid and trusted. The certificate used to sign the server certificate will be in the client’s Trusted Root Certification Authorities store. Then it creates a pre-master secret, encrypts it with the server’s public key and sends it to the server.
5. The server receives and decrypts the pre-master secret with its private key. This server is the only one that can do this because it’s the only server with the matching private key.
6. Both the server and client have the pre-master secret and random numbers exchanged at the beginning of the process. They use these values to generate the 48-byte master secret (also known as the shared secret). After generating the master secret, they delete the pre-master secret.
7. Both client and server then hash the 48-byte master secret and use it to generate the MAC secret (the session key used for hashing) and the WRITE key (the session key used for encryption). These keys encrypt and decrypt communication for this session. After the session is over, the keys are discarded.

If any step of this sequence doesn’t work, the connection hasn’t been fully secured. What happens then depends on the Advanced tab settings on the Remote Desktop Connec­tion (RDC) client. In the case of authentication failure, a user can choose to do any one of the following:

• Connect anyway without notifying the client there was a problem authenticating the server.
• Warn the client, but still allow the connection (the default setting).
• Deny the connection if it can’t be verified.

The exception is if the server requires a minimum security level. If that’s the case and the client can’t meet the minimum level, the connection will fail. By default, the client and server will negotiate and use the most secure connection settings they both support.

Credential Caching with CredSSP

Credential caching was introduced with Windows Vista and Windows Server 2008. This enables two features—one that helps the user and one that helps protect the server.

Credential caching helps users by storing credentials for a particular connection so they don’t need to provide them every time they connect to that server (this is SSO). This speeds up the connection. Otherwise a brokered connection must be checked at each step.

On the server side, credential caching provides credentials to the server before it establishes a session. This avoids the overhead of a session if the user isn’t authorized (this is NLA).

The piece that makes credential caching work is the Credential Security Service Provider (CredSSP). This is supported by Windows 7, Windows Vista, Windows Server 2008 and Windows XP SP3. It isn’t linked to the version of RDC being used because CredSSP is part of the OS. CredSSP performs the following functions:

• For NLA, CredSSP provides the framework that authenticates a user to an RD Session Host server before fully establishing the connection.
• For reconnecting to a session within a farm, CredSSP speeds the process of passing the connection to the correct server by letting the RD Session Host server see who’s logging on without having to create an entire session. This uses NLA in a slightly different scenario.
• For SSO, CredSSP stores user credentials and passes them to the RD Session Host server to automate logon.

CredSSP enables mutual authentication of the server and client.

This authentication process takes the following steps.

1. The client initiates a secure channel with the server using TLS. The server passes back the certificate with its name, CA and public key. Only the server is identified. The client remains anonymous at this point.
2. When the session is established and a session key created, CredSSP uses the Simple and Protected GSS-API Negotiation (SPNEGO) protocol to mutually authenti­cate the server and client. Basically, this mechanism lets the client and server agree on an authentication mechanism they both support, such as Kerberos or Windows NT LAN Manager (NTLM).
3. After mutual authentication is finished, CredSSP on the client side encrypts the server’s certificate with the session key created during step 2, and sends it to the server. The server receives the encrypted certificate, decrypts it with its private key, and then adds one to the most significant bit of the certificate number. It then encrypts the result and sends it back to the client. The latter operation ensures that no one can intercept the exchange between client and server and spoof the server.
4. The client reviews the encrypted certificate received from the server and com­pares it to its own certificate.
5. Assuming the results match, CredSSP on the client side sends the user credentials to the server.

Authenticating Server Identity

One danger of communicating with a remote computer that requires you to supply your credentials is that the server might not be what you think. If it’s a rogue server impersonating a trusted one, you could inadvertently type your credentials into the wrong server. This would give attackers everything they need to connect to your domain or server.

