Information Assurance Program Manager U.S. Army Europe and Seventh Army Information Assurance in Large-Scale Practice International Scientific NATO PfP/PWP Conference on Security and Protection Of Information 10 May 2001 Efficiency Security Morale Threat w/ Global Reach

Information Assurance Program Manager U.S. Army Europe and Seventh Army Agenda Network Setting Current Network Defenses Challenges Road Ahead Conclusions

Information Assurance Program Manager U.S. Army Europe and Seventh Army UK(2) Balkans(6) Setting: USAREUR NIPRnet ca. 50,000 systems in 2,000 LAN over 200 public websites 35 Gateways to... - Department of Defense networks - the Internet Wide Area Network managed and secured by 5 th Signal Command Regional Campus Area Networks serviced by six Signal Bns Local Area Networks often operated by individual military units Non-classified Internet Protocol Routed Network (NIPRnet)

Information Assurance Program Manager U.S. Army Europe and Seventh Army Setting: Security Implications Internet Connectivity +Essential for logistics (commercial purchases) +Desirable for soldier morale and welfare –Exposes network to exploitation, viruses, and hackers Decentralized management (LAN) +Services are tailored to individual unit needs +Commanders balance their mission and risk –Consistent compliance with security policies is hard to ensure –Network is as secure as the weakest link Threat w/ Global Reach

Information Assurance Program Manager U.S. Army Europe and Seventh Army Knowledgeablepeople Bite-sized Policies - keep up with dynamic environment - established by a Council of Colonels - guide network, server, and user-level actions IA Vulnerability Alerts (IAVA) - warn of weaknesses is operating systems - mandate acknowledgement and compliance with fixes IA Training Program (IATP) - Two-four weeks of network, security fundamentals - Systems Administrators, others w/ elevated rights Computer User Testing and Agreement - Must pass to have /network account - A security awareness tool Data Network Protection 1 – Policy and Program Common Security Standards

Information Assurance Program Manager U.S. Army Europe and Seventh Army UK(2) Balkans(6) Data Network Protection 2 - Perimeter at the 35 Gateways... Security Routers block: - known hacker tools - unused/unauthorized services - selected geographic regions - previous sources of probes Intrusion Detection Systems: - monitored 24hrs/7days - DETECT dangerous activity Regional Computer Emergency Response Team-Europe (RCERT): - REACT to isolate / mitigate damage - teamwork with units, CID, CI Some Hacker Threat Blocked Some Minimize Exposure

Information Assurance Program Manager U.S. Army Europe and Seventh Army Further Reduce Exposure Gateway Critical Servers Client PC Customer Routers & Firewalls Data Network Protection 3 – Campus & Local Area Network Tools FocusedProtection Tailored Access Control Lists Strict Configuration Management - secure baselines provided by RCERT - compliance with all IA Vulnerability Alerts Firewalls and Virtual Private Networks: - RCERT assists planning and initial installation and configuration Host-based Intrusion Detection Regular Anti-virus and Vulnerability Scans Basics: Certification and accreditation; strong passwords; up-to-date anti-virus; no back-door connections; only approved software, etc.

Information Assurance Program Manager U.S. Army Europe and Seventh Army Network Protection Challenges Configuration Control Hard to do Units are inconsistent in meeting standards Hackers exploiting known vulnerabilities with identified fixes Application of IA Tools Limited progress below the network perimeter Most units have not yet made plans to add them Not enough experts if all units requested them now Not enough personnel resources for all IT/IA tasks; Inadequate inspections and checks on units; Anticipated network growth demands even more of decentralized security capability

Information Assurance Program Manager U.S. Army Europe and Seventh Army Road Ahead: Simplified Configuration Compliance Make secure baselines easier to apply Provide matrices of known vulnerabilities by operating system and application – together with sources of fixes and ways to verify Develop automated tools to assist units to securely configure new systems and check their own compliance with our standards OS App Win2kWin NTSolaris Work Station Exch Server Web Server Load Test

Information Assurance Program Manager U.S. Army Europe and Seventh Army 22 Network Service Centers - focus on Local Area Networks - help units apply security tools, identify vulnerabilities 6 Network Ops & Security Centers - manage Campus Area Networks - support warfighting headquarters - visibility into network security status - enforce security compliance Full-time IA specialists in most centers, bringing security together with Network Management and Info Dissemination Management Information Dissemination Management Information Assurance Network Management Road Ahead: Regional Network Operations

Information Assurance Program Manager U.S. Army Europe and Seventh Army Conclusions For network security – just like combat – large organizations require decentralized decisions and actions, but common vision and standards: –Network security specialists available in all areas of the organization –Security standards that are simple to meet (not to be confused with simple standards) –Checks to enforce common standards Network Security must be embedded in network operations