Developing an Effective & Affordable Security Infrastructure in a Small College Environment

About Penn College Williamsport Technical Institute, founded 1941 Williamsport Technical Institute, founded 1941 Williamsport Area Community College, founded 1965 Williamsport Area Community College, founded 1965 Pennsylvania College of Technology, founded 1989 Pennsylvania College of Technology, founded 1989 Special Mission Affiliate of Penn State University Special Mission Affiliate of Penn State University Accredited - Middle States Association of Colleges and Secondary Schools Accredited - Middle States Association of Colleges and Secondary Schools 6,358 headcount - 5,891 FTE 6,358 headcount - 5,891 FTE 288 FTE faculty, 518 FTE staff 288 FTE faculty, 518 FTE staff B.S., A.S. and certificate degrees in over 100 majors B.S., A.S. and certificate degrees in over 100 majors Specialize in vocational and technology-based education Specialize in vocational and technology-based education Strong focus on small class sizes and hands-on instruction Strong focus on small class sizes and hands-on instruction

Williamsport, PA

IT Infrastructure 2,600 College-owned computers, 1,400 student-owned computers in residential complexes 1,600 computers in 50+ academic computer labs, student to computer ratio of 4:1 Standard computer lab software includes Microsoft Windows XP, Office 2003, NetMail POP3 system

IT Infrastructure (contd) 1,000 staff/faculty PCs Standard employee image: Windows XP, Office 2003, Novell GroupWise, iSeries client Novell Directory Services (NDS) IBM iSeries mainframe, home-grown legacy administrative applications WebCT, Sirsi, eRecruiting, Raisers Edge, Cbord Odyssey, EBMS 25 Novell, 15 Microsoft, 3 Linux, 1 Sun, 1 AIX server

IT Infrastructure (contd) 100% Cisco network infrastructure except for Packeteer Packetshaper Fast Ethernet via CAT5 for all building LANs, Gigabit Ethernet via fiber for backbone Dual Cisco 6500s for redundant core Fractional T-3 (30 Mbps) Internet service Dial-up Internet access provided for employees, not students About 50% wireless coverage

Campus Network Layout

Information Technology Services Organization (50 employees) Desktop Computing Academic Computing Technical Support/Help Desk Technical Writer/Trainer Administrative Information Systems Network Applications Mail & Document Services Media Services Telecommunications

Post Y2K IT Security Problem Increasing threats from viruses, trojans, worms, hackers, etc. Lack of security standards No coordinated security response Poor security awareness Minimal security policy No security testing

The Challenge Limitations Budget Staff Time Large backlog of post Y2K projects Balancing security effectiveness with efficient resource management

Solution Analysis Dedicated security staff vs. security team Advantages of team approach: Utilizes existing staff and expertise Spreads/diffuses the importance of security across all functional IT areas Funded through existing budgets Disadvantages: No centralized focus/authority Long lead time to develop expertise Staff time directed away from other projects Not invented here syndrome

The Solution IT management recommended forming a campus security team. Each area of the IT department committed one employee and a percentage of its budget. A senior manager was designated to provide leadership and coordination of this team effort. The team met weekly over an initial 18 month period, then bi-weekly. Rotating duty officer/CERT format

The Context Risk vs. investment Scope and impact for priority Mitigating risk factors Administrative data locked up in IBM iSeries (AS/400) GroupWise system Institutional policy requiring data files to be stored on network drives Centralized IT management and budget culture

7-Layer Security Approach Layer 1 - Physical Layer 1 - Physical Layer 2 - Internet Layer 2 - Internet Layer 3 - Network Layer 3 - Network Layer 4 - ResNet Layer 4 - ResNet Layer 5 - Servers Layer 5 - Servers Layer 6 - Employee PCs Layer 6 - Employee PCs Layer 7 - Social Layer 7 - Social

Layer 1 - Physical Before Distributed servers, not physically secured, some actually in staff/faculty offices Network components not secured Minimal UPS protection After Most non-academic servers moved to secured data center; backup generator Wiring closets secured UPS for all servers and network equipment