RDP includes encryption, but the protocol doesn’t have any means to authenticate the server. That’s where TLS and CredSSP come in. Server Authentication checks the name you enter in the RDC client (or RDP file) against the name issued in the certificate specified in the RD Configuration Tool on the RD Session Host server to which it’s connected.

Signing RDP Files

You can use certificates to digitally sign RemoteApp files, as well as RDP files used to connect to a pooled or personal VM (VDI). Signing these files assures the user they were created by a trusted source. It also secures the RDP file from tampering.

Signing RemoteApp files is also required for implementing Web SSO. This lets users sign in once to the RD Web Access Web site. Then they can launch RemoteApps from any farm without having to provide their credentials again.

CredSSP can’t pass credentials to RD Web Access. The user must first log in to the Web site to store their credentials. Then they won’t need to authenticate again to start RemoteApp programs. For this to work, the RemoteApps must be signed and the user must trust the certificate used to sign the RemoteApp.

RDP files created when a user launches an RDP connection from the RD Web Access Desktops tab are created on the fly. The files aren’t signed. Therefore, Web SSO won’t work when connecting to desktops. The user will have to log in to the endpoint once the connection is established. Web SSO also won’t work for connections to pooled or personal VMs.

Contact PSS Enterprises today for a free evaluation of your server.  1-800-285-2448 or mail@pssenterprises.com to get more information about Win Server 2008.

Just as we are preparing for this change, be aware that hackers are busy preparing as well. Our industry is preparing for a flood of viruses, malware, phishing programs, and hackers to compromise those who did not take the precautions and upgrade their system to Windows 7.   Sadly, there will be those unprepared that will suffer untold issues as a result of not taking a few precautionary measures and a upgrade.

PSS Enterprises will be sending teams to our clients who are still operating on XP.  We will be evaluating current applications, hardware, and peripherals that the user operates.   We then run compatibility checks for the applications, hardware, and peripherals.  After analysis, a course of action will be charted for the upgrade.

Please be aware that deployment is not and does not have to be expensive.  Taking measurements now will offset those costs.  Be aware there is no way to directly migrate from XP to Windows 7.  However, PSS Enterprises uses an advanced migration tool to streamline and deploy the new operating system, making the transition a seamless as possible.

CALL OR EMAIL  TODAY to begin your migration process.  The industry standard for upgrading a system from XP to Vista to Win7 is about 12-18 months.

Email us at mail@pssenterprises.com or give us a call at 1-800-285-2448 option 1 for technical support.

https://www.pssenterprises.com

https://www.dentonit.com

PSS Enterprises offers full evaluation and consultation on all server operating systems, migrations, and upgrades. Call today for a full evaluation at 1-800-285-2448 or email us at mail@pssenterprises.com for an appointment.

https://www.pssenterprises.com

**Article reprint with permission**

Review insurance policies. 

Often insurance policies are set up and then put to the side, forgotten, until something bad happens. Take some time to carefully review all your policies with your agent, so important questions that arise can be answered in plain English on the spot. Insurance isn’t the most exciting subject in the world, but making sure there is adequate coverage now could save a lot of money later. This is especially important if changes have taken place in your company during the past year that affects your liability. Be proactive, have a declarations page ready in a PDF and save it to the server, should any clients ask.

Review marketing campaigns.

The end of the year is a great time to take a look at which marketing efforts are driving business and which aren’t. Don’t hesitate to make changes if current efforts aren’t paying off. Keep in mind that a lot of ads will automatically renew, so there is an ad in your portfolio you don’t think is helping the business, you’ll want to make a change before committing to running it for another year.

Review all vendor contracts.

Take a close look at how much business is being done with each vendor. Are you getting the best rates based on how much work is being done together? Is the relationship mutually beneficial? If not, don’t be afraid to make a change. On the other hand, if you’re happy with your vendors, tell them! Let vendors know you want to create a great relationship with them. They’ll appreciate that you’re taking the time to make sure they’re happy in the relationship, too. Let them know you want to be their favorite customer.

