I’m running out of space. My Synology DiskStation DS1621xs+ (originally provided by Synology, thank you!) is at 89% full. Rather than waiting until it actually runs out, I decided it was time to upgrade one of the drives.
Because I’m running SHR RAID, I can have different sized disks. All my disks in the unit are shucked from Western Digital (WD) or Seagate external enclosures – because it’s cheaper to do that than buy disks outright. This time I’ve bought an 18TB WD drive, which takes about two minutes to remove from it’s case. (Note that before removing, I always test the drive to make sure it’s not DOA. WD and Seagate should still honour the warranty anyway if a drive fails later, and I’ve done this on a shucked WD drive before successfully).
This NAS supports hot swapping the disks, so I don’t need to do any prep or power it down – just make sure you have a backup in case it all goes wrong (which you should have anyway if you care about the data).
Here’s a quick video of the drive swapover:
On the Synology itself – Before the upgrade:
10TB drive has been taken out, Synology starts beeping in a concerning way due to being in a degraded state:
New drive inserted:
Using the Action > Repair option to start the rebuild
Then comes the waiting game for the repair, which took about two days to complete:
Note that adding a single 18TB disk is wasting some of the space. If you look at their RAID calculator (which right now goes up to 16TB only but will still show the problem) before taking out the 10TB in bay 6:
Swapping the 10TB to a 16TB only gives 2TB more available space, and 4TB unused, because it hasn’t got available capacity anywhere to mirror all the space the 18TB disk had:
However, if we drop out another 10TB for another 16TB, we see the available space jump up to 60TB and no unsued space. This will be my plan, order another 18TB drive to shuck which should take me all the way up to 62TB available space.
For home use, I really like the Synology Hybrid Raid (SHR) because it provides actual redundancy, as well as easy expansion. I don’t have to commit to buying a bunch of drives at once of all the exact same size, and can gradually increase if and when I need more space. The process of upgrading a disk is so easy too that it’s not an inconvenience when upgrade time comes around.
A new feature has turned up today in Microsoft Teams – the long awaited ability to route unassigned numbers. This was available in Skype for Business On-premises, and is great for misdials or when someone departs the firm, their calls can be sent to someone else, such as reception. There’s no ongoing work or maintenance required either, once a number is unassigned, it can be picked up by these rules.
The documentation is light at the moment and it’s in preview, but it does work. Note that I’ll cover the call redirect option, but there’s also an option to redirect calls to a pre-recorded message in WAV format.
First, make sure your MicrosoftTeams PowerShell module is at least 2.5.1. The latest live version at the time of writing is 2.6.0 so you don’t need to worry about preview module versions – just the PowerShell command:
Update-Module Microsoft Teams
will update. You can check the version afterwards with this command:
Once your MicrosoftTeams module is up to date, and if you’re redirecting the call to a user, auto attendant or calling group, you’ll first need to get the ObjectID. Here’s Microsoft’s example for a resource account:
Once you have the $UserObjectID value set, it’s time to create the Unassigned Number Treatment. The possible options for this command are documented here and again here’s an example:
Identity: This needs to be a unique value for the treatment and can be a descriptive name.
Pattern: This is where you define the number pattern. In my example above, I’m wanting the number to match what I’ve defined up to the last two digits, which can be anything.
TargetType: This needs to be defined as User, ResourceAccount or Announcement for the Target.
Target: This is the ObjectID from the first command.
TreatmentPriority: This needs to be a unique number for each treatment, and has an order preference in case of overlap in rules. I’m using 2 above purely because it’s the second one, and have no plans on overlapping rules.
Once the New-CsTeamsUnassignedNumberTreatment command has completed, it won’t apply immediately – in my testing it took roughly 15 minutes.
I’m really glad this feature is now available – and I expect others have also been waiting for it to be available, or weren’t aware it was even an option.
First, the unboxing. I don’t bother about this too much usually when reviewing hardware, but there’s a fair bit of attention to detail here. A mounting guide for the screw holes that includes a tiny spirit level, the detailed hole explanations on the plate, and the hardware kit – an assortment of screws and brackets that come in a nice sleeved foam holder, so you don’t inevitably drop something when you would normally find these in a plastic bag to rip open.
