• Github : https://github.com/alist-org/alist
• Document: https://alist.nn.ci/
• Demo: https://al.nn.ci

Introduction

• Audio types: mp3,flac,ogg,m4a,wav,opus
• Video types: mp4,mkv,avi,mov,rmvb,webm,flv
• Image types: jpg,tiff,jpeg,png,gif,bmp,svg,ico,swf,webp
• Documents: doc,docx,xls,xlsx,ppt,pptx, pdf

PaaS To Deploy Alist

Free Database for PaaS Deployment

Add Storages

Local 

Google Drive:

If you have your own Client ID, Client Secret, and refresh token, you can directly paste them in here. As to how to get your own Google Drive's following information, I will put them into another post to talk about it. 

To make it simple, you can use a default client id / client secret to generate your refresh_token for your Google drive folder, using https://tool.nn.ci/google/request:

After you collected all those information, you can enter them into this AList page to add your Google Drive folder to show all the files / folders. 

OneDrive:

Same as Google Drive, it had better to have your own client id 

To make it simple, we also can use  https://tool.nn.ci/onedrive/request to generate all information. 

Videos

 

Online AList Sites

 

Configure Interfaces

Configure Destination NAT Firewall Rule

References

• Barracuda CloudGen Firewall Get Started
• Quick Start Guide
• Barracuda Cloud Control
• Barracuda Campus
• Default Forwarding Firewall Rules

STEP 1: IDENTIFY STAKEHOLDER NEEDS 

• • Determine the internal and external (usually restricted) stakeholders and their  interest in organizational Cybersecurity. 
•  • Incorporate  confidentiality  needs and mandated  secrecy  in  the identification  process. 
• • Understand how cybersecurity should support overall enterprise objectives and  protect stakeholder interests. 
• • Identify  reporting  requirements  for  communicating  and  reporting  about  cybersecurity (contents, detail). 
• • Clearly  define and articulate instances  of  reliance  on  the work  of  others (for  external auditors). 
•  • Define and formally note confidentiality and secrecy requirements for external  auditors. 

STEP 2: MANAGE CYBERSECURITY TRANSFORMATION STRATEGY. 

• • Review legal and regulatory provisions in cybercrime and cyberwarfare 
•  • Identify  the  senior  management  tolerance  level  in  relation  to  attacks  and  breaches. 
• • Validate  business  needs  (express  and  implied)  with  regard  to  attacks  and  breaches
• • Identify and articulate any game changers or paradigm shifts in cybersecurity. 
•  • Document systemic weaknesses in cybersecurity as regards the business and its  objectives 
• • Identify and validate strategy for cybersecurity (“zero tolerance” vs. “living with  it”) 
•  • Identify  adaptability,  responsiveness  and  resilience  of  strategy  in  terms  of  cybersecurity attacks and breaches 
•  • Identify  any  rigid/brittle  governance  elements  that  may  inadvertently  be  conducive to cybercrime and cyberwarfare (e.g., instances of over control) 
• • Define the expectations, in alignment with strategy (“zero tolerance” vs. “living  with it”), with regard to cybersecurity, including ethics and culture. 
•  • Highlight any ethical/cultural discontinuities that exist or emerge. 
•  • Define  the  target  culture  for  cybersecurity,  and  develop  a  cybersecurity  awareness program. 
• • Obtain management commitment for the selected strategy 

STEP 3: DEFINE CYBERSECURITY STRUCTURE 

Structure 

• • Define  the  Cybersecurity  organizational  structure  –  an  appropriate  platform/committee,  in alignment with  information  security and information  risk functions. 
• • Highlight  any  barriers  or  other  organizational  segregation  of  duties/information. 
• • Mandate an appropriate cybersecurity function, including incident and attack  response 

Roles and Responsibilities 

• • Determine an optimal decision‐making model for cybersecurity— this may be  distinct and different from “ordinary” information security 
• • Define high‐level RACI (responsible, accountable, consulted, informed) model  for cybersecurity function, including any external resources. 
• • Consider any extended decision rights that may be applicable in crisis/ incident  handling situations. 
• • Determine  cybersecurity  obligations,  responsibilities  and  tasks  of  other  organizational roles (including groups and individuals). 
• • Ensure cybersecurity participation at the steering committee level. 
•  • Embed  cybersecurity  transformation  activities  in  the  steering  committee  agenda. 

Communications 

• • Establish  escalation  points  for  attacks,  breaches  and  incidents  (information  security, crisis management, etc.)
• • Define escalation paths for cybersecurity activities and transformational steps  (e.g., new vulnerabilities and threats). 
• • Establish fast‐track/crisis mode  decision procedures with escalation  to senior  management. 
• • Identify  the  means  and  channels  to  communicate  cybersecurity  issues  and  information. 
• • Prioritize cybersecurity reporting to stakeholders by applying the principles of  least privilege and need‐to‐know basis. 
• • Develop appropriate guidance for associates. 

