The Harvard Network: An Overview of Connectivity and Security 31 Oct 2017

Agenda Network overview 8/23/2018 Agenda Network overview Internet connectivity and “built-in” security features Firewalls and School inter-connectivity Medical affiliates Amazon Web Services and CloudShield Supporting research at MGHPCC Challenges Q&A Christian

8/23/2018 Purpose Brief the CIO Council on how Harvard’s network “works” at a high level, including what security features are and are not included. Christian

8/23/2018 Intended Outcomes CIOs have a high-level understanding of how Harvard’s network works and how the Schools are connected to one another, the Internet and the Amazon Web Services (AWS) cloud. CIOs have an opportunity to ask questions and provide feedback on this topic. Christian

8/23/2018 Introduction Utilizing Internet-based technologies, Harvard University IT (HUIT) operates an network backbone that connects the schools to: One another To Internet and Internet2 To Harvard affiliates like the Longwood Medical (LMA) hospitals To HUIT datacenters and hosting facilities at 1 Summer St and 300 Bent To Research Computing assets This network acts as a foundational enabler for sharing research and data both within Harvard and out to other R&E institutions Jefferson

What Does the Harvard Network Look Like? 8/23/2018 Jefferson What Does the Harvard Network Look Like?

8/23/2018 Jefferson

Well, that wasn’t that useful. Try again. 8/23/2018 Jefferson Well, that wasn’t that useful. Try again.

Logical Representation of a Campus Network 8/23/2018 Logical Representation of a Campus Network Jefferson

That was even more useless. One more time. 8/23/2018 Jefferson That was even more useless. One more time.

Overview of the Harvard Campus Network 8/23/2018 Overview of the Harvard Campus Network Border: connects Harvard to NOX, Internet, Internet2 (2x100gb) 20-30 GIGABITS per second border traffic Core: all schools and regions inter-connect via the Harvard Core (4x10g) Plans to add 100gb in future Region: specific parts of campus like River, Yard, Northwest, Law, LMA (2x2x10gb) Allston will be added as a new region “Last Mile”: Building Distribution/Uplink (mostly 2x1gb) Access (100mb or 1gb) Jefferson

Harvard Internet Border and Information Security Visibility 8/23/2018 Harvard Internet Border and Information Security Visibility 2 Border routers: 300 Bent 1 Summer 2x100gb to NOX An advanced networking exchange/NREN established in 1999 by Harvard, MIT, BU We also have 3 other Internet connections: Cogent Level 3 CenturyLink Information Security visibility at each border router and AWS Jefferson

“Built-in” Security Features 8/23/2018 “Built-in” Security Features Bro intrusion detection system (IDS) and network traffic forensics Network flow data logged to Splunk for correlation and alerting FireEye malware detection BONUS: DMCA violation processing and delivery Robust detection capabilities Very few built in protections Christian

Firewalls None at the Internet border 8/23/2018 Firewalls None at the Internet border Though we do coarsely block a few “ports” In front of the data center In front of our AWS presence Many Schools have their own For others, each “VLAN” (individual network) has firewall capabilities Block “Microsoft” ports (445, 3389, etc.) Christian

School Inter-connectivity: how does one School impact others? 8/23/2018 School Inter-connectivity: how does one School impact others? It depends… Some Schools have firewalls configured to “protect themselves” from Harvard Others have firewall capabilities on each individual network Defining exactly what is Harvard from a network perspective can be challenging Medical affiliates? Just like the Internet…mostly Christian

LMA Net 2 HUIT-operated gateway ASR Routers: 2x10gb to Harvard Border 8/23/2018 LMA Net 2 HUIT-operated gateway ASR Routers: Gordon Hall Dana Farber 2x10gb to Harvard Border Discussions underway for 40gb or 100gb Additional 10gb link to Harvard Core for VoIP traffic InfoSec Taps at each Border capture ingress/egress Not intra-LMA LMA interest in aggregated and shared firewall logs via Splunk       Jefferson

HUIT Cloud Connectivity and Cloud Shield 8/23/2018 HUIT Cloud Connectivity and Cloud Shield HUIT has multiple 10gb Direct Connect links into AWS 2 Harvard Points of Presence: 1 Summer St in Boston and Equinox Datacenter in VA Can provide private access into AWS VPC’s AWS public peering to S3 and other “front door” services CloudShield Network Security infrastructure Can be extended to other cloud providers in the future Jefferson

HUIT Cloud Connectivity and Cloud Shield 8/23/2018 HUIT Cloud Connectivity and Cloud Shield ”Next-Generation” Fortinet Firewalls 1 Virtual Firewall per AWS VPC Inbound and outbound traffic enforcement Intrusion detection and prevention Implicit outbound Web Proxy Load balancing Can be extended to include other cloud providers Network traffic sent to central information security complex and processed by same tools for further intrusion detection and network forensics Christian

MGHPCC Close partnership with FAS RC on network access 8/23/2018 MGHPCC Close partnership with FAS RC on network access Leveraging MIT’s optical network, we have 2 diverse connections to MGHPCC 20gb in each direction Short Path: faster, default path (2.9ms RTT) Long path: adds DR resiliency, increased latency due to distance (10.2ms RTT via NYC) Jefferson

8/23/2018 Challenges Duplicate 10.x networks at HMS and HUIT Infrastructure means these networks can’t easily “talk to each other” (without complex configuration) Students not currently meaningfully separated from faculty or staff in a scalable way from a network perspective Some “bleed” between what we consider HMS networks and the smaller medical affiliate networks Without a true firewall at the Internet border, we don’t have a way to block attacks from the Internet University-wide (other than a very coarse set of filters we can apply) Rapidly changing landscape for security in the Cloud Traditional security monitoring and enforcement methods more challenging (or more expensive) at 100gb+ Christian/Jefferson?

8/23/2018 Questions