Secure Browser Settings

I know this is going to be long and technical, but it is important for everyone regardless of your technical ability to look at.
The one line TLDR version (TLDR is internet speak for "too long, didn't read") is this:
Secure sites use SSL. TLS is the newer SSL. You should be using the newest one you can.

Ok, so for a while now webmasters, IT people, developers etc, have been slowly transitioning the internet away from SSL 2.0 to newer versions of the protocol. SSL is the s in https:// it is the secure part of secure websites. Version 1 was phased out before most folks even knew there was an internet, but version 2.0 has stuck with us, despite being broken in many different ways, for a long time.  The payment card industry, via their PCI-DSS rules by which individual merchants have to run their payment networks, and banking systems have to communicate with merchants across data networks like the internet, has outlawed the use of SSL 2.0. A while back. And so, most websites and some browsers (I think all browsers except Internet Explorer) have abandoned the old clunker of a security protocol. By default most newer web browsers support SSL 3.0 and TLS 1.0 (which can be thought of as SSL 3.1 or 4.0).

TLS 1.0 was first introduced back in 1999. In 2002 a theoretical exploit was discovered. About a year ago that exploit, dubbed the BEAST (Browser Exploit Against SSL and TLS) was made easy to do. It allows a person who can insert themselves between the user's browser and the secured web server to pick and choose what bits of encrypted data get sent and use the chosen length bits of ciphered text to get a head start on decrypting the conversation. This is effective only against SSL 3.0 and TLS 1.0, and only when they use block ciphers like AES and 3DES not stream ciphers like RC4. Because they have decided that we've had enough time, the payment card industry is starting to insist that merchants protect against the BEAST attack. This can cause someone with inadequate security settings on their browser to get a blank page when trying to connect to a secure website.

So far TLS 1.1 and 1.2 are still quite secure, but not used everywhere yet and not supported by every browser.

I'm going to show you how to turn on the best protocol available to you in the most popular browsers and then if you are also a techie running a server, I'll go into how to do the server side.

First Internet Explorer:


For Internet Explorer:  In internet options, under the advanced tab, scroll almost all the way to the bottom and you will find these settings.
By default SSL 2.0, SSL 3.0 and TLS 1.0 should be on, I am recommending that all users switch off SSL 2.0 as no sites on the internet rely on that anymore, and it is a very broken protocol.
Also,  if available (if you have Windows 7 or higher) you should turn on TLS 1.1 and TLS 1.2 as well.


Now Firefox:



Firefox  already should have only SSL 3.0 and TLS 1.0 enabled. If it does not have TLS 1.0 checked please make sure you enable it.
Again, TLS 1.0 dates back to 1999 there has been over a decade of use ensuring that all sites and browsers are compatible.
The only reason to have it turned off is if you are US Government and required to use only 1.1 and 1.2  :)  but as we can see with the Firefox example, not having anything older than 1.1 means breaking compatibility.

On the server side...

IIS:

IIS uses the Microsoft SChannel settings. The protocol versions it supports are turned on in the registry. Paste the following code into a file called saferSSL.reg or something like that. then double click on your new .reg file to import those settings.
Windows Registry Editor Version 5.00 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56] 
"Enabled"=dword:00000000 
 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 40/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC2 56/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 40/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 56/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\RC4 64/128] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\PCT 1.0\Server] 
"Enabled"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 2.0\Server] 
"Enabled"=dword:00000000


And optionally (this one will break compatibility with IE6):
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\SSL 3.0\Server] 
"Enabled"=dword:00000000


And then to enable TLS 1.1 and 1.2:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1] 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\client] 
"Enabled"=dword:00000001 
"DisabledByDefault"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.1\Server] 
"Enabled"=dword:00000001 
"DisabledByDefault"=dword:00000000 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2] 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\client] 
"Enabled"=dword:00000001 
"DisabledByDefault"=dword:00000000 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2\Server] 
"Enabled"=dword:00000001 
"DisabledByDefault"=dword:00000000 
 
Then go into the group policy editor (type gpedit.msc into the run box or command line)
Find the section: Local Computer Policy -> Administrative Templates -> Network -> SSL Configuration Settings
edit the Cipher Order value to include only RC4 ciphers for SSL 3.0 and TLS 1.0.
Move "TLS_RSA_WITH_RC4_128_SHA" to the top of the priority list, and get rid of any SSL 3.0 or TLS 1.0 ciphersuites with CBC in the name. You can keep whatever TLS 1.1 or 1.2 ciphers you need (hint anything with SHA256 or higher is fine). If you are not sure what to include just copy this string into that box and click OK.

