UC Davis Vulnerability Scanning and Remediation 2005 Larry Sautter Award UC Davis, Information and Education Technology

UC Davis Vulnerability Scanning and Remediation Project description and background Project description and background Project Objectives Project Objectives Protecting the campus network Protecting the campus network Scalable technology Scalable technology Education Education Questions Questions

Project Description A proactive approach to reducing threats to computing resources and enhancing the protection of university electronic information.

Project Objectives Protect the integrity of the campus computing environment Protect the integrity of the campus computing environment Provide a cost-effective solution for vulnerability scanning and remediation Provide a cost-effective solution for vulnerability scanning and remediation Develop a scalable system Develop a scalable system Educate campus computer users, support staff and system administrators Educate campus computer users, support staff and system administrators

Timeline September 2003 September 2003 –Temporary scanning system deployed to detect RPC vulnerabilities October 2003 October 2003 –Reduction in vulnerable and/or infected systems on campus network from more than 700 to fewer than 40 in four weeksMay 2004 –Planning for a permanent vulnerability scanning system was initiated September 2004 September 2004 –Computer Vulnerability Scanning Policy adopted by Campus –Rebuilding/redeployment of the campus vulnerability scanning system components –Threat analysis subscription begins –Database upgrades made January 2005 January 2005 –Honeypot integrated into permanent scanning system June 2005 June 2005 –Intrusion detection system (IDS) integrated into vulnerability scanning system July 2005 July 2005 –Campus vulnerability scanning system is in full production mode

Computer Vulnerability Scanning Policy All computers, servers, and other electronic devices connected to the campus network shall be kept free of critical security vulnerabilities. All computers, servers, and other electronic devices connected to the campus network shall be kept free of critical security vulnerabilities. Individuals whose computers present critical security vulnerabilities must correct those vulnerabilities in a timely manner before connecting to the campus network. Individuals whose computers present critical security vulnerabilities must correct those vulnerabilities in a timely manner before connecting to the campus network. Computers found to contain critical security vulnerabilities that threaten the integrity or performance of campus network will be denied access to campus computing resources, and may be disconnected from the campus network to prevent further dissemination of infectious or malicious network activity. Computers found to contain critical security vulnerabilities that threaten the integrity or performance of campus network will be denied access to campus computing resources, and may be disconnected from the campus network to prevent further dissemination of infectious or malicious network activity.

Protecting the Campus Network

Vulnerability Assessment Mechanisms Nessus (scanlite perl module) is used to scan campus systems daily for 1-3 vulnerabilities Nessus (scanlite perl module) is used to scan campus systems daily for 1-3 vulnerabilities Nessus is used to identify compromised systems during web-based authentication Nessus is used to identify compromised systems during web-based authentication Labrea (honeypot) is used to identify malicious network traffic on an unannounced network segment Labrea (honeypot) is used to identify malicious network traffic on an unannounced network segment Bro (IDS) identifies malicious network traffic. Bro can use the snort rule set. Bro (IDS) identifies malicious network traffic. Bro can use the snort rule set.

Vulnerability Assessment Database IP Address IP Address Date Date Type (honeypot, scan, IDS) Type (honeypot, scan, IDS) MAC address MAC address Username Username

Input Sources VLAN assignments (What IPs shall we scan?) VLAN assignments (What IPs shall we scan?) VLAN technical contact (Who do we contact if there is a problem?) VLAN technical contact (Who do we contact if there is a problem?) ARP table records (What MAC address is associated with a particular IP?) ARP table records (What MAC address is associated with a particular IP?) MAC address ownership (Who registered a particular MAC address?) MAC address ownership (Who registered a particular MAC address?) Web authentication (What IP is attempting to authenticate to a UCD web site?) Web authentication (What IP is attempting to authenticate to a UCD web site?) Threat selection (What threats represent highest risk to campus?) Threat selection (What threats represent highest risk to campus?) Web/Daily Scan Capability (What Nessus security plug-ins are available?) Web/Daily Scan Capability (What Nessus security plug-ins are available?)

Scalable Technology Production System ComponentHardwareOperating SystemApplication Web Authentication ScannerSun V210 (2)Solaris Nessus/Scan Lite Daily Network ScannerSun V210 (2)Solaris Nessus/Scan Lite Intrusion Detection SensorDell 2650 (2) LinuxBRO Network HoneypotDell 1750 (1)LinuxLaBrea DatabaseDell 2650 (1) and Dell PowerVault 220 (2) with 2TB Storage LinuxMySQL Web ServerSun V210 (1)SolarisApache Test ServerDell 1750 (1)LinuxVMware

Educating the Campus Community

Faculty, Staff and Students Formal discussions with senior campus administrators and advisory groups Formal discussions with senior campus administrators and advisory groups alerts/announcements alerts/announcements Print and Web publications Print and Web publications Posters and Flyers Posters and Flyers Self-initiated scans Self-initiated scans Scan results pages Scan results pages

Technical Staff Formal discussions Formal discussions Computer & Network Security Report (secalert.ucdavis.edu) Computer & Network Security Report (secalert.ucdavis.edu) notifications notifications “Top Ten” graphs “Top Ten” graphs

ids ids

/ids

Lessons Learned and Next Steps Nessus limitations Nessus limitations Reliance on campus unit system administrators Reliance on campus unit system administrators Enhance integration with Remedy trouble-ticketing system Enhance integration with Remedy trouble-ticketing system Product integration via database is not readily available Product integration via database is not readily available

Questions

Contact Information Robert Ono, Robert Ono,