Distance Education Team 2 Security Architectures and Analysis

Distance Education Team Members Chris Rush – Team Leader, Step 1 Mike Gazdus – A/V Expert, Step 1 Ron Banerjee – Tech Analyst, Step 2 Russ Griffith – Tech Analyst, Step 2 Scott Currie – Scribe, Step 3 Chris Ameter – Tech Analyst, Step 3 Jack Pickett – Tech Analyst, Step 3 Raman Rangswamy – Tech Analyst, Step 4 Ayman Lugman – Tech Analyst, Step 4

Topics for Discussion Step 1 Recap Step 1 Recap – DE User Categories – DE Architecture Step 2 Recap Step 2 Recap – Essential Services and Assets – Essential Scenarios Trace – Essential Components Step 3 Goals Step 3 Goals – Relevant Attacker Profiles – Likely Levels of Attack – Representative Attack Scenarios – Identify Compromisable Components Step 4 Next Step 4 Next

Step 1 Recap DE Organization Mission DE Organization Mission “To offer the same high quality MSE courses currently available to resident students, through the use of on-line, Computer Based Training (CBT), and two-way audio two-way video through Distance Education”. Mel Rosso-Llopart Director, Distance Education

DE User Categories Student Student Admin Staff Admin Staff Technical Support Staff Technical Support Staff Web Support Staff Web Support Staff Director & Associate Director Director & Associate Director

DE Architecture Admin DB (Oracle) Product DB (MySQL) Web App (Perl Scripts) DE Student Client (browser) DE Admin Client (Win32) Admin App (VB) Admin Server (Win NT) Product Server (Linux) Tech Support Admin Staff Student Web Support Director & AssocDirector Apache Server

Step 2 Recap Essential services and assets Essential services and assets Essential scenarios trace Essential scenarios trace Essential components Essential components

Essential Services & Assets Essential Services: Essential Assets: Tech support updates My SQL database Student access to web application Web support(Courseware specialist) perform maintenance on web applications. Student data Web contents: Calendars Class assignments Files Assigned readings

Admin DB (Oracle) Product DB (MySQL) Web App (Perl Scripts) DE Student Client (browser) DE Admin Client (Win32) Admin App (VB) Admin Server (Win NT) Product Server (Linux) Tech Support Admin Staff Student Web Support Director & AssocDirector Apache Server Essential Scenarios Trace

Essential Components My SQL database My SQL database Web Application Web Application Apache Server Product Server

Step 3 Goals Attacker Profiles - Internal Threat - External Threat Levels of Attack - “Target of opportunity” - “Intermediate” - “Sophisticated”

Step 3 Goals Cont. Describe intrusion scenarios - steps in attacker usage scenarios Identify compromisable components Identify compromisable components - parts of architecture accessible by intrusion scenarios

General Attacker Profiles Recreational Hacker – Current/Past Students – Current/Past Admin & Support Staff – External Hacker Disgruntled Employee / User – Current/Past Students – Current/Past Admin & Support Staff Activist –Not Likely Industrial Spy –Not Likely Nation State –Not Likely

Attacker Attributes AttackerResourcesTimeToolsRiskAccessObjectives Recreational Hacker - External (i.e.. Script Kiddie) -Range, but generally limited. -Lots of time, very patient. -Generally available scripts and tools. -Little knowledge of potential risks. -Likely to be risk averse. -Little knowledge of potential risks. -Likely to be risk averse. -External web access. -Fun, status. Disgruntled Employee/User - Current or past Admin & Support staff - Current or past students -Moderate. CS students, and skilled support staff. -Varies, but generally cannot devote long hours. -Existing access, knowledge of programming and system architecture. -Likely to be risk averse. Jobs and/or enrollment status at risk. -Internal, or external with a knowledge of internal network structure. -Payback, revenge, havoc, chaos. -Theft of financial info. Activists Not Likely Industrial Spy Not Likely Nation State Not Likely