Review all systems from top to bottom.

Carefully examine what’s working and what’s not. Decide where the problems are, and figure out what can be fixed. A system review can be an eye-opening experience –and users are surprised to find their work has fallen into habits that are hindering them from being more productive.  PSS Enterprises has a comprehensive system review process that documents current technology uses and suggests what changes are necessary to provide a successful 2012.

Overhaul the website. 

In the same way that retail stores move around their floor sets, make changes to the website to keep people coming back. Make sure all information is updated, and post any articles that have recently mentioned anything related to the industry.  Set all homepages to www.dentonit.com, so help is just a click away when deciding to have the website updated!

Consider technology upgrades.

If you need new computers or a new phone system to help things run more smoothly, the end of the year is a great time to make those upgrades. A new computer, phone system or other technology upgrade can make a huge difference in the daily lives of employees by enabling them to spend less time attending to such problems as computer crashes or attending to voicemails and focus more attention on the things that really matter.  PSS Enterprises offers training with all new technology upgrades!

Make 2012 a year to remember.  Last but not least, make an appointment with the solutions specialists at PSS Enterprises to schedule a time for a certified expert to look at technology systems, telephony systems, or create a support structure for users.  Just call 1-800-285-2448 or email us at mail@pssenterprises.com and we will contact you!

Take a moment to check out our favorite company: MVP-Graphics!  They make us look good!

https://www.mvp-graphics.com

Components of the Cisco Unified Communications 520 include:
• Cisco Unified Communications Manager Express for call processing of Cisco Unified IP Phones, providing a phone system rich in features
• Cisco Unity® Express for voice messaging and Automated Attendant, to help improve communication among employees and with customers
• An integrated 8-port Power over Ethernet (PoE) local-area network (LAN) switch
• Network security functions including Cisco IOS® Firewall, which protects the wide-area network (WAN) entry point into your network, and virtual private network (VPN), which gives up to 10 remote users highly secure access to your network
• Optional integrated wireless LAN (WLAN) capability on some models or external access points and Cisco Wireless LAN Controller Modules, to enable mobile networking, which can help increase employee flexibility and productivity
• Cisco Configuration Assistant so you can easily configure devices and technologies including unified communications (phones and software), switching, routing, security, and wireless
• Optional remote system-monitoring capabilities

As a key component of the Cisco Unified Communications 520, Cisco Unified IP Phones and communications devices are designed to take full advantage of converged voice and data networks. These devices offer the convenience and user friendliness found in business phones, and can help improve productivity by meeting the needs of different users throughout your organization.

We recommend the Cisco Unified IP Phone 7900 Series that offers the following:
• IP phones with LCD displays, including dynamic soft keys for call features and functions
• A range of wireless, conference, and desktop phones to choose from
• Support for Cisco and third-party XML and MIDlet applications

This system is more than just a phone system. A router, wireless access capabilities, and voice contained in one easy to manage box. Backed by CISCO, this is reliable technology that PSS Enterprises would like to tell you more about.

Call today for a free consultation regarding current phone systems, needs, and forecast growth. 1-800-285-2448 option 1, or email at mail@pssenterprises.com.

http://www.pssenterprises.com

http://www.dentonit.com

Take a moment to check out our favorite company: MVP-Graphics!  They make us look good!

http://www.mvp-graphics.com

Denton IT is PSS Enterprises’ Technology Department.  Denton IT offers a range of services from outsourcing technical support to on-site resolutions.  Upgrades, Server maintenance, PBX, Unified Communications, IP Telephony, VoIP, Cabling, Security, and much more. Call for your free technology/productivity assessment. 1-800-285-2448

PNK Box- Denton IT is the proud creator of the PNK Box, the Ultimate Threat Management Gateway. This product will protect one of the most costly assets of any business, the technology at the internet gateway level.  Fend off vicious spyware, malware, viruses, SPAM, and everything else that is trying to take your company down.  Control employee productivity and protect your company from lawsuits by blocking inappropriate websites.  Interested? Go to http://www.DentonIT.com and click to talk to an online tech right now!