Layer 2 - Internet Before Internet router with public IP addresses No filtering of ports After Cisco PIX firewall with PAT translation initially, later acquired additional IPs, changed to NAT ( still occasional problems, need an XLATE clear ) Access control list on Internet router (example)example Packeteer - Although purchased for bandwidth control, provides another layer of protection and detection

Internet Router ACL access-list 115 permit tcp any established access-list 115 permit tcp any established access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny ip host any access-list 115 deny ip host any access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny ip any access-list 115 deny tcp any any eq 135 access-list 115 deny tcp any any eq 135 access-list 115 deny udp any any eq 135 access-list 115 deny udp any any eq 135 access-list 115 deny tcp any any eq 137 access-list 115 deny tcp any any eq 137 access-list 115 deny udp any any eq netbios-ns access-list 115 deny udp any any eq netbios-ns access-list 115 deny tcp any any eq 138 access-list 115 deny tcp any any eq 138 access-list 115 deny udp any any eq netbios-dgm access-list 115 deny udp any any eq netbios-dgm access-list 115 deny tcp any any eq 139 access-list 115 deny tcp any any eq 139 access-list 115 deny udp any any eq netbios-ss access-list 115 deny udp any any eq netbios-ss access-list 115 deny tcp any any eq 445 access-list 115 deny tcp any any eq 445 access-list 115 deny udp any any eq 445 access-list 115 deny udp any any eq 445 access-list 115 deny tcp any any eq 593 access-list 115 deny tcp any any eq 593 access-list 115 deny udp any any eq 593 access-list 115 deny udp any any eq 593 access-list 115 deny tcp any any eq 3333 access-list 115 deny tcp any any eq 3333 access-list 115 deny udp any any eq 3333 access-list 115 deny udp any any eq 3333 access-list 115 deny tcp any any eq 4444 access-list 115 deny tcp any any eq 4444 access-list 115 deny udp any any eq 4444 access-list 115 deny udp any any eq 4444 access-list 115 deny tcp any any eq 69 access-list 115 deny tcp any any eq 69 access-list 115 deny udp any any eq tftp access-list 115 deny udp any any eq tftp access-list 115 deny tcp any any eq 161 access-list 115 deny tcp any any eq 161 access-list 115 deny udp any any eq snmp access-list 115 deny udp any any eq snmp access-list 115 deny tcp any any eq 162 access-list 115 deny tcp any any eq 162 access-list 115 deny udp any any eq snmptrap access-list 115 deny udp any any eq snmptrap access-list 115 deny udp any any eq 1993 access-list 115 deny udp any any eq 1993 access-list 115 deny tcp any any eq 1900 access-list 115 deny tcp any any eq 1900 access-list 115 deny udp any any eq 1900 access-list 115 deny udp any any eq 1900 access-list 115 deny tcp any any eq 5000 access-list 115 deny tcp any any eq 5000 access-list 115 deny udp any any eq 5000 access-list 115 deny udp any any eq 5000 access-list 115 deny udp any any eq 8998 access-list 115 deny udp any any eq 8998 access-list 115 permit icmp any any echo access-list 115 permit icmp any any echo access-list 115 permit icmp any any echo-reply access-list 115 permit icmp any any echo-reply access-list 115 deny ip any any log-input access-list 115 deny ip any any log-input

Layer 3 – Network - Before 10.x.x.x organized geographically; each building complex has a subnet; 10.1.x.x, 10.2.x.x, 10.3.x.x, etc. Any to any routing philosophy Simple telnet to devices No central security scheme

Layer 3 – Network - After 100% VLAN scheme VLANs based on computer/user role Internet style ACLs applied on traffic leaving VLANs Traffic denied entering VLAN if no reason for the traffic Extended today to separate VLANS for point-of-sale stations, HVAC, wireless, dial-up; each with its own ACL SSH required to access devices, coordinated userid/password with Cisco ACS server that LDAPs to our NDS 10.1.x.x network equipment 10.1.x.x network equipment 10.2.x.x servers 10.2.x.x servers 10.3.x.x printers 10.3.x.x printers 10.4.x.x staff 10.4.x.x staff x.x ResNet x.x ResNet Etc. Etc.

