Gaspar Modelo-Howard NEEScomm Cybersecurity Software Engineer Saurabh Bagchi NEEScomm Cybersecurity Officer
Scanning of Remote Sites Incident Response Procedure Best Security Practices Remote Authentication Service NEEScomm Security Operational Duties GOAL Ensure that NEEScomm can operate and maintain its IT resources to serve the NEES community
Objective: To check the security of the IT resources at the sites Guiding principles: ◦ Be proactive ◦ Minimize impact to the sites’ activities Will be done once per year ◦ Remote (non-intrusive) scans from “inside” the network ◦ Limited to site IT assets from inventory ◦ Time schedule determined between SIM and CSO
Candidate scanners to be used: Nessus, Nikto, web app scanners Critical vulnerabilities will be immediately identified and reported to SIM with mitigation hints Each discovered vulnerability will follow an incident report procedure Results of the scan will be documented in a comprehensive archival report
If it pertains to operation of NEES IT resources, at earliest possible opportunity Form available from (not working yet) Telephone line set up ◦ Report the incident via a voice message ◦ Greeting message will prompt for required information and will trigger a ticket which will notify NEEScomm IT support ◦ NEEScomm IT will contact the person reporting the cybersecurity incident to gather standard information, primarily IP and description of incident ◦ Information will be recorded in the current ticketing system and will be tagged as a cybersecurity incident
A team for resolving the incident will be developed by the CSO in consultation with the SIM Criticality level of the incident will be determined: critical, important, moderate, low Site IT resource may be taken offline to prevent spread of the security incident Record will be kept of the incident progression through the ticketing system Incidents of a grave nature will need to be reported to NSF, as per agreement with NSF
Modification of previous remote authentication service (gridauth.cgi) by Karan Bhatia ◦ Objective was to make as few changes (to users) as possible Accessible thru Complete URL: /gridauth.cgi?username=uuuuuuu&password =ppppppp
User account administration NEEScomm servers audit ◦ Source code File integrity checker Intrusion detection system
1. Encourage difficult to guess, easy to remember passwords, especially administrators accounts 2. Keep your systems up-to-date with patches and updated software versions 3. Monitor system logs periodically 4. Have backup and disaster recovery processes 5. Create educational sessions for users – we can help 6. Screen lock on unattended user terminals 7. Decide from which IP addresses you will allow users to connect to your critical IT assets Sites’ feedback is appreciated
Contact: Gaspar Modelo-Howard / Saurabh Bagchi, PhD /
gama.neeshub.org Existing Accts.: 222 Migrated: 1258 NOT migrated: 367 Migrated: 1258 neesforge.neeshub.org Migrated: 159 NOT migrated: 138 ml.neeshub.org Migrated: zero NOT migrated: 1788 Migrated: 159 Migrated: zero Total Number of Accounts: 1639
Unix47% Windows44% Others9%