INDIANAUNIVERSITYINDIANAUNIVERSITY Automated Network Isolation at Indiana University David A. Greenberg Information Technology Security and Policy Office Indiana University Copyright Indiana University This work is the intellectual property of the author. Permission is granted for this material to be shared for non- commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author."

INDIANAUNIVERSITYINDIANAUNIVERSITY Indiana University Founded in campuses ~100,000 Students ~18,000 Faculty and Staff

INDIANAUNIVERSITYINDIANAUNIVERSITY IT Security and Policy Office Reports directly to CIO University-wide office Staff responsible for a wide range of technologies

INDIANAUNIVERSITYINDIANAUNIVERSITY Incident Response Coordinating response to incidents of abuse or inappropriate use of information or information technology, such as: –Computer and network security breaches –Unauthorized disclosure or modification of electronic information –Denial of service attacks –Port probes, scans –Identifying virus infected machines –Copyright infringement (DMCA) –Forgery, fraud, harassment, chain mail, etc.

INDIANAUNIVERSITYINDIANAUNIVERSITY Incident Response Process Reports sent in to our tracking system Gather supporting technical data Interact with computer security officers to assist with technical investigation Package technical information for IU governance agencies, IU legal counsel, law enforcement, prosecutors, university administration, etc.

INDIANAUNIVERSITYINDIANAUNIVERSITY Incident Response Statistics

INDIANAUNIVERSITYINDIANAUNIVERSITY What types of common blocks exist? On Campus –DHCP lease –Switch port –Null Route –Router ACL Remote Access –Dialup modem pool –VPN access

INDIANAUNIVERSITYINDIANAUNIVERSITY Null Route A route that goes nowhere > route add mask Unicast Reverse Path Filtering (RPF) –Prevents traffic sourced from the null routed IP

INDIANAUNIVERSITYINDIANAUNIVERSITY Internet Router Null Routing

INDIANAUNIVERSITYINDIANAUNIVERSITY Block characteristics The device can communicate with other hosts on the same VLAN, yet is not routed beyond. Typically used as an easier to implement switch port block.

INDIANAUNIVERSITYINDIANAUNIVERSITY Null Route Pros –Blocks take effect almost instantaneously –Can block many devices efficiently –Integration with web interface and shell interface Cons –Devices on same VLAN still exposed to threat –Reporting limited (no means to associate IPs belonging to computer support staff yet) –Only keeps track of IPs –Not suitable for dynamic ips

INDIANAUNIVERSITYINDIANAUNIVERSITY IU Core Network Map

INDIANAUNIVERSITYINDIANAUNIVERSITY Automated Network Isolation (ANI) The coupling of Network Intrusion Detection and Null Routing made easy In a nutshell –ITSO Intrusion Detection Sensors (IDS) detect malicious activity –IDS notifies Null Route Injector “hub” to block IP –ANI block is set with an expiration time of 10 mins Limited view ability

INDIANAUNIVERSITYINDIANAUNIVERSITY ANI cont’d Ideal for people that have the authority to block devices from the network but do not maintain network hardware. Initial automated ANI rollout focused on only one IDS rule, with fairly low incidence and high confidence.

INDIANAUNIVERSITYINDIANAUNIVERSITY

INDIANAUNIVERSITYINDIANAUNIVERSITY

INDIANAUNIVERSITYINDIANAUNIVERSITY Block List

INDIANAUNIVERSITYINDIANAUNIVERSITY 3-way Handshake SYN SYN + ACK ACK FIN ACK FIN ACK CLIENTSERVER

INDIANAUNIVERSITYINDIANAUNIVERSITY SSH brute force attack 13:01: IP y.z.22 > aa.bb.49343: F ack 13:01: IP y.z.22 > aa.bb.49358: S ack 13:01: IP aa.bb > y.z.22:. ack 13:01: IP aa.bb > y.z.22:. ack 13:01: IP y.z.22 > aa.bb.49358:. ack

INDIANAUNIVERSITYINDIANAUNIVERSITY SSH attack after ANI block 13:01: IP aa.bb > x.y.22: F 0:0(0) ack 13:01: IP aa.bb > a.b.22: F 469:469(0) ack 13:01: IP aa.bb > a.b.22: F 469:469(0) ack 13:01: IP aa.bb > c.d.22: F 468:468(0) ack 13:01: IP aa.bb > c.d.22: F 449:449(0) ack 13:01: IP aa.bb > e.f.22: F 468:468(0) ack 13:01: IP aa.bb > g.h.22: F 469:469(0) ack

INDIANAUNIVERSITYINDIANAUNIVERSITY Additional Resources Indiana University IT Security Office – IU Knowledge Base – Indiana University –

INDIANAUNIVERSITYINDIANAUNIVERSITY

INDIANAUNIVERSITYINDIANAUNIVERSITY

INDIANAUNIVERSITYINDIANAUNIVERSITY Data submission my $wddx_data = { requestor => "$user via sniffer", action => "BLOCK", ipaddr => $ipaddr, expire => $expire_time, itso_reason => $sig, itpo_incident => "$incident" };