IT & Security Blog

NCUA ISE Security Testing Requirements for Credit Unions | Conetrix

CoNetrix Security — Fri, 22 Aug 2025 13:30:00 GMT

The National Credit Union Administration (NCUA) Information Security Examination (ISE) procedures include specific security testing requirements for credit unions. In this article, we'll look at the requirements and talk about how you can meet them.

Volt Typhoon: Cybersecurity Risks and Strategies for Financial Institutions | Conetrix

CoNetrix Technology — Mon, 30 Sep 2024 13:30:00 GMT

Volt Typhoon is a nation-state cyber espionage group. Their objective is to compromise the United States' critical infrastructure. In this article, we're going to talk about the cyber threat posed by Volt Typhoon, as well as mitigation strategies for financial institutions.

A Practical Tip for Securing Your Password Vault | Conetrix

CoNetrix Security — Fri, 17 May 2024 15:30:00 GMT

Password vaults offer a lot of benefits by allowing you to set long, complex passwords, and only requiring you to remember a single master password. However, the biggest drawback with using password vaults is that if the vault is breached (as we've seen happen recently), then all of your passwords are at risk of compromise.

The Challenges of Multifactor Authentication | Conetrix

CoNetrix Technology — Tue, 04 Jan 2022 16:45:00 GMT

Multifactor authentication (MFA) is considered a staple in the world of security. For many, the use of MFA may seem straightforward, but as with many things in life, complexities abound. In this article, we will discuss five current challenges associated with MFA and ways to mitigate those risks.

Does Microsoft 365 Data Retention Leave Your Business At Risk? | CoNetrix

CoNetrix Technology — Wed, 26 May 2021 09:45:00 GMT

Many organizations are adopting Microsoft 365 (formerly Office 365) and businesses nationwide are seeing the benefits of improved productivity through its email and collaboration solution. Organizations of all sizes can benefit from a seamless user experience between mobile and on-premise environments.

Block Outlook Web Access and Exchange Control Panel access from external addresses | Conetrix

CoNetrix Technology — Thu, 02 Apr 2020 18:00:00 GMT

In most of our Exchange environments, we'll have port 443 open to the outside for ActiveSync and Outlook Anywhere. When you do that, you'll also open up OWA and ECP to the outside. If you'd like to keep access for ActiveSync and Outlook Anywhere open but would like to block OWA and ECP you can follow the steps below.

There are a few ways to block OWA and ECP to external addresses, but the best method is probably to use the IP and Domain Restrictions feature in IIS. This feature isn't available by default, so you'll have to install it.
To install it, open Server Manager, select Add Roles and Features. In the Add Roles and Features Wizard, under Server Roles, expand Web Server (IIS), then expand Web Server, and then expand Security. Then click the checkbox for IP and Domain Restrictions.

Once that installs, open IIS, expand Default Web Site and click on the OWA Virtual Directory. You'll now see the IP Address and Domain Restrictions feature available.

When you open that feature you can add an Allow Restriction Rule or a Deny Restriction Rule. My suggestion would be to add the subnets you would like to be able to access OWA and ECP (internally and externally) and then change the default behavior for unspecified clients to Deny.

To add an entire subnet as an allowed subnet, click Add Allow Entry, and then in the Rule settings enter the IP info. You can add an individual IP, a range, or a subnet.

To change the default behavior for unspecified clients, click Edit Feature Settings and set Access for unspecified clients to Deny.

Repeat the same steps on the ECP virtual directory. Once that has been completed restart the IIS service (iisreset) to apply the changes.

Fortigate Local-In Policies and Geoblocking | Conetrix

CoNetrix Technology — Mon, 03 Feb 2020 15:00:00 GMT

When you enable SSLVPN or HTTP/HTTPS for Management on your WAN interface on a Fortigate, the Fortigate creates global system Local-In policies. These are built-in policies that allow all traffic to the ports and services for SSLVPN and management on the WAN interface by default.

When you put in a Geoblocking rule to block traffic to or from certain countries on your Fortigate under IPv4 Policies, that will not affect these system Local-In policies, even if you put in an IPv4 policy to block all inbound traffic from certain countries. There are a couple of ways to fix this.

The first option is the most restrictive and would probably be the best. This option is to specify only the addresses you want to have access to these services when setting them up, which will prevent a global system Local-In policy from being created. When setting up SSLVPN, instead of allowing access to all hosts, you can specify only the IPs or countries you want to have access to the SSLVPN ports from the outside. (You need to have already setup the address objects for the IPs or countries you want to have access).

Comprehensive Guide for Choosing Penetration Tests | Conetrix

Ed McMurray — Fri, 22 Nov 2019 15:45:00 GMT

"You need a pen test. This is a vulnerability assessment. Have you considered Red Team testing?"

You might have been told this by a regulatory examiner, your IT vendor, a senior partner, a Board member, or read it in an article. It's a common statement in the penetration testing space these days and with good reason. The scope and methodology of penetration tests is not standardized or regulated, so each provider can create their pen test service as they see fit. This puts more responsibility on you, the customer, to determine if they are meeting your needs.

Installing certificates on a FortiGate managed by FortiManager | Conetrix

CoNetrix Technology — Thu, 10 Oct 2019 15:00:00 GMT

When a FortiGate is managed via FortiManager, administering the FortiGate outside of FortiManager can cause the configuration to become out of sync. While updating an SSL certificate used for VPN access on a FortiGate for a customer, I found that I was unable to create a certificate signing request from FortiManager. After doing some research, I found a Fortinet cookbook article that explains that the certificate must be requested and the certificate request completed from the FortiGate itself, even if the device is managed via FortiManager. To complete this process, do the following:

Lenovo Thinkpad emergency reset hole | Conetrix

CoNetrix Technology — Mon, 29 Jul 2019 16:00:00 GMT

If you have a Lenovo laptop with a built-in battery and it won't power on or wake-up from a sleep state, you can use the pin-hole emergency reset hole (button) to resolve the issue.

Disconnect the power adapter and depress this button with a paper-clip or similar item. Wait for 1 minute, then reconnect the AC adapter or power up using the battery.

The location of the reset button varies by model. The location for a T480s is shown below (taken from the Hardware Maintenance Manual). You do not lose any settings or data. Best I can tell, this is the similar to removing a removable battery on older models.