Integration 

• • Integrate, to the appropriate extent, the cybersecurity direction into the overall  information  security  direction,  and  highlight  areas  of  cybersecurity  that  are  deliberately kept separate and distinct. 
• • Establish interfaces between the cybersecurity function and other information  security roles. 
• • Embed  cybersecurity  reporting  into  the  generic  reporting  methods  for  information security. 

STEP 4: MANAGE CYBERSECURITY RISKS   

• • Determine  risk  appetite/tolerance  levels  in  terms  of  cybercrime  and  cyberwarfare attacks and breaches at the board/management level.  
• • Align  risk  tolerance  levels  against  the  overall  strategy  (“zero  tolerance”  vs.  “living with it”). 
•  • Compare  cybersecurity and generic information  security  risk  tolerance levels  and highlight inconsistencies.  
• • Integrate  cybersecurity  risk  assessment  and  management  within  overall  information security management.  

STEP 5: OPTIMIZE CYBERSECURITY RESOURCES  

• • Evaluate  the  effectiveness  of  cybersecurity  resources  in  comparison  with  information security and information risk needs. 
•  • Validate cybersecurity resources in terms of specific goals and objectives.  
• • Ensure  that  cybersecurity  resource  management  is  aligned  to  overarching  information security needs.  
• • Include external resource management.  

STEP 6: MONITOR CYBERSECURITY EFFECTIVENESS  

• • Track cybersecurity outcomes and effects, particularly with a view to changes  in attacks/breaches/incidents. 
• • Compare  outcomes  against  transformation  steps  and  milestones  –  initial  (current state) and future (target state) expectations.  
• • Integrate  cybersecurity  measurements  and  metrics  into  routine  compliance  check mechanisms.  
• • Evaluate threats and vulnerabilities relevant to cybersecurity, and incorporate  the changing threat landscape into cybersecurity strategy.  
• • Monitor  the  risk  profile  for  attacks/breaches  and  the  corresponding  risk  appetite  to achieve optimal balance between cybersecurity  risk and business  opportunities.  
• • Measure  the  effectiveness  of  cybersecurity  resources (internal  and  external)  against defined information security needs, goals and objectives. 

Cyber Security : Governance vs Operation

Detect, prioritize, and control

Plan - Do - Check - Act model

• Plan. The overall GRC/IRM process beings with planning. This planning will define the policies, standards and controls for the organization. It will also directly influence the tools and services that an organization purchases, since technology purchases should address needs that are defined by policies and standards.
• Do. Arguably, this is the most important section for cybersecurity and privacy practitioners. Controls are the “security glue” that make processes, applications, systems and services secure. Procedures (also referred to as control activities) are the processes how the controls are actually implemented and performed. The Secure Controls Framework (SCF) can be an excellent starting point for a control set if your organization lacks a comprehensive set of cybersecurity and privacy controls.
• Check. In simple terms, this is situational awareness. Situational awareness is only achieved through reporting through metrics and reviewing the results of audits/assessments.
• Act. This is essentially risk management, which is an encompassing area that deals with addressing two main concepts (1) real deficiencies that currently exist and (2) possible threats to the organization.

Plan – Policies & Standards

Do – Controls & Procedures

Check – Reporting & Assessments

Act – Risk Management

References

• Cyber Security Governance A Component of MITRE's Cyber Prep Methodology

The following table contains the Azure RBAC permissions related to this configuration. If you're using Azure Storage Explorer, you'll also need the Reader and Data Access role in order to read/access the file share.

Supported Windows ACLS (NTFS)

The following permissions are included on the root directory of a file share:

• BUILTIN\Administrators:(OI)(CI)(F)
• BUILTIN\Users:(RX)
• BUILTIN\Users:(OI)(CI)(IO)(GR,GE)
• NT AUTHORITY\Authenticated Users:(OI)(CI)(M)
• NT AUTHORITY\SYSTEM:(OI)(CI)(F)
• NT AUTHORITY\SYSTEM:(F)
• CREATOR OWNER:(OI)(CI)(IO)(F)

Mount the file share using storage account key

net use Z: \\<YourStorageAccountName>.file.core.windows.net\<FileShareName> /user:localhost\<YourStorageAccountName> <YourStorageAccountKey>

net use R: \\fileshare4test.file.core.windows.net\fstest /user:localhost\fileshare4test h1GUuy3YasaG1LLNjQLQ8wD9PpYtyeVY1MY6s4s11BJLJQTzyUaX69LzYsDVyYOKm3cXgrsvYOpX+AStkQD+zW==

Robocopy "F:\testshare" "R:\test" /COPY:DAT /SEC /MIR /R:10 /W:5 /V /ETA

./azcopy.exe copy "F:\testshare\" "https://fileshare4test.file.core.windows.net/fstest/testfolder/?sv=2021-06-08&ss=bfqt&srt=sco&sp=rwdlacupiytfx&se=2022-09-13T05:11:14Z&st=2022-09-12T21:11:14Z&spr=https&sig=85MdmVM%2FGwPmAQSay0sDC1mCboxZZP62UdFnYmW1HHR%3D" --preserve-smb-info=true --preserve-smb-permissions=true --disable-auto-decoding=false --recursive --log-level=INFO

Videos