Section 4.4-4.9: Safety, Scripting, and Remote Access

- ESD: can be very damaging to computer components, silicon is very sensitive to high voltages
- static electricity: electricity that doesn't move
- static electricity isn't harmful to computers: it's the discharge that gets them
- feel static discharge: ~3,500 volts
- damage an electronic component: 100 volts or less

- humidity over 60% helps control ESD: won't prevent all possible ESD, keep an air conditioned room at 60% humidity isn't very practical
- use your hand to "self-ground": touch the exposed metal chassis before touching a component, you'll want to unplug the power connection
- do not connect yourself to the ground of an electrical system

- anti-static strap: connect your wrist to a metal part of the computer
- anti-static pad: a workspace for the computer
- anti-static mat: a mat for standing or sitting
- anti-static bag: safely move or ship components

- try not to touch components directly: card edges only
- store in an HVAC regulated environment: between 50 and 80 degrees fahrenheit, or 10 to 27 degrees celsius
- avoid high humidity: silica gel packets can help control humidity
- store in the original padded box: bubble wrap can be a good alternative

- power is dangerous
- remove all power sources before working
- don't touch ANYTHING if you aren't sure
- replace entire power supply units: don't repair internal components
- high voltage: power supplies, displays, laser printers

- most computer products connect to ground: divert any electrical faults away from people
- also applies to equipment racks: large ground wire
- don't remove the ground connection: it's there to protect you
- never connect yourself to the ground of an electrical system: this is not a way to prevent ESD

- lifting technique: lift with your legs, keep your back straight, don't carry overweight items, you can get equipment to lift
- electrical fire safety: don't use water or foam, use carbon dioxide, FM-200, or other dry chemicals, remove the power source
- safety goggles: useful when working with chemicals, printer repair, toner, batteries
- air filter mask: dusty computers, printer toner

- health and safety laws: vary widely depending on your location, keep the workplace hazard-free
- building codes: fire prevention, electrical codes
- environmental regulation: high-tech waste disposal

- read your MSDS(Material Safety Data Sheets): US Department of Labor, OSHA(Occupational Safety and Health Administration), https://www.osha.gov, Index page
- SDS(Safety Data Sheet): different names in each country
- provides information for all hazardous chemicals: batteries, display devices or CRTs, chemical solvents and cans, toner and ink cartridges

- product and company information
- composition or ingredients
- hazard information
- first aid measures
- fire-fighting measures
- accidental release or leaking
- handling and storage
- much more

- batteries: uninterruptible power supplies, dispose at your local hazardous waste facility
- toner: recycle and reuse, many printer manufacturers provide a return box, some office supply companies will provide a discount for each cartridge
- other devices and assets: refer to the MSDS, don't throw out without clear directions

- temperature: devices need constant cooling, so do humans
- humidity level: high humidity promotes condensation, low humidity promotes static discharges, 50% is a good number
- proper ventilation: computers generate heat, don't put everything in a closet

- UPS(uninterruptible power supply): backup power, power failures, under-voltage events, surges
- UPS types: standby UPS, line-interactive UPS, on-line UPS
- features: auto shutdown, battery capacity, outlets, phone line suppression

- not all power is "clean": self-inflicted power spikes and noises, storms, power grid changes
- spikes are diverted to ground
- noise filters remove line noise: Db(Decibel) levels at a specified frequency, higher Db is better

- Joule ratings: surge absorption, 200=good, 400=better, look for over 600 Joules of protection
- surge amp ratings: higher is better
- UL 1449 voltage let-through ratings: ratings at 500, 400, and 330 volts, lower is better

- control evidence: maintain integrity
- everyone who contacts the evidence: avoid tampering, use hashes
- label and catalog everything: seal, store, and protect, digital signatures

- identify the issue: logs, in person, monitoring data
- report to proper channels: don't delay, this may include internal management and law enforcement
- collect and protect information relating to an event: many different data sources and protection mechanisms

- copy the contents of a disk: bit for bit and byte for byte
- remove the physical drive: use a hardware write-blocker, preserve the data
- software imaging tools: use a bootable device
- use hashes for data integrity: drive image is hashed to ensure that data has not been modified

- document the findings: for internal use, legal proceedings, etc
- summary information: overview of the security event
- detailed explanation of data acquisition: step by step method of the process
- the findings: an analysis of the data
- conclusion: professional results given the analysis

- most software includes a license: terms and conditions, overall use, number of copies, and backup options
- valid licenses: per-seat, concurrent
- non-expired licenses: ongoing subscriptions, annual, three-year, etc, use the software until the expiration date