IIS 7.5:

TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_RC4_128_MD5,SSL_CK_RC4_128_WITH_MD5,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384_P521

IIS 7.0:

TLS_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_RC4_128_MD5,SSL_CK_RC4_128_WITH_MD5


Apache:
Put this into your config

SSLHonorCipherOrder On
SSLCipherSuite ECDHE-RSA-AES128-SHA256:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH

Watch What Permissions You Give

Watch what permissions you grant to apps on social sites and on your cell phone.

I logged into Facebook today and there was a message " wants to include you as a travel connection in Tripadvisor."

I clicked it and saw this (faces obscured for privacy reasons):

I don't know why Tripadvisor needs to have access to all that in order to make travel suggestions, but I'd never grant it. On the other hand, my work issued blackberry has been prompting me lately saying that the Phone app would like to access phone information. ...well, Duh! of course the phone part of my cellphone needs access to phone information. Funny thing though, I denied it and was still able to use the phone... so I'm not sure what phone info it needs, but It seemed to be doing ok without it.

Test Your Passwords

This is a little follow-up to the post about learning to program in python.
I thought I would throw some code out there for people to play with.

This program is written in python3. It prompts the user to enter a password that they want to test and compares it to complexity requirements and then checks if it is in a file called passwords.txt in the working directory.  It will tell the user if the password meets complexity requirements (currently set for windows' standard for complexity (8+ characters and 3 of the 4 categories: upper case, lower case, number or special characters)  There are some unused functions in this such as num_specials() that are there in case you want to customize it for stricter password requirements.

You will need to provide a passwords.txt file with one word per line of passwords that the user should not use. A good place to look for password lists is pastebin.com

If you are learning python then take a look at the code, run it in IDLE, play with the functions, see if you can extend it to do something cool.

If you are not learning python that's cool just place a password.txt file in the same directory full of words you don't think are good to use (The top 10 most used passwords is a start), and run it like so:

python3 passwordStrengthChecker.py

 Anyway, here is that code:

Want To Learn To Program A Computer?

If you have never taken a computer programming course before I'd strongly recommend picking up python as your first programming language. (version 3 if you are starting from scratch)

Take a beginner's course over at Coursera.  I highly recommend the University of Toronto one, Learn to Program: The Fundamentals, which is just wrapping up it's first semester now (and should be starting again soon) Paul and Jen's approach of teaching functions first, starting with defining exactly what the function should do, including examples of inputs and the expected outputs, in the docstring, then moving on to actually coding the function to do that is much easier to get your head around than the way I learned programming back in the early to mid 1990's.

Of course there is also Google's Python Class that is available on-demand, but not as interactive.There is thenewboston's YouTube tutorials, which are really engaging and perfect for new programmers.
Or there's Codecademy: Python or if those methods don't work for you, there's Learn Python the hard way pick what works for you. They are all free.

Pick up a free e-book, or perhaps several of them, from http://pythonbooks.revolunet.com/

I'd recommend starting with Think Python: How to Think Like a Computer Scientist or Dive Into Python 3.

The main thing that holds a lot of us back from learning how to code is not having an idea of what we would like to do with the code. Sometimes all it takes is just sitting back and thinking about problems that you'd like to solve, tasks you do repeatedly every day, every week or every month that could be simplified because you do the same thing every time, again and again. Those are things that computer programs are good for.

I manage a lot of windows computers. Some of them are on the old side, running dangerously close at times to the limits of what their hard disks can hold. Time and again, I found myself going in and deleting uninstall files for updates I knew I would never be uninstalling, just to free up a little space. So, I wrote a program that looks for those files and checks how old they are. If an update was installed more than 90 days ago it deletes the uninstall folder for it. Launching that program saves a bit of precious time each time I find I'm in that position of having to free up some disk space ASAP.

Sit down and think, what tasks like that could you automate? I bet there are at least a few.

Another one was a program that reads a comma separated list of computers (name, ip address, mac address) and uses Wake On LAN to wake the computers in that list up at a specific time. At first I had it call a command line based wake on lan program I downloaded from the net, but later I revised it to create and send the WOL Magic Packets itself ...The possibilities are basically endless.

Free E-book - Learn Windows 8

 Are you looking for a good book to learn Microsoft's new Windows 8 operating system? Start with this free one from Microsoft :

Introducing Windows 8: An Overview for IT Professionals

more free e-books

Why Hosting On YouTube Could Be Hazardous To Your Company's PR

A picture speaks 1000 words.