The size difference of the Access Point nanoHD vs Access Point WiFi 6 Long-Range is substantial (and is a bit over 3x as heavy):
Comparing the specs between the two:
NanoHD:
Four-Stream 802.11ac Wave 2 Technology
Simultaneous Dual-Band Radios
Supports 200+ Concurrent Users
5 GHz Band 4×4 Multi-User MIMO with Radio Rate of 1.733 Gbps
2.4 GHz Band 2×2 MIMO with Radio Rate of 300 Mbps
Powered by Gigabit 802.3af PoE
U6-LR:
1.3 GHz dual-core processor (now upgraded to support full-duplex 1 Gbps TCP/IP performance)
Four-stream high-efficiency Wi-Fi 6 technology
5 GHz band 4×4 MU-MIMO and OFDMA with radio rate of 2.4 Gbps
2.4 GHz band 4×4 MIMO with radio rate of 600 Mbps
Powered with 802.3at PoE (PoE injector not included)
Both units at the time of writing are the same price of $179US. Beyond the Wi-Fi 6 functionality on the U6-LR, the radio rates are higher and denser on it too. It’s worth noting the U6-LR has a the updated PoE requirement (also known as PoE+) and does not come with a PoE injector; if you’re already using a PoE+ switch like I am, this isn’t an issue. Otherwise, order a US$12 PoE Injector with the 802.3at standard
Swapping over the units was incredibly easy – I hadn’t mounted the NanoHD since moving, and may end up mounting this one once I’ve been using it for a bit and know I’m happy with it.
When I say it was easy; after swapping the network cable over, I logged onto the UniFi Dream Machine (UDM) web interface, went to the network devices page, and clicked ‘Adopt device’ that popped up. About a minute passed, and the device was now under control:
There was an update available, which upgraded the device from 5.43.15.12477 to 5.60.9.12980. I decided to add the second U6-LR on, but this time it would take over the Wi-Fi duties of the UDM; I adopted it into the UDM, then went into the WiFi settings for both the 2.4ghz and 5ghz networks, created a new AP Group, and ticked all but the UDM and applied (I have separate WiFi network names for the different bands due to an issue with a 2.4ghz only device that wouldn’t work when both bands were used on the same name).
Once I had done all this and let the connections settle down, the experience across each wireless AP was 92% or better. My Samsung Galaxy S21 shows a little ‘6’ next to the WiFi symbol.
I’ll take a few days living with this to see if there’s any issues that pop up, or if I notice any improvements (one sore point was a Chromecast that would dip in video quality now and then).
It’s been going very well. No dropouts or hiccups of any sort, and I’m noticing on my mobile that I stay on 4 bars around the house rather than dropping to 3 in some areas – which makes sense now being on a long range access point.
Also I found this video also looking at the UniFi 6 LR which has some extra info and visuals:
Microsoft Mechanics just released a video about how to set up Microsoft Teams Phones which as always, is a good high level technical overview of something Microsoft is doing. Here’s the video:
Personally, I’ve been living with using Microsoft Teams as the phone system for PSTN calls for about 6 months now, after coming from Skype for Business On-premises. There are some aspects that do ‘just work’, but there’s also limitations to be aware of. For reference, I’m using it via Telstra’s TCO365 service, which may give a bit of a different experience to others not using it this way. For example, I can’t get PSTN call logs via Teams itself:
With Skype for Business On-Premises, we had multiple gateways to convert the SIP calls into SfB. It’s now all happening in the cloud, I just have a range of numbers provided by the telco that turn up in Teams and can allocate them, along with the user requiring the right Micrsoft license, and the TCO365 license. There’s no specialist knowledge required to maintain any gateways, and reduces complexity of the environment. The gateways were mostly set and forget – but still needed work do to manual updates. If one had a fault, it’d be a pain to resolve.
Microsoft Teams Client
This will also appear as a con later, but everyone already uses the Microsoft Teams client for meetings – so the learning curve isn’t as bad compared to using another platform. It very much leads into the notion that beyond email, Teams is trying to be the single pain of glass for immediate interactions and communications. The client receives constant updates which can bring quality of life improvements.