- personal license: designed for the home user, usually associated with a single device or small group of devices owned by the same person, perpetual(one time) purchase
- corporate use license: per-seat purchase or site license, the software may be installed everywhere, annual renewals

- FOSS(Free and Open Source Software): source code is freely available, end user can compile their own executable
- closed source or commercial: source code is private, end user gets compiled executable
- EULA(End User Licensing Agreement): determines how the software can be used

- PCI DSS(Payment Card Industry Data Security Standard): a standard for protecting credit cards
- 6 control objectives: build and maintain a secure network and systems, protect cardholder data, maintain a vulnerability management program, implement strong access control measures, regularly monitor and test networks, maintain an information security policy

- used for government services and documentation: social security number and driver license
- there may be restrictions on collecting or storing government information: check your local regulations
- OPM(U.S. Office of Personnel Management): comprised personal identifiable information, personnel file information; name, SSN, date of birth, job assignments, etc, July 2015 - approximately 21.5 million people affected

- Personally Identifiable Information: any data that can identify an individual, part of your privacy policy
- not everyone realizes the importance of this data: it can be easy to forget its importance
- attackers use PII to gain access or impersonate: bank account information, answer badly-written password-reset questions

- General Data Protection Regulation: European Union regulation - data protection and privacy for individuals in the EU
- name, address, photo, email address, bank details, posts on social networking websites, medical information, a computer's IP address, etc
- control export of personal data: users can decide where their data goes
- gives individuals control of their personal data: a right to be forgotten, right of erasure
- site privacy policy: details all of the privacy rights for a user

- Protected Health Information: health information associated with an individual - health status, health care records, payments for health care and much more
- data between providers: must maintain similar security requirements
- HIPAA regulations: Health Insurance Portability and Accountability Act of 1996

- keep files that change frequently for version control: files change often, keep at least a week perhaps more
- recover from virus infection: infection may not be identified immediately, may need to retain 30 days of backups
- often legal requirements for data retention: email storage may be required over years, some industries must legally store certain data types
- different data types have different storage requirements: corporate tax information, customer PII, tape backups, etc

- one of the most useful skills for the troubleshooter
- one of the most difficult skills to master
- a skilled communicator is incredibly marketable

- abbreviations and TLAs(Three Letter Acronyms)
- avoid acronyms and slang: be the translator
- communicate in terms that everyone can understand: normal conversation puts everyone at ease, decisions are based on what you say
- these are the easiest problems to avoid

- positive tone of voice: partner with your customer, project confidence
- problems can't always be fixed: do your best and provide helpful options
- your attitude has a direct impact on the overall customer experience

- even if you know the answer
- why do we interrupt: we want to solve problems quickly, we want to show how smart we are
- actively listen, take notes: build a relationship with the customer, they'll need help again someday, don't miss a key piece of information, especially useful on the phone
- this skill takes time to perfect

- ask pertinent questions: drill down into the details, avoid an argument, avoid being judgmental
- repeat your understanding of the problem back to the customer: "did I understand you correctly"
- keep an open mind: ask clarifying questions even if the issue seems obvious, never make assumptions

- offer different options: repair or replace
- document everything: no room for questions
- keep everyone informed: even if the status is unchanged
- follow up afterwards: verify satisfaction

- match the attire of the current environment: everyone should feel comfortable about their dress
- formal: some organizations have specific requirements
- business casual: a more relaxed style
- find the right balance: follow the organization's lead

- cultural sensitivity: use appropriate professional titles
- you're the teacher: not the warden, leave insults on the playground
- make people smarter: they'll be better technologists
- you're going to make some BIG mistakes: remember them

- don't allow interruptions: no personal calls, texting, or twitter, don't talk to co-workers
- apologize for delays and unintended distractions
- create an environment for conversation: in person - open and inviting, on phone - quiet background, clear audio, stay off the speakerphone

- technical problems can be stressful
- don't argue or be defensive: don't dismiss or contradict
- diffuse a difficult situation with listening and questions: relationship-building
- communicate: even if there's no update
- never take the situation to social media: everything that happens at work should stay at work

- privacy concerns: sensitive information - both professional and private, on the computer, desktop, or printer
- professional responsibilites: IT professionals have access to a lot of corporate data
- personal respect: treat people as you would want to be treated

- automate with the right tools: the script should match the requirement
- may be specific to a task or OS: your choices may already be limited
- you will probably learn more than one of these: an important skill for any technician

- .bat file extension: scripting for Windows at the command line, legacy goes back to DOS and OS/2

- command line for system administrators: .ps1 file extension, included with Windows 10 and 11
- extend command-line functions: use cmdlets(command-lets), PowerShell scripts and functions, standalone executables
- automate and integrate: system administration and active directory administration