I was watching the video on the Netflix blog about the new Windows 8 app and guess what came up as a suggested next video...

...a kid explaining how to bypass netflix regional lock settings and watch USA netflix in other countries. Doh! social media fail for Netflix!

Windows 8 - Can I run it?

So Windows 8 is out, and you are wondering if you should upgrade.
Well, let's start with can your computer handle it?

You need to have these specs as a minimum.

• 1024x768 monitor (yes, it will run on as low as 800x600, but you won't like the experience as all of the new apps need at least 1024x768)
• 1366×768 resolution if you want the snapping feature
• 1 GHz (with PAE, NX and SSE2 support) sure, most people have that, but some might not.
• 1GB RAM (2GB if using the 64 bit version)
• DirectX 9 capable video card
• 20GB of Hard disk space 

This is a little more than Windows 7, so not every Win7 machine can be upgraded.

Now there is the whole start menu issue. Windows 8 doesn't have one, at least not in the traditional sense. It just throws all of the start menu icons onto a Start Screen that looks very much like a tablet screen and doesn't bother to sort them into folders. This can be annoying.

Realistically, Win 8's interface is designed to be used with a touch screen, so yes, it can be used with a mouse and keyboard, but you will find that you use the keyboard far more often now if you choose to use it this way.  You can't click the start button for instance, because there is no onscreen start button, you use the keyboard or a touch gesture to get to the start screen from the desktop.


Be prepared for some programs to not work in Windows 8. Just like any major Windows release, not all of your old software will work with the new OS. But, sometimes that is a blessing in disguise. I wanted to download MS Security Essentials for a Win 8 box I have, but found that there is no version for 8. That's because they re-named it Windows Defender and included it by default. Go MS! Finally you have done that right.

If you are a techie and want to run it in a Virtual machine first, (If you are a techie why has it taken till now for you to get around to installing it??) you should know it cannot run on Microsoft Virtual PC, Windows Virtual PC, Microsoft Virtual Server or VMware Workstation v7.x or earlier. It should run ok on newer VM environments though.

To check if your PC meets all of the requirements, you can run the Upgrade Assistant from Microsoft.

If you are looking for the cheapest way to get it you can Download Pro for $39.99 directly from Microsoft. Then you just burn your own DVD-ROM of it just like Microsoft's corporate customers have been doing for ages, and away you go.

PHPMyAdmin Distributed By One Mirror Site With A Backdoor Installed

To any web developer who recently set up a new server or upgraded phpMyAdmin on an existing server:

If you downloaded phpMyAdmin-3.5.2.2-all-languages.zip  from SourceForge between Sept 22, 2012 and Sept 25, 2012 you should disable it on any serrver running it and re-download it. One official mirror site based in Korea served a copy of this file that had been tampered with and had a backdoor installed.

Read more here: http://sourceforge.net/blog/phpmyadmin-back-door

Sophos False Positive for Shh/Updater-B

I have been talking about Sophos a lot lately, so I feel kind of responsible if someone started using it because of me and woke up this morning to a startling "outbreak" of Shh/Updater-B.

This is a false positive that accidentally disabled the Sophos updater. It somehow made it past Sophos QA and caused a lot of people headaches last night.

The IDE that is responsible is agen-xuv.ide

This is a quick little script that stops the Sophos Antivirus service, deletes that IDE and restarts the service. You can run this on the update servers and any workstations that give you problems afterward via PStools.

net stop savservice

if %PROCESSOR_ARCHITECTURE%==x86 (
  rem 32 bit
del "c:\Program Files\Sophos\Sophos Anti-Virus\agen-xuv.ide"
) else (
  rem 64 bit
del "c:\Program Files (x86)\Sophos\Sophos Anti-Virus\agen-xuv.ide"
)

net start savservice

After running this Acknowledge alerts in the Enterprise console.
I hope this helps a few of you.

If you need to empty quarantines on individual machines try this, but be careful not to empty a quarantine that contains a real virus, this releases the lock on quarantined files if you are using the recommended setting of deny access instead of move or delete.

net stop savservice
del "%ALLUSERSPROFILE%\Sophos\Sophos Anti-Virus\Config\Quarantine.xml"
net start savservice

Thanks to The folks at Sophos who published this last night and tweeted it out to the world.  http://nakedsecurity.sophos.com/2012/09/19/sshupdater-b-fsophos-anti-virus-products/

Sophos Mac Antivirus Home Edition

Did you know that while Sophos doesn't have a home edition of their PC antivirus they do have a FREE home edition for Mac?

