CompTIA Network+ Lab Series Network Concepts. Lab 11: Business Continuity - Disaster Recovery

Transcription

1 CompTIA Network+ Lab Series Network Concepts Lab 11: Business Continuity - Disaster Recovery Objective 5.4: Explain common threats, vulnerabilities, and mitigation techniques Document Version: otherwise noted, is licensed under the Creative Commons Attribution 3.0 Unported License. Development was funded by the Department of Labor (DOL) Trade Adjustment Assistance Community College and Career Training (TAACCCT) Grant No. TC A-48; The National Information Security, Geospatial Technologies Consortium (NISGTC) is an entity of Collin College of Texas, Bellevue College of Washington, Bunker Hill Community College of Massachusetts, Del Mar College of Texas, Moraine Valley Community College of Illinois, Rio Salado College of Arizona, and Salt Lake Community College of Utah. This workforce solution was funded by a grant awarded by the U.S. Department of Labor's Employment and Training Administration. The solution was created by the grantee and does not necessarily reflect the official position of the U.S. Department of Labor. The Department of Labor makes no guarantees, warranties or assurances of any kind, express or implied, with respect to such information, including any information on linked sites, and including, but not limited to accuracy of the information or its completeness, timeliness, usefulness, adequacy, continued availability or ownership.

2 Contents Introduction... 3 Objective: Explain common threats, vulnerabilities, and mitigation techniques... 3 Lab Topology... 5 Lab Settings Create a Data Backup Using Windows Server Backup Enable Windows Server Backup Features Create a Backup Volume Configure Windows Server Backup Review Questions Restore Data from a Data Backup Delete a File to Restore from Backup Restore Deleted Data to its Original Location Verify Recovery of the File Review Questions Use a Virus Test File to Test the Antivirus Software Using a Virus Test File To Test Antivirus Software Review Questions

3 Introduction This lab is part of a series of lab exercises designed to supplement coursework and provide students with a hands-on training experience based on real world applications. This series of lab exercises is intended to support courseware for CompTIA Network+ certification. Catastrophes of various types, fires, floods, illness, and terrorism or server crashes, hard drive failure, viruses, and downed networks, can upset an organization s ability to meet business needs causing disruptions to regular operational conditions. It is necessary for businesses, whether large or small, to have plans in place to mitigate the effects of potential catastrophes. Business continuity and disaster recovery plans are important components to any business plan to prevent major disruptions. The purpose of this lab is to characterize some key points in disaster recovery plans and demonstrate the need for implementation. Students will create and restore a data backup. They will examine the importance of virus and malware protection and test antivirus software. Objective: Explain common threats, vulnerabilities, and mitigation techniques Business continuity includes the planning of how a business will continue to operate despite big or small interruptions until normal conditions are restored. An important consideration to Include in business continuity planning is a disaster recovery plan providing for system and data protection in terms of data encryption, physically securing data, antivirus software installations, data backups and restoring backups. The focus here is on one component of the plan: data protection and recovery. In this lab, you will perform the following tasks: 1. Create a data backup 2. Restore data from a data backup 3. Download a virus test file to test antivirus software Key terms for this lab: data backups copying files from a computer s hard drive onto other digital media that is stored in a secure location data recovery - the process of restoring data that is lost through accidental or no accidental means adware a software program that delivers advertising content in a manner that is unexpected and unwanted by the user 3

4 antivirus (AV) software that can examine a computer for any infections as well as monitor computer activity and scan new documents that might contain a virus computer virus malicious software program that reproduces itself on a single computer and can spread by sharing the infected files and usually infects program executable files rootkit a set of software tools used by an attacker to hide the actions or presence of other signature file file that contains known patterns or sequences of bytes (strings) found in viruses; used by antivirus software to identify malware spyware general term used to describe software that spies on users by gathering information without consent, thus violating their privacy Trojan an executable program advertised as performing one activity but actually does something else (or it may perform both the advertised and malicious activities) worm malicious program designed to take advantage of vulnerability in an application or an operating system in order to enter a computer 4