- VBScript: .vbs file extension
- general purpose scripting in Windows: back-end web server scripting, scripting on the Windows desktop, scripting inside of Microsoft Office applications

- scripting the Unix or Linux shell: automate and extend the command line
- starts with a shebang or hash-bang "#!": often has a .sh file extension

- scripting inside of your browser: .js file extension
- adds interactivity to HTML and CSS: used on almost every web site

- general-purpose scripting language: .py file extension
- popular in many technologies: broad appeal and support

- automate tasks: you don't have to be there, solve problems in your sleep, monitor and resolve problems before they happen
- the need for speed: the script is as fast as the computer, no typing or delays, no human error
- automate mundane tasks: you can do something more creative

- turning it off and back on again: an important task
- application updates: some apps require a system restart
- security patches: deploy overnight and reboot the system
- troubleshooting: the once-a-day restart, you may not have physical access

- shared network drives: the link between the user and their data
- a common task during startup: login scripts provide the connection
- automate software changes: map a drive to the repository
- add or move user data: automate the process

- install applications automatically: don't walk a flash drive to every computer
- many applications have an automated installation process: scripting can turn this into a hands-off process
- on-demand or automatic installation scripts: map the application installation drive, install the application without user prompts, disconnect the drive, restart the system

- usually performed at night or during off-hours: get a copy of all important data
- time consuming: file systems, network connections
- script an automated backup process: works while you sleep

- get specific information from a remote device: monitoring and reporting
- performance monitoring: confirm proper operation of a device
- inventory management: check the hardware or software configuration
- security and vulnerability checks: check for certain application or library versions, plan for the latest patches

- nothing ever stays the same: constant changes and updates
- OSes: new features, security patches
- device drivers: bug fixes, new hardware or OS support
- applications: new version rollouts

- unintentionally introducing malware: make sure you know what you're installing
- inadvertently changing system settings: test all updates, track file and registry changes
- browser or system crashes: mishandling of resources, a single character in a script can have unintended consequences, always have a backup, always test before deployment

- share a desktop from a remote location
- RDP(Microsoft Remote Desktop Protocol): clients for Mac OS, Linux, and others as well
- VNC(Virtual Networking Computing): RMB(Remote Frame Buffer) protocol, clients for many OSes, many are open source
- commonly used for technical support: and for scammers

- Microsoft Remote Desktop: an open port of tcp/3389 is a big tell, brute force attack is common
- 3rd party remote desktops: often secured with just a username and password, there's a LOT of username and password re-use
- once you're in, youre in: the desktop is all yours, easy to jump to other systems, obtain personal information like bank details, make purchases from the user's browser

- Virtual Private Networks: encrypted(private) data traversing a public network
- concentrator: encryption and decryption access device, often integrated into a firewall
- many deployment options: specialized cryptographic hardware, software-based options available
- used with client software: sometimes build into the OS

- on-demand access from a remote device: software connects to a VPN concentrator
- some software can be configured as always-on
- corporate network >> VPN concentrator >> internet >> your laptop at a coffee shop. Vice versa

- VPN data on the network is very secure: the best encryption technologies
- authentication is critical: an attacker with the right credentials can gain access
- almost always includes MFA(multi-factor authentication): require more than just a username and password

- the network traffic is encrypted: nothing to see in the packets
- authentication is a concern: SSH supports public and private key pair authentication
- certain accounts should be disabled in SSH: for example - root, consider removing all password-based authentication
- limit access to SSH by IP address: configure a local firewall or network filter

- Remote Monitoring and Management: manage a system from a remote location
- MSP(Managed Service Providers): many customers and systems to monitor, many different service levels
- many features: patch OSes, remote login, anomaly monitoring, hardware and software inventory

- a popular attack point: the RMM has a great deal of information and control
- access should be limited: don't allow everyone to connect to the RMM service
- auditing is important: know who's connecting to which devices and what they're doing

- Microsoft Remote Assistance: get access to a remote user's desktop, no firewall configurations or port forwarding required
- user makes a request: sends an invitation with the details
- technician connects: uses the password in the request
- replaced by Quick Assist in Windows 10 and Windows 11: the latest version of MSRA

- no ongoing Remote Desktop service required: avoids unintended access, no port forwarding
- email with invitation details is always a concern: concern using voice communication
- perhaps a bit too easy to use: social engineering can be an issue

- screen-sharing: see and control a remote device, GoToMyPC and TeamViewer
- video-conferencing: multi-user meetings with video and audio, Zoom and WebEx
- file transfer: store and share documents in the cloud, Dropbox, Box.com, and Google Drive
- desktop management: manage end-user devices and OSes, Citrix Endpoint Management and ManageEngine Desktop Central