It supports OSX 10.4 (both Intel and PPC) all the way up to 10.8 Mountain Lion.

What's that you say? Macs don't need Antivirus? are we still arguing that old point? Well then, yes they do!

At the SecTor security conference at the beginning of October, Seth Hardy will be talking about a new development in Mac malware attacks. Targeted attacks:

APT ALL THE THINGS: are Mac users no longer safe? - Seth Hardy

A new development of 2012, targeted attacks (APTs) against human rights now often include malware specifically designed to compromise Macs. Mac users have long thought they're safe, for a variety of reasons including: "nobody ever targets us" (not anymore!), "Macs are based on Unix so have additional security" (not if new vulnerabilities are found, or you choose to run the program), and "we're not using Internet Explorer or Outlook so most threats don't work" (other software can be just as buggy).

One region in particular has started using malware "bundles" that detect the target's operating system and serve up the appropriate program to compromise computers within NGOs and other human rights organizations. This is a relatively new development, with names starting to become more familiar: e.g. SabPab (related to the known LuckyCat campaign), Lamadai, and MacControl. This also coincided with the rise of the Flashback botnet - a Mac-specific botnet believed to at one point be over 600,000 strong. In this talk we'll look at targeted Mac malware, observe similarities and differences to "conventional" targeted attacks, and go over some end-of-year thoughts as to where Mac malware may be going next.

For home users on PC, you can get Sophos' virus removal tool  for free, but if you want the real deal, you have to buy at least 6 licenses of the coprorate product.  While it is good, I'd recommend most home users on PC look at another product.

Amazon Releases Another Set Of New Kindles

Today Amazon announced it's newest line-up of Kindle devices.


The big news on the LCD tablet side was the Kindle Fire HD with a high definition screen and more processing power than last year's fire, it comes in 7" and 8.9" versions, and the 8.9" has an LTE cellular option. Various storage capacities are available.

and...


The Kindle PaperWhite was released on the e-ink e-book reader side of the kindle lineup, with a crisper, whiter screen, a front light and enough battery to last you 8 weeks even when using the light! It comes in WiFi only and WiFi/3G versions.

OpenDNS to prevent Malware, Phishing, and Porn

A parent I know was wondering last week what she could do to block her kids from going to websites of questionable educational value for children of a young age if Chrome was installed on their computer.

Previously she'd been using the Windows Live parental filters built into recent Internet Explorer versions. I suggested she look at OpenDNS as you can set filters and any computer using the OpenDNS DNS servers, regardless of browser or even operating system, would be blocked from going to sites in your blacklisted categories. Thus, this solution, if implemented right in the house's internet router, would also work for the kids' iPods, and any other devices they had that could connect to the internet.

Personally, I have OpenDNS enabled on my home network with only Malware and Phishing sites blocked. This allows an extra layer of protection from accidentally browsing to a malware infected site over the Google blacklist that many browsers use.

You set up an account and set whatever settings you want for web filtering, and give them your external (internet) IP address to tie those filtering rules to, then set OpenDNS's DNS servers in your router or computer's IP settings. Don't worry, if you don't know how to do that they offer plenty of helpful instructions.

What if you are with an Internet Service Provider that gives you a different address each time you connect, or you want that protection on a laptop that moves from network to network getting new IP addresses all the time? They have an app for that. (sorry Apple)

OpenDNS Updater is a tiny app that sits in the system tray by your clock and periodically updates the IP address they have on file for your account.

Make Your Gmail Harder to Break Into

If you have a phone (not even a cell phone is necessary) or access to paper and a pencil, you could be using 2 factor authentication with Gmail and other Google services... well, if you only have paper and pencil it's not strictly speaking going to be 2 factor, but 2 part, one-time use passwords, which is almost as good.

I could go into a step by step of how to do it, but Google has already done that for me, with videos and screenshots and everything, just follow the link below.

http://goo.gl/qpY26





I just set my account up, added my cell phone as an SMS phone I could receive codes at, my home phone # as a backup voice phone I could receive codes at, copied the one-time use passwords for emergencies into a keypass file, and set up Google Authenticator on my blackberry. It took all of 10-15 minutes to do and I have 2 factor auth with several backup options in case I lose my Blackberry phone. ...so I can feel even more sure somone will not be able to easily hack my Google account from the Ukraine or somewhere else where hackers are plentiful, but also confident that I am not going to lose access to it myself.