Teams Admin Portal
The admin portal is generally a lot nicer to use than the old Skype for Business portal, which ran on Silverlight. It is constantly changing and being updated, and has grown in stability since I started using it 6 months ago. There’s a lot more that can be done in there around usage and reporting, and client health. There’s still plenty of improvements that can be made, but for the most part it does work.
Feature Updates
Not having to patch Skype for Business servers is great – a standard benefit of on-premises vs SaaS. The less things we have to manage for no real benefit, the better. When those updates come through, they’re regular, and bring new options to the platform. The client updates of course bring many more features too – but be weary of release dates. When something gets released in June 2021, it probably means that Microsoft are starting to roll it out then, and may take a few months to get to your tenant.
Calling Queues and Auto Attendants
The range of options around these is a lot greater in Teams – you can have a lot of scenarios covered and more complicated rulesets on how to handle calls. Members of a calling queue can also optionally have the toggle in their client if they want to be a part of it or not, which is handy to give end users the ability to jump in and out.
Cons:
Microsoft Teams Client
A double edged sword – it is nowhere near as slick and well designed as Skype for Business was for purely making phone calls. The interface is huge, becuase it’s designed to do so much; but the phone aspect still feels like an afterthought that constantly changes. Doing something simple like clicking in the field to dial a number, typing it and pressing enter does not call the number. You have to press enter twice – but not straight away, that won’t work, you have to wait for it to pop up a dialog showing it’s got the number ready to dial, then press enter again. Or, you can then go to the mouse and click call, which to me isn’t as good since I just used the keyboard to type a number in. Clicking all the digits of a phone number isn’t fun.
The Teams client is still memory hungry, has a lot of weird bugs (at one stage, the Calls icon just wouldn’t show which makes it very hard to make calls!). A whole re-write of the Teams client will come out at some stage, so hopefully that runs a lot better.
Desk Phones
This is another aspect that feels like it doesn’t get enough attention and effort. The Teams app that runs on Android will power any desk phone, and it’s not instantly quick to respond. It’s good enough, but not great. Many phones still don’t support being automatically updated via Teams, but will support a manual update. Part of the desk phone experience comes down to which third party vendor you pick, but features like being able to swap a PSTN call between desk phone and PC are still coming – these should have been there from day 1.
Unassigned Number
On Skype for Business, there was a great feature that would redirect calls of unallocated numbers in number ranges to another number – so if someone left, their calls would go to reception. This isn’t available in Teams at all, if you want to recreate the feature, you’ll have to pay license and phone company fees for every single number you’d like to do this to. A real pain.
Calling Queues and Auto Attendants
Although another positive, the internal Teams support for this is poor. If you try to look up the name of a calling queue in Teams, it won’t come up. So, if you create a Helpdesk group and expect internal staff to be able to type ‘Helpdesk’ in to find and call them, you can’t. I’m really disappointed on this one. The workaround is to fully license an account called Helpdesk, and set that to divert all it’s calls to the calling queue number.
There’s a bunch more points to consider, if you want to see a comparison on features for Skype for Business vs Teams in it’s multiple iterations of phone support (Teams Calling Plan, Teams Direct Routing, Teams Operator Connect) check out Luca Vitali’s constantly updated feature comparison table
I am looking forward to seeing how Teams Phones progresses and becomes a stronger product; in it’s current state be aware of the existing limitations and if it meets your requirements. It’s also worth seeing what’s on the roadmap for Teams and Phones to know what’s coming.
In the firsttwo parts of this series, I went over what happens when BitLocker attacks your computer when the computer is unprotected, and what it takes to possibly recover at least partially from the attack. While it is possible that someone who is prepared will not be significantly impacted by a ransomware attack, most of us will not be so lucky. In most cases, a ransomware attack will mean completely restoring the computer to its factory settings and losing most or all of our data. This is clearly not the best option for anyone, so what can we do to make sure that we don’t become a victim in the first place?
Be prepared
The phrase is a little cliche, but it’s the best piece of advice I can provide. It’s easy to say, but what does it mean? Being prepared in this case means that you are assuming that you will be attacked at some point, and you have protections in place to stop the attack early in the attack chain, while also having measures in place to stop the attack at later stages and recover from damage in case the attack can’t be prevented early on. It’s something we advise all of our customers to do at Acronis. Attackers are continually improving their tactics and tools, which means that a solution that is continually updated and implements detection that has a better chance of detecting future attacks is key.