5 Lab Topology 5

6 Lab Settings The information in the table below will be used to complete the lab. Additional details will be provided within the task sections as required. Required Virtual Machine and Applications Log in to the following virtual machine before starting the tasks in this lab: Windows 2k8 R2 Internal Windows 2k8 R2 Internal 2 password P@ssw0rd Windows 2k8 R2 Login (applies to all Windows machines) 1. Click on the Windows 2k8 R2 icon on the topology that corresponds to the machine you wish to log in to. 2. Use the PC menu in the NETLAB+ Remote PC Viewer to send a Ctrl-Alt-Del (version 2 viewer), or click the Send Ctrl-Alt-Del link in the bottom right corner of the viewer window (version 1 viewer). 3. In the password text box, type P@ssw0rd and press Enter to log in. 6

7 1 Create a Data Backup Using Windows Server Backup An essential component to data protection is data backup, copying files from a computer s hard drive onto other media stored in a safe location. This is one of the best ways to prepare for data recovery in the event of natural or unnatural disasters. Deciding on what data should be backed up, where the backup should be stored and the backup schedule are all important considerations. There are several solutions to make creating backups easier. Most operating systems can perform automated backups, and third-party software is available that typically provides more robust features. Windows Server Backup tool is the software used in this lab. Configuration options allow for data protection of the operating system, applications that are registered to Windows, volumes, or individual files. The backups can be stored to internal, external, or online storage areas and it has an automatic daily backup scheduler. Backing up on a regular schedule is a key point in disaster recovery. 1.1 Enable Windows Server Backup Features To use the Windows Server Backup tool, Windows Server Backup Features must first be installed on Server 2008 r2 using the Add Features Wizard in Server Manager. 1. Use the instructions provided in the Lab Settings section to log on to the Windows 2k8 R2 Internal 2 machine, if you are not logged in already. If Server Manager opens, skip to Step Click on Start-> Control Panel -> Administrative Tools -> Server Manager 3. When the Server Manager window appears, in the left panel click Features, then go to the right panel and click Add Features. The Select Features window in the Add Features Wizard opens. 7

8 4. To enable the Windows Server Backup Features: on the Select Features page, scroll the list until you find Windows Server Backup Features. Click the + sign next to Windows Server Backup Features and select the check boxes for Windows Server Backup and Command-line Tools. Click Next. 5. On the Confirm Installation Selections page, review the features displayed to be certain you have made the correct selection. If they are correct, click the Install button. If you need to make a change to your selections, click the Previous button. 8

9 6. The Installation Results page will present an overview of the components installed and installation results. Click Close after viewing the results (ignore any warning messages about Windows Automatic Update not being enabled if they appear in the results page). You have now successfully installed Windows Server Backup Features, which will enable you to use the Windows Server Backup tool. 1.2 Create a Backup Volume It is necessary to have a backup storage area. A second hard drive or volume on the local computer is one solution, but damage to the system could cause both the original and backup location to be destroyed. An alternative is to put the backup data on an external portable device such as a USB hard drive or optical disk media, so that the portable device or media could be stored in a remote location for security and safety. To complete the lab, you will to create a storage area on the server. You will add a volume on the local hard drive to store the backup. Keep in mind, in actuality, the decision on where to store the backup will be based on individual and organizational needs. With the Windows Server Backup Tool. backups can be stored on hard drives (internal or USB), network shares, and on a SAN, but no backup tape drives are supported. For the purpose of this exercise, you will create a volume on the internal hard drive of the server. This will be done by shrinking an existing volume and creating unallocated space to be used as a new volume. 9