PSS Enterprises offers great outsourcing for Human Resources, OSHA compliance, A/R Management and Property Management.  Instead of paying full price for employee overhead, see what outsourcing can save you. Mention “PowerPaks” for our discount services. Call 1-800-285-2448 today and let a solutions specialist walk you through the money saving process.

Take a moment to check out our favorite company: MVP-Graphics!  They make us look good!

http://www.mvp-graphics.com

1. Quickly create the diagrams you need with minimal effort. Visio 2010 can help you make your business smarter, leaner, and safer—strengthening it now and preparing it for future growth.

Identify operational inefficiencies Use Visio’s comprehensive and robust business process analysis capabilities to capture, explore, and communicate current business processes and identify operational inefficiencies.2. Reduce IT costs and risks Document IT infrastructure and improve critical IT processes to enhance compliance and reduce IT costs. 3. Improve project management Create, edit, and modify project plans using Visio to better understand and more effectively communicate key information. 4. Gain valuable business insights Link data to diagrams to visualize and explore complex data and make better decisions, faster. 5. Reduce costs using server consolidation planning Quickly assess server usage at both the rack and individual server level to help support decisions around shifting workloads.

 

Take a moment to check out our favorite company: MVP-Graphics!  They make us look good!

http://www.mvp-graphics.com ]]> http://BLOG.pssenterprises.com/2010/11/microsoft-visio-2010top-5-benefits/feed/ 0 http://BLOG.pssenterprises.com/2010/10/solutions-specialist/ http://BLOG.pssenterprises.com/2010/10/solutions-specialist/#comments Sun, 10 Oct 2010 05:28:21 +0000 joslynsmith http://BLOG.pssenterprises.com/?p=330 At PSS Enterprises, we know what matters to business owners.  Our approach to handling client needs goes beyond what is in “scope”.  We truly offer customized solutions to every client.  We know what matters to business owners because they tell us.  As a trusted team member we serve as an extension of our clients business.

Information Technology

PSS Enterprises offers pro-active solutions through their technology department, Denton IT.  Our clients are assigned a Solutions Specialist who goes on-site to our clients location.  Upon our initial meeting, our Solutions Specialist will provide a FREE technology assessment.  Aside from resolving any immediate technology need, our Solutions Specialist wants to know how the client intends on growing and increasing their business.  It is key to how we provide customized solutions to our clients  to achieve their goals.   From creating an IT budget, staffing, remote support, network administration, to relocation services, project management, and forecasting, our Solution Specialist is there to make sure all needs are met and expectations are exceeded.

Consulting

Many business reach an important fork in the road to growth several times.  Determining what path to take can be daunting and confusing.  PSS Enterprises offers consulting services to help businesses make the right decisions.  Market analysis, production efficiency, design, marketing, OHSA compliance, and successful execution of projects are just a few of the ways that PSS Enterprises assists in the development of our clients business.

Outsourcing

PSS Enterprises realizes that growth can be expensive.  The old adage “It takes money to make money” most certainly applies in this facet.   Your business might need a Human Resources person now that you have more that just a few employees.  Perhaps you need to cut costs and eliminate some full time positions, but the work still needs to be done in absence.   Whatever the case might be, PSS Enterprises can assist with the temporary placement of employees, or filling a department need remotely.

Ease of Use

Why do business with PSS Enterprises?  Ease of Use.  Here are just a few of the reasons our clients stay with us and refer us to their associates.

• PSS Enterprises exclusively offers Power Paks, a preset prices based on services rendered in a preset time block.  This allows our clients to budget their expenses, forecast usage, and increase productivity while maintaining control.  Our terms are simple and so are our service rates.
• Remote support: Get the help you need when you need it.  Click HERE to gain access to our technology website, Denton IT.  Remote support from a certified technician is only a click away.
• 1-800-285-2448 will connect you to a Solutions Specialist right away.