Attack Patterns User Access –Current Student Privilege Escalation –Current Access to Damage the Database –External Attacker Gaining Account Level Access Through a Remote Exploit Component Access –Port Flood / DOS Attack Application Content –PERL Script Exploits –Buffer Overflows –OS / Application Vulnerabilities

Potential Attacker Profiles Internal Threat – Existing DE Student –Privilege Escalation –Modification of registration/payment info Internal Threat – Administrators/Student Support –Read/Write Access to DB’s –Accidental/Intentional DB Corruption –Theft of Financial Information –Co-opt System resources (game/file server, DDOS) External Attacker –Vandalism –Theft of course material –Theft of student financial information – DDOS Platform

Levels of Attack Target of Opportunity –External Attacker – Script Kiddie Intermediate –Existing Student –Admin/Support Staff –External Attacker Sophisticated –Existing Student –Admin/Support Staff –External Attacker

Potential Attacker Profiles Internal Threat – Existing DE Student –Privilege Escalation –Modification of registration/payment info Internal Threat – Administrators/Student Support –Read/Write Access to DB’s –Accidental/Intentional DB Corruption –Theft of Financial Information –Co-opt System resources (game/file server, DDOS) External Attacker –Vandalism –Theft of course material –Theft of student financial information – DDOS Platform

Attack Scenarios Privilege Escalation Admin DB (Oracle) Product DB (MySQL) Web App (Perl Scripts) DE Student Client (browser) DE Admin Client (Win32) Admin App (VB) Admin Server (Win NT) Product Server (Linux) Tech Support Admin Staff Student Web Support Director & AssocDirector Apache Server

Potential Attacker Profiles Internal Threat – Existing DE Student –Privilege Escalation –Modification of registration/payment info Internal Threat – Administrators/Student Support –Read/Write Access to DB’s –Accidental/Intentional DB Corruption –Theft of Financial Information –Co-opt System resources (game/file server, DDOS) External Attacker –Vandalism –Theft of course material –Theft of student financial information – DDOS Platform

Attack Scenarios Theft of Financial Information Admin DB (Oracle) Product DB (MySQL) Web App (Perl Scripts) DE Student Client (browser) DE Admin Client (Win32) Admin App (VB) Admin Server (Win NT) Product Server (Linux) Tech Support Admin Staff Student Web Support Director & AssocDirector Apache Server

Potential Attacker Profiles Internal Threat – Existing DE Student –Privilege Escalation –Modification of registration/payment info Internal Threat – Administrators/Student Support –Read/Write Access to DB’s –Accidental/Intentional DB Corruption –Theft of Financial Information –Co-opt System resources (game/file server, DDOS) External Attacker –Vandalism –Theft of course material –Theft of student financial information – DDOS Platform

Attack Scenarios DDOS Platform Admin DB (Oracle) Product DB (MySQL) Web App (Perl Scripts) DE Student Client (browser) DE Admin Client (Win32) Admin App (VB) Admin Server (Win NT) Product Server (Linux) Tech Support Admin Staff Student Web Support Director & AssocDirector Apache Server Attacker DDOS Application DDOS Application

Compromisable Components Admin Server –Possible DDOS platform –DB Contains Student Financial Info. Production Server –Web Server –No encrypted Authentication –Password Lists in DB

Compromisable Components Admin DB (Oracle) Product DB (MySQL) Web App (Perl Scripts) DE Student Client (browser) DE Admin Client (Win32) Admin App (VB) Admin Server (Win NT) Product Server (Linux) Tech Support Admin Staff Student Web Support Director & AssocDirector Apache Server

What’s Next Step 4 –Identify “softspots” –Existing Mitigation Strategies –Recommended Mitigation Strategies –Survivability Map & Suggested Changes

Conclusion Reviewed the DE Architecture Reviewed the user categories Reviewed the architecture Reviewed the essential services and assets Reviewed the essential usage scenarios Reviewed the essential components Discussed Relevant Attacker Profiles Discussed Likely Levels of Attack Discussed Possible Attack Scenarios Identified Compromisable Components Briefly showed where we are going next.

Questions?