10 1. Use the instructions provided in the Lab Settings section to log on to the Windows 2k8 R2 Internal 2 machine, if you are not logged in already. If Server Manager opens, skip to Step Click on Start-> Control Panel ->Administrative Tools -> Server Manager 3. Go to the left panel in Server Manager and click Storage, then go to right panel and double-click Disk Management. a. In the middle panel of Disk Management in the graphical view of the volumes, right-click on Disk 0 C: and click on Shrink Volume. b. Type in the Enter the amount of space to shrink the volume text box. This will create a volume with 45000MB of allocated space and leave the existing volume with of space. Click Shrink. 10

11 c. The Disk Management tool will be open. Now you will need to create a simple volume in the newly allocated space. d. Right-click on the unallocated space, select New Simple Volume and click on it. The New Simple Volume Wizard starts. Click Next. e. Click Next to accept the size on the Specify Volume Size page. This size is the total amount of space you allocated in the previous step. In a real-life situation, the actual volume size necessary would be set according to what the company backup plan required. f. On the Assign Drive Letter or Path page, you will assign a drive letter to the volume so that a path to the backup storage space is created. A good practice is to choose a drive letter at the end of the alphabet (we will use Z), so that new devices or other resource volumes can have the earlier letters. Be sure the radio button next to Assign the following Drive letter is selected and click the drop-down arrow. Drag the cursor until Z is highlighted, then click to choose the letter Z for the volume. Click Next. 11

12 g. Now you will need to format the volume to prepare it accept data. On the Format Partition page in the New Simple Volume Wizard, select the radio button next to Format this volume with the following settings: File system: NTFS Allocation unit size: Default Volume label: type Backup in the text box h. Check the box next to Perform a quick format. Click Next. i. The Completing the New Simple Volume Wizard page opens. Review the settings to be sure they match your selections. Click Finish. The Server Manager is open. 12

13 1.3 Configure Windows Server Backup The configuration of a backup strategy should be tailored to the environment where it will be implemented. As stated earlier, backups can be stored on different types of media in various locations and controlled by operating system utilities or third-party software, but the most important thing about backups, is that they are done. A plan should be made that states what will be backed up, when and how often, and what type of backup will be used. Generally, there are three types of backups. A full backup copies all data to a storage medium, regardless of whether the data is new or changed. An incremental backup copies only data that has changed since the last full or incremental backup. A differential backup copies only data that has changed since the last full backup. In this exercise, you will create a backup schedule using Windows Server Backup utility. 1. In the left panel of Server Manager, click Storage, then go to right panel and double-click Windows Server Backup. 2. On the right panel Actions pane, under the Windows Server Backup heading, click Backup Schedule. This opens the Backup Schedule Wizard s Getting Started page. Click on the More about scheduling backups link. Notice the page titles and the actions that can be performed on each page. 1. What is the title of the page where data to be included in the backup is selected? 13

14 3. Close the help page by clicking on the X in the top-right corner of the window. Click Next. The Select Backup Configuration page is open. On the Select Backup Configuration page, there are two choices: Full Server - the recommended option, which creates an image of the entire contents of the server and backs up all volumes Custom - used to back up just certain volumes/files allowing users to select the check boxes for the volumes/files to be backed up and clear the check boxes for the volumes/files that are to be excluded An organization should have a plan in place for a back-up schedule before starting the backup configuration process. Typically, backup schedules include a full backup that is done weekly and incremental backups done daily for data that has been changed. In this lab exercise, you will schedule a custom backup. 4. On the Select Backup Configuration page, click the radio button next to Custom. Click Next. This will open the Select Items for Backup page. 14

15 5. On the Select Items for Backup page, click Add Items. Click in the check box next to System state to select it for backup. Click OK. Review the selection you have made to be sure it is accurate and click Next. On the Specify backup time page, users can stipulate if they want to run backups just once a day or more than once a day. Selecting Once a day, enters the time to start running the daily backup. Selecting More than once a day allows a user to select multiple start times one for each backup to add throughout the day. It is not possible to specify weekly or monthly backups using the Windows Server Backup, but this can be done using the Schedule Task tool. 6. Click on the radio button next to Once a day and select a time close to the time that you are performing this lab, since you will need to run this backup in order to complete this task. Click Next. This will bring up the Specify Destination Type page. 15