VoIP at home

So, I've been playing with VoIP for years. I have set up an asterisk machine, (both as a service on my existing Linux box, and as a VM... many different iterations of the VM), I've had a commercial VoIP phone line from Primus, and later took the Sipura SIP ATA that I had been using with Asterisk and used it with various VoIP wholesalers directly, and in the end this is the solution I have come up with that works best for me:

Service Provider: voip.ms
SIP ATA: Cisco SPA122 (This is the box that all your old fashioned analog phones plug into)
Desk Phone: Grandstream GXP2000 (used for business line and house line)
Spare SIP ATA: (because it's a little buggy and I don't have time to figure out why, so I plan to use it for travel) Sipura SPA-3000, which is no longer made, but it is the predecessor to the newer Cisco/Linksys SPA-3102

Originally the Sipura SPA-3000 provided a way for me to take my hard wired phone line (hooked up to the FXO port) and feed it into asterisk, then come out of the asterisk box as an extension (connected to the FXS port) connected to all the phones in the house, using the asterisk box as a way to route some calls over the internet, and to provide interesting IVR/answering machine features on incoming calls. (for example, I found I got almost no telemarketer calls if I simply had it send all unrecognized phone numbers to a menu that simply said "press 1 to ring the phone, or stay on the line to leave a message"

Nowadays I have no hard wired voice line. I have my phone number set up as a DID at  voip.ms and then each of my SIP devices register as a separate sub-account (extension) there. The DID rings to a Ring Group made up of all of the extensions, so all of the phones will ring when the house phone number is dialed. I filter any telemarketers through CallerID Filtering, sending most to either a "this number is no longer in service" message or just a straight hangup. Charities are treated a little bit better, they are sent to a message saying that their number has been recognized as a charity and that I don't give money over the phone, but if they want to get a message to me they can send an e-mail. ...and that I get a lot more calls from clothing drives than I have clothes to give, so if they are calling on behalf of a clothing drive I have nothing available. That basically takes care of most of the telemarketers and other annoyances. Filters for obvious fake phone numbers also help. By that, I mean numbers that are too short to be actual phone numbers...telemarketers use VoIP too, and sometimes either by mistake or on purpose, they fill out the "outgoing number for caller ID" field wrong.

So, if you are looking at the specs of the Cisco ATA, you will notice that there are 2 phone ports (FXS ports). My idea for that is to hook some of the phones in the house up to one port and some up to the other and have each port register as a separate extension. Not only will this allow 2 simultaneous calls from the same house at no extra cost (except per minute usage fees) it also adds a bit of redundancy in that if one extension fails to register properly with the voip.ms servers, the other may still work. They all still ring when the phone number is called due to the ring group setup explained earlier. That is, unless someone is currently talking on the phone. In that situation other phones on that same extension will not ring.

What does all of this cost? aside from the purchase cost of equipment (which was not terribly expensive) I pay $0.99/month for the DID, and per minute usage for both incoming and outgoing calls. In the month of May the usage added up to $19.16, in June the usage was $15.26, in July it was $1.31 yes that is one dollar and thirty one cents. I guess we didn't make as many long distance calls in July. Yes, you pay for local calls too, but the rate is so ridiculously low that it doesn't matter.

I have also found it useful to set up an IVR for incoming calls from my cell phone that lets me press 1 to ring the house phones or 2 to leave myself a voice mail (which automatically gets saved as a .WAV file and e-mailed to me, so it is useful if I just want to take a quick note of something) or 3 to dial out, in case I want to make a long distance international call and not have it billed to my cell phone.

Sophos

This is going to sound like a sales pitch, but I assure you I am not being paid by Sophos to say this.

I've been deploying Sophos Anti-virus at work in stages over the last month or so, and I am continually amazed at how many of the JavaScript Trojan droppers and Fake Antivirus programs it is finding in people's temp and temporary internet files, or buried in system restore points that the previous antivirus just plain missed.

I'm not talking about bleeding edge definitions for variants that just came out the day before the switch either. I'm talking about stuff that's been sitting in temp for months in some cases.

If you are curious how it'd do in your environment, download the free removal tool and run a one time scan of your system. or sign up for a trial of the full thing. It really does find stuff that the other guys miss. http://www.sophos.com/en-us/products/free-tools/virus-removal-tool/download.aspx

Sophos doesn't have a home user product like most of the other antivirus companies, but even for small businesses they have packages that are fairly affordable, especially if you bundle several products. With our government pricing we managed to get a replacement for our antivirus including e-mail servers, plus a spam appliance as a VM and mobile device management, endpoint encryption, and a few other things for about what we were paying for maintenance on the anti-virus parts with another company.