Call, email us at mail@pssenterprises, or click to get started.  We are ready to start developing our relationship with you right away.

Take a moment to check out our favorite company: MVP-Graphics!  They make us look good!

http://www.mvp-graphics.com

Results from the recently released Cisco 2010 Midyear Security Report indicate the need for increasing vigilance in battening down the email hatches. The study found that companies of all sizes are struggling to secure networks that are increasingly mobile, especially as more employees use their personal smartphones to do business-related tasks, such as checking work email. Also, social networking sites like Facebook (and the games played on those sites) increasingly expose users to dangerous spam emails and nefarious websites. In addition, the Cisco report found that the amount of spam sent around the world will increase 30 percent in 2010 compared to last year, with the U.S. being the country originating the largest amount of spam.

Have you found all of the possible entry points by which a cyber criminal might gain access to your company’s critical information?

Securing your email protects your network email security is paramount. Businesses like yours rely on email to communicate among employees as well as with customers and partners, but it can allow anyone in the world to drop dangerous data into your business network. Hackers love to wreak havoc on networks by mass emailing spam and viruses, which can disable servers and PCs. And those disruptions caused by spam and viruses can cost your company in lost productivity and revenues as well as damage your reputation with customers.

There are two types of security solutions that every small business needs to protect its email and networks from spam and viruses: anti-spam and anti-virus software. Anti-spam software (also referred to as spam blocker) stops unwanted emails at the server and prevents them from being delivered to users’ inboxes. Anti-virus software recognizes the code that was used to create a virus and then stops the virus from spreading across your network from a PC or server that was infected via an email or website.

You have more choices than ever when it comes to deploying these types of security solutions. PSS Enterprises offers both anti-virus and anti-spam software either as individual products or bundled together with other Web security tools.

How anti-spam and anti-virus solutions work:
Anti-spam and anti-virus solutions sit on your network between your firewall and your email server, or on the email server itself, and scan all incoming traffic before forwarding it to users’ inboxes. These solutions work by identifying dangerous data in incoming messages and separate them from the rest of your email traffic so that the infected messages can’t be acted on by unsuspecting employees.

Any anti-spam software will include a quarantine feature that lets PSS Enterprises create a safe place to filter and store emails that might not be spam, such as newsletters from reliable sources, but that raise the spam filter’s flags. In general, an anti-spam solution should provide plenty of flexibility in setting spam filters to catch spam coming into the server. The anti-spam software also should block spam-related threats like phishing attacks, which use email to get users to reveal sensitive information, such as user names and passwords.

Anti-virus software should be installed on every workstation, laptop, and smartphone that has access to your network in addition to an anti-virus gateway installed on or near the email server. The anti-virus program will be regularly updated by PSS Enterprises with new, known virus signatures.

Your anti-virus solution should provide different options for handling infected email, including quarantining and deleting the messages. Don’t just rely on the software to catch viruses as they come in, though. Make sure employees are conducting regular scans of their computers in case any malware has made it past your defenses.

Email security is critical to the well-being of your business. All businesses are just as likely to be attacked by hackers with viruses and other malware just as larger companies, and the losses can be significant. In Symantec’s recent 2010 SMB Information Protection Survey, 50 percent of respondents said they’ve suffered losses due to cyber attacks, including network downtime and theft of corporate and customer financial data as well as identity theft. Hackers count on small businesses assuming they’re safe, and that’s another point of entry cyber criminals can exploit to their benefit.

What steps have you taken to secure your company’s email?

Contact PSS Enterprises today at 1-800-285-2448 for your free site evaluation.

Take a moment to check out our favorite company: MVP-Graphics!  They make us look good!

http://www.mvp-graphics.com