16 The Specify Destination Type page is used to indicate where to store the backup. There are three choices, a dedicated hard drive, a volume on a designate hard drive, or network share. This decision is usually made prior to starting the backup, based on what is right for the organization. In a previous section, you created a volume on which to store the backup. 7. On the Specify Destination Type page, select the radio button next to Back up to a volume. Click Next. 8. On the Select Destination Volume page, you will add the volume you created in a previous section as the backup volume. Click the Add button. This will open the Add volumes page. 9. Find the volume created earlier (Backup Z:) and click on it to highlight. Click OK, and then click Next. 16

17 10. Review the settings on the Confirmation page, then click Finish to approve the settings. 11. After confirming the settings, a status summary page will open. Review the status. Click Close. You will see the Server Manager with the Windows Backup Server tool in the middle pane. Information about when the next backup is scheduled to run, which items will be backed up, and the destination for the backup are found here. 12. Instead of waiting for your backup to run, on the right panel Actions pane, under the Windows Server Backup heading, click Backup Once. 17

18 13. On the Backup Options page, click the Scheduled backup options radio button then click Next. 14. On the Confirmation page, review your selections and click Backup to start the process. 15. The Backup Progress page opens and you can see the initialization of the backup. Once the process is under way, click Close. 18

19 16. You can continue to view the progress of the backup under the Windows Server Backup Messages heading. 17. Completed backup information is also shown under the Windows Server Backup Messages heading. Confirm the completed backup and now you will move to the next task of restoring data from the backup. 1.4 Review Questions 1. Explain the disadvantages of installing a second hard drive in a computer to back up data from the primary hard drive of the same computer. 2. Describe alternative storage location(s) that could be used for data backup storage. What are the advantages and disadvantages of using such locations? 3. Explain full, incremental, and differential backups. 19

20 2 Restore Data from a Data Backup Equally as important as a data backup plan, is the data restore plan. Hard drive failure, corrupt data, or any other situation that leaves you with data loss will be detrimental to normal business operations. A backup plan that is established and implemented is a defense against data loss. A data restore plan is a defense against loss of normal business operation. Data recovered from backups is a critical component in disaster recovery planning. Both a backup strategy and recovery strategy need to be in place for disaster recovery to be successful. Creating backups without a recovery strategy test can be as dangerous as no backup plan at all. To ensure that backups are not corrupt or damaged and that they are actually being run, organizations need to test the data recovery from the backups to ensure they will be prepared to do so in response to a critical situation. In this task, you will recover deleted data using the backup you made in the previous exercise. 2.1 Delete a File to Restore from Backup In order to be able to restore data, you will first need to simulate data loss by deleting a file or folder on the current hard drive and then retrieve it from the backup. 1. Use the instructions provided in the Lab Settings section to log into the Windows 2k8 R2 Internal 2 machine, if you are not already logged in. 2. Click on Start->Computer a. Double-click Local Disk (C:) b. Double-click Program Files (x86) c. Right-click the WinPcap folder and click Open 20

21 d. Select the file, rpcapd. e. Right-click, drag the cursor to Delete on the dropdown menu and click. f. When the Delete File box opens, click Yes to confirm deleting the rpcapd file. 3. Click the "X" in the upper-right corner of the WinPcap folder to close the window. 2.2 Restore Deleted Data to its Original Location 1. Open Windows Server Backup if it is not already open, Start->Administrative Tools->Server Manager, click the + next to Storage in the right pane, click Windows Server Backup. 2. On the right panel Actions pane, under the Windows Server Backup heading, click Recover. This opens the Recovery Wizard s Getting Started page. 3. Select the radio button next to A backup stored on another location. This is the correct choice because you have created a separate volume from the system volume on the server for the storage location. Click Next. 21

