Advanced Internet Bandwidth and Security Strategies Fred Miller Illinois Wesleyan University

Advanced Internet Bandwidth & Security Strategies How Illinois Wesleyan University: –Minimizes copyright infringement notices –Allows peer-to-peer computing –Maintains sub-second web performance –Mitigates denial of service attacks –Identifies virus infections –Controls illegal activities on the campus network

Advanced Internet Bandwidth & Security Strategies Layers of security Intrusion Detection –Host based intrusion detection –Network based intrusion detection Knowledge based Behavior based Bandwidth management & monitoring User education and enforcement

About Illinois Wesleyan University Liberal arts students –1800 on-campus residents IT Resource limitations –16 IT Staff –Voice, video, & data Environment –100mpbs switched port per pillow –18mbps Internet connection –No technology fee –Some wireless –LDAP authentication

Bandwidth & Security Strategies User Education (and results) Firewall & IP address policies Response Time Measurement Bandwidth Policies Monitoring and detection Redirection & quarantine Judicial procedures Future plans

User Education Computer Incident Factor Analysis and Categorization (CIFAC) Project –IT personnel More education and training… –Users More education and training… –Non IT Staff More education… –Networks More resources, more and better procedures…

User Illinois Wesleyan Freshman orientation Web site, portal & lists One on one training Help desk Assessment Our customers –Novices –“The Mistaken”

User Education - Results

Firewall & IP Address Policies No MAC registration (yet) DHCP All local 10.x.x.x IP numbers Ports blocked inbound, few outbound Restrict SMTP, SNMP, etc.

Response Time Measurement Library consortium RRDTOOL MRTG ping probe Packetshaper command: rtm sho

rtm sho

Bandwidth Policies Detail* Traffic classification Flow control Host lists Class licenses *Command line vs. web interface

Traffic classification Classify in and out - hundreds of classes No changes for time of day Can block/restrict by IP#, port, or protocol Partitions and policies Peer to peer - low priority, typically 10k policy in, 1k policy out Gamers are a challenge

Flow control Limits the number of new flows per minute for client or server actions

Classification and Flow Control No auto-discovery, but all traffic classified

Host lists Groups of internal or external IP numbers using bandwidth rules Quarantine internal users Limit groups of high bandwidth servers Quickly block intruders Identify servers for additional priority

Class licenses Limit how many connections per class

Know what’s typical and atypical Check for top bandwidth users Watch number of flows - active and failed Spot check Automation Community Monitoring and Detection

Know what’s typical & atypical –sys heal

Monitoring and Detection Check for top bandwidth users –Over time hos top sho /outbound Host top sho /inbound Host inf -sr -i –Right now Host inf -sr -n 10

Monitoring and Detection Watch number of flows - active and failed –host inf -sf -n 10 –host inf -sp -n 10

Monitoring and Detection Spot check –Overall (e.g., check tree) tr tr –Individual classifications tr fl -tupIc/outbound/discoveredports/students tr his recent /inbound/multimedia/mpeg-video –Individual machines (servers & clients) tr fl -tupIA10.x.x.x tr his find 10.x.x.x

Monitoring and Detection Automation  Rule sets: application and port rules  notifications  Identify & isolate violators  Packetshaper Adapative Response  Snort

Monitoring and Detection Automation - Packetshaper Adaptive Response

Monitoring and Detection Automation - Packetshaper Adaptive Response

Monitoring and Detection Automation - Snort  By Martin Roesch  Extensive rule sets  Henwen & Letterstick = Snort GUI for Mac

Monitoring & Detection

Monitoring and Detection Community - firewall log analysis  D-Shield Distributed Intrusion Detection System  D-Shield Academic  SANS Internet Storm Center Computer Emergency Response Team 

Redirection & Quarantine Soft quarantine Hard quarantine with redirect

Judicial Procedures Network disruption - logical disconnect RIAA notices - less than 1 per month Students referred to Associate Dean of Students for judicial processes

Future Plans Cisco ASA - firewall, VPN, intrusion detection More Adaptive Response More Snort 45mbps Internet NetReg? Clean Access? –VLAN Quarantine Wireless authentication

Advanced Internet Bandwidth & Security Strategies Summary –User education is key –Need layers of security –Bandwidth management & monitoring –Intrusion detection and prevention Hosts and network More application level detection Support more community efforts – Enforce policies with judicial procedures

Additional References… Packeteer Education list EDUCAUSE Intrusion Detection Resources CIFAC Project Report (volume 1) Illinois Wesleyan IT Policies Snort Henwen & Letterstick