When it comes to ransomware, there are a number of aspects we need to consider. How did the ransomware get on the computer in the first place? How can the ransomware be stopped early? How can the ransomware be stopped before significant damage is caused if the initial attack isn’t stopped? How can we easily recover from an attack if all other methods fail? By asking these questions, we can find a solution that ensures any attacks have little to no impact on our lives.
Just stop it!
The best way to avoid an attack is to stop it before it starts. Most ransomware attacks come from malware installed because of a phishing attack, or a vulnerability in the software we have installed. The solutions here are fairly simple, as we can learn to keep from opening attachments or clicking links in unexpected emails and keep our software updated. Another good practice is to uninstall any software that we stop using. Old software potentially adds vulnerabilities to our computers, even if we don’t run the software anymore.
Of course, a solution to help us avoid some of the malicious servers and websites is available as well. Sometimes a link or file may be convincing enough that even a well-trained individual may be fooled. This is where URL Filtering comes in. A solution that prevents access to malicious URLs will help to keep us from accessing dangerous websites, or having documents download malware behind the scenes.
Stop it early
In the cases where an attacker uses an unknown vulnerability, also known as a zero-day vulnerability, or a new website or server, we can still stop most malware before it can impact our systems. A good, modern, antivirus that utilizes AI and behavioral detection will usually be able to stop even new droppers and trojans, preventing the installation of ransomware early on in the attack chain. By utilizing newer technologies, rather than relying on classical antivirus solutions that just look at the code or the file hash, we can ensure that even new malware is detected and blocked by the solution you implement.
At least stop it
Even with modern antivirus, there may be times when the initial malware isn’t stopped. As I have previously mentioned, attackers are constantly updating how they do things, and sometimes they find novel ways to attack systems that haven’t been considered previously. This type of attack may even be able to bypass behavioral detection or AI analysis. This is where dedicated ransomware protection comes in. There are behaviors exhibited by ransomware that will exist no matter what methods are used. For instance, multiple files being encrypted is a strong indicator of a ransomware attack. A solution that specifically looks at ransomware behaviors, and provides proper protection against ransomware, will create protected duplicates of files as they are accessed, then will stop the ransomware and be able to restore the files from the backups it created. It is important not to rely on Windows shadow copies, as some ransomware will delete these copies to prevent easy access to be able to restore the files.
Reverse total destruction
Even with the best solutions, there is always going to be a worst-case scenario. When the attack starts, executes and completes, a proper solution ensures that all is not lost. It is important to have a backup solution that can scan backups for malware, and protects the backup files from tampering. With a full backup, it can be made simple to restore the system to the last backup prior to the attack. If there have been new changes to files between the last backup and the attack, it is still possible to lose some data, but this will minimize the impact of any lost data and will ensure that any lost data is recent enough that it will be much easier to remember what it was and recreate it.
The key consideration with your backup solution is that the backups must be protected from tampering. A recent addition to the common tactics of ransomware operators is to identify and delete or encrypt backups. Ensuring that the backups are protected against tampering will help to ensure that they are available when it comes time to use them to recover your files.
Final thoughts
While it can be overwhelming to think about a ransomware attack, there are ways to make sure you can easily defend against or recover from an attack. Even if you think you are not a target, it is important to have a multi-layered solution that covers attack prevention, malware detection, ransomware protection, and protected backups. With such a solution in place, you can rest easy knowing that if an attack comes, you have a solid security posture, and won’t be significantly impacted by the attack.
Topher Tebow is a cybersecurity researcher, focusing on community collaboration and threat analysis. Topher has been working with malware and other cyberthreats for more than a decade, beginning with web-based malware before moving into endpoint protection. Topher has written technical content for several companies, covering topics from security trends and best practices, to the analysis of malware and vulnerabilities. In addition to being published in industry publications like Cyber Defense Magazine and Security Boulevard, Topher has contributed to articles by several leading publications, and spoken at international cybersecurity events.