22 4. On the Specify Location Type page, select the radio button next to Local drives. Click Next. 5. On the Select Backup Location page, choose the backup volume created in the previous exercise. Click Next. 6. On the Select Server page, highlight the server s data you would like to recover. You have backed up the local machine data so there is only one choice. Highlight the server and click Next. On the Select Backup Date page, users have the option of choosing the timeframe from which they want to recover the data. 1. Why would a user not necessarily choose to recover from the most recent backup? 22

23 7. On the Select Backup Date page, click the date on calendar for the backup from which to restore the data. Then, choose the time of the backup from the drop down menu (your selection should be the backup that you created during the previous task). Click Next. You will need to select the type of data you want to recover. In an actual disaster, analyzing the situation will determine the most appropriate choice or as in this scenario, backup testing is taking place and someone intentionally deleted data to recover. 8. On the Select Recovery Type page, choose Files and folder for the type of data to recover. Earlier in the lab, you deleted the rpcapd file from the WinPcap folder to be able to test the backup. Click Next. The Select Items to Recover page opens. 9. Now it is time to select the actual data item to recover. In the Available Items pane, the name of the server where the data is located is indicated. Click on the + next to the name to expand the content tree. You will need to follow the same path you did when deleting the file to find it in the backed up items. a. Click the + next to Local disk (C:) b. Click the + next to Program Files (x86) c. Click on the WinPcap folder d. Notice in the Name panel on the left, the file rpcapd is listed; this is the data that will be restored. e. Click Next. 23

24 2. On the Specify Recovery Options page, what options must be specified? 10. Select the radio button next to Another location to choose the recovery destination. To set the path for the data click the Browse button and: a. Click the + next to Local disk (C:) b. Click the + next to Program Files (x86) c. Click on the WinPcap folder. d. Click OK 11. Review the rest of the page, but do not make any changes. Click Next to add the path for the recovery and accept the defaults for all other settings on the page. 3. What configurations would be selected to avoid overwriting a newer copy with an older copy stored in a backup file? 12. Review the items on the Confirmation page and then click the Recover button. The Recovery process will begin. 24

25 When the recovery process starts, the Recovery Progress page opens. This page will provide a continuous status of the recovery progress, but does not need to remain open while the recovery is taking place. The progress of the recovery can be monitored in the Windows Server Backup Messages. 13. Once the process starts, click the Close button and monitor the progress from the Windows Server Backup Messages. 2.3 Verify Recovery of the File When the recovery is complete, verify that the file is back in the correct location. 1. Click Start->Computer 2. Double-click Local Disk (C:) 3. Double-click Program Files (x86) 4. Double-click WinPcap 1. Is the restored file in the correct location? 2. What is the filename? 2.4 Review Questions 1. Describe three different recovery types that can be done using the Windows Server Backup utility. - 25