Layer 4 – ResNet Before Before Normal network subnet Normal network subnet No restrictions No restrictions ISP attitude ISP attitude No scanning No scanning After – version 1 After – version 1 Single VLAN Single VLAN ACL limited access to other campus VLANs ACL limited access to other campus VLANs After – version 2 After – version 2 VLAN per 48 port switch VLAN per 48 port switch Internet style ACL rule set to block known bad ports such as 445 Internet style ACL rule set to block known bad ports such as 445 Routine scanning and quarantining Routine scanning and quarantining

Layer 5 – Servers - Before Public IP address via firewall conduit Distributed physically No port filtering Inconsistent patch strategy No virus protection Inconsistent HTTPS implementation Many outside of the network department No scanning for vulnerabilities No disaster recovery plan

Layer 5 – Servers - After Servers in data center or managed by server group Servers in data center or managed by server group HTTPS required for any sensitive data HTTPS required for any sensitive data Private IP addresses mapped to public via conduit in the firewall Private IP addresses mapped to public via conduit in the firewall Port filtered in the firewall, deny all, allow those required for specific services Port filtered in the firewall, deny all, allow those required for specific services Port filtered coming out of ResNet and student computer labs Port filtered coming out of ResNet and student computer labs Managed patch strategy, critical patches applied in 24 hours Managed patch strategy, critical patches applied in 24 hours Symantec Anti-Virus on servers Symantec Anti-Virus on servers NetMail/CA eTrust anti-virus and RBL filtering for NetMail/CA eTrust anti-virus and RBL filtering for GWAVA/Symantec Anti-Virus filtering GWAVA/Symantec Anti-Virus filtering GWAVA attachment filtering GWAVA attachment filtering Routine Nessus scanning Routine Nessus scanning Comprehensive disaster recovery plan Comprehensive disaster recovery plan

Layer 6 - Employee PCs After After Private IP address via PAT/NAT Managed Symantec Anti- Virus Push of critical Microsoft security patches via Novell ZenWorks Nessus scanning Before Before Public IP address No anti-virus No patch management No scanning

Layer 7 - Social Before Before Little or no public awareness Little or no public awareness No AUP No AUP Loose user ID and password policies Loose user ID and password policies It wont happen here, we know everyone personally It wont happen here, we know everyone personally After After Acceptable Use Policy Acceptable Use Policy Accounts blocked after 3 failed log in attempts Accounts blocked after 3 failed log in attempts Passwords changed every 180 days Passwords changed every 180 days Regular communication via online newspaper Regular communication via online newspaper Security education classes Security education classes

Whats on the radar screen? Spyware Spyware PC firewall PC firewall Instant Messenging issues Instant Messenging issues VPN VPN Network access control Network access control Two factor authentication Two factor authentication Security as it affects privacy issues Security as it affects privacy issues security security

Conclusion Security team was the right approach for us Security team was the right approach for us Effective, no significant down-time except for Blaster/Welcia, fall 2003 Effective, no significant down-time except for Blaster/Welcia, fall 2003 Cost-efficient Cost-efficient Diffused security awareness across the department Diffused security awareness across the department Developed security skills across ITS Developed security skills across ITS Security Infrastructure Security Infrastructure Cisco PIX firewall Cisco PIX firewall Packeteer Packetshaper Packeteer Packetshaper Cisco VLANs/ACLs Cisco VLANs/ACLs Symantec Anti-Virus Symantec Anti-Virus Novell ZenWorks Novell ZenWorks GWAVA Anti- virus/attachment filtering GWAVA Anti- virus/attachment filtering Nessus Nessus

Discussion

Slide to link