Vulnerability Management Team Information Security Office Web Cluster Scans Vulnerability Management Team Information Security Office Intro!

Where do we start? Why is this important? What is the web cluster? To understand a web cluster, you need to start with a web server. A single server that hosts web content for others to see. A cluster is simply a group of servers that all host the same content, and you do this when you expect a large amount of traffic, as our main web presence does. In order to make this cluster work, you need staff. Lots of staff. You need staff to manage the servers themselves, which we have within OIT, and you need developers to manage the code, content, and functionality of the web applications, which we also have through University Web Services and the departmental developers that work for specific areas of the campus community. Once you have both of these elements, along with a sound network to host them on, you get your www.utdallas.edu web presence. This is important because our web presence is our number one way that the world gets to know us. It’s helpful to those who are a part of UT Dallas, but it is much more valuable to the outside world. So, between the servers, the different departments who own different sections of our web presence through the cluster, and everything in-between – where do we start?

786 57 28% Inventory Document Contact Report Plan Scan We start with an inventory, which we already have completed for the top level directory structure of the web cluster. There are 786 top level directories within the cluster. Then, we start getting in touch with those who we have identified as the content owners or custodians for those areas. This is usually the department web developer or UWS. We have identified at least 57 unique points of contact. We are still waiting to hear back from a few areas, but this number could easily be above 60 by the time everything is finalized. We then plan out our strategy. When to scan, what to include, what to prepare for, etc. will all be asked at this point in time. During this planning process, we’re going to be working through some findings we have come across during the inventory process, including 28% of all top level directories leading to some form of error page, which we believe is most likely going to be some easy cleanup. Once we feel good about our plan, we move forward and scan the application(s) using our web application scanning tool, Trustwave App Scanner. After the scans have finished, we then report our findings, even if the findings are that the application looks good. If items need to be addressed, we report those findings and rescan the application to verify that changes have resolved the findings. Finally, after all of those steps are done, we document everything. We want to retain this information for future usage. Let’s not forget this important arrow, which will actually get his own slide right after this. I’ve colored him different from the others for easy recognition. Since there are hundreds of top level directories, each will need to be tested and run through this cycle. We can do more than one at a time, but those determinations will be made at a later date. Report Plan Scan

Web Application Classification “All applications are subject to periodic application vulnerability scans conducted or sponsored by the Information Security Office. For applications that are Internet-accessible or host Confidential or Controlled Data, these scans must be conducted at least annually. All other applications must be scanned for application vulnerabilities every two years.” -ISO Web-based Application Standard We have established a web classification format within our group. This qualitative assessment uses multiple factors, some weighted higher than other, to establish how frequently something should be rescanned. The more important the data, for instance, the more likely we would want to rescan that application. With that in mind, we want to take this opportunity to also discuss the results of each directory scan with the responsible parties for each area and have the classification conversation. We will need to work out details on how to perform the subsequent rescans in the future, but for now, just getting started with the initial conversation would be a big help for future efforts.

Questions? Questions?