26 3 Use a Virus Test File to Test the Antivirus Software Data backup and recovery are strategies to guard against damaging events having a profound effect on normal business operations, but to protect systems and data from being vulnerable to attacks that can harm the system or its resources, other measures should be in place. Malware is an umbrella term for programs written to cause harm or intrude upon a system or its resources. Familiar terms like viruses, Trojan horses, and worms are all considered malware. Installing anti-malware and antivirus software on a system is a method to protect systems from malware attacks. The prevalence of malware attacks is evidenced everyday by businesses and individuals around the world. Incidences of millions of daily attacks thwarted and billions of infected files discovered are part of the discussion in the IT security community. It is the role of the IT departments or individual users to be diligent in protecting systems. Installing and testing antivirus software is a good starting point in protecting systems from malware threats. Most operating systems and types of devices are prone to attack. To ensure that a network and its systems are being protected, check to be sure that an antivirus program is running on all devices. If a device does not have an antivirus installed, then the first step in the process is to install one. For individual workstations, there are many free reliable antivirus software programs available. Some operating systems include a builtin antivirus program. In an enterprise environment, using a server/client model, antivirus programs on the server need to be more fully featured and robust than the typical free programs, so a paid solution is often implemented. Servers and workstations should run antivirus software whether connected to the Internet or just an internal network. Malware infected computers can spread infections rapidly to other connected systems. Many malware threats come through the Internet or . Types of malware threats that are of great concern include: Virus code added to legitimate programs on a system and activated when the program is run, then writes itself to memory and runs instead of the legitimate program. They are designed for various purposes to be annoying, destructive, and malicious. Worm do not need to be attached to other programs, like their biological counterpart, can replicate quickly, which can cause high bandwidth consumption and resource overload. If a worm carries a payload, it can carry out an action such as deleting files or stealing data. Trojan or Trojan Horse disguises itself as a normal file or program and deceives users into downloading and installing them. Once that is accomplished, Trojans can cause a great deal of harm such as creating back doors to give users with malicious intent access to the system, deleting files, or something as simple but annoying as causing windows to keep popping up. 26

27 rootkit stealthy, malicious software program designed to conceal itself in a system and allows remote access and control of a system without detection by the user or security programs. It can be very difficult to detect and remove, which is one reason security protection measures such as operating system updates, application patches, and keeping antivirus software definitions up to date are critical. At the minimum, antivirus software should protect against viruses, Trojans, and worms and offer tools for detecting, quarantining, and removing such threats. It is also crucial to the usefulness of an anti-malware, or antivirus program that signature files are updated regularly. Signature files uniquely identify a specific virus and are used for virus detection. Virus definition is a term often used to refer to the database of signature files downloaded by an antivirus program. The antivirus program compares the data content on the system against the virus definition database to detect a virus. In this task, you will simulate downloading a virus and observe the reaction of the antivirus software. 3.1 Using a Virus Test File To Test Antivirus Software In this task, you will be testing antivirus software using a virus test file. Because you have no Internet access on these systems the test file has been downloaded and placed on the desktop for use in this exercise, it is named testav.zip. When connected to a system with Internet access the test files can be downloaded from You can read more about EICAR at 1. Use the instructions in the Lab Settings section to log into the Windows 2k8 R2 Internal 2 machine, if you are not already logged in. 2. If the Initial Configuration Tasks and/or Server Manager windows appear, close them by clicking on the X in the top-right corner of the window. 3. On the desktop, locate the shortcut to start the ClamWin Antivirus program and double-click on the icon to launch the program. Before the program launches you will be asked if you would like to update signature files. On a system connected to the Internet, you would select the Yes button to keep the signatures current. For the purpose of the exercises, click No and the program will open. 27

28 4. Eicar files are standardized test file for signature based virus detection software. These files can be used to verify that antivirus is installed and scanning what it was expected to scan. These files are not viruses, but simulate a virus based on the code structure of the file. The testav.zip is a renamed copy of an eicar test file. 5. With your antivirus software running, double-click the [C:] folder, then select to highlight the Users folder. 6. Click the Scan button to begin scanning to see if the ClamWin antivirus software is functioning. 7. When the scan is completed, ClamWin Antivirus, the antivirus software running on this system, will display information about the files and folders that were scanned and any infected files that are discovered. Notice that the testav.zip was recognized as the Eicar-Test-Signature and marked as an infected file. This is one way to test the installation and configuration of an antivirus program. Regardless of the antivirus software program being used, this should be the result. Click the Close and then Close again to stop ClamWin Antivirus. 28

29 3.2 Review Questions 1. Describe two types of malware discussed in this task, Including how they can gain access to a system to infect it and what potential harm they can cause to a computer system. 2. Why is a rootkit considered to be one of the more difficult types of malware to detect and remove? 3. Explain how a computer not connected to the Internet is vulnerable to malware and could become infected if not running an antivirus software program. 29