Safeguarding OECD Information Assets Frédéric CHALLAL Head, Systems Engineering Team OECD

Agenda  Network Security  Remote Access  Anti-Virus Protection  Content Filtering and Blocking  Possible Future Directions

Network Security

Private Network External Firewall Internal Firewall Internet DMZ Extranet DMZ SITA X25 InternetInternet

Network Security  2 levels of firewalls for access control  2 separate DMZs to protect sensitive information  Outgoing Internet access through application relays  Intrusion detection systems on both DMZs  Vulnerability scanning on a regular basis

Intrusion Detection System  Network sensor watching for attack signatures  Responses to suspicious activity:  Connection termination  Alerts sent by  Session recorded  Other …

Intrusion Detection System

Centrally Managed Security Policies

Remote Access

Exchange Web SQL

Remote Access Home users Mission users

Remote Access  For portables and Outlook Web Access users to access the OECD network, two- factor authentication based on:  A PIN number (known by the user)  An authenticator (either hardware or software)  Also based on Windows authentication to access network resources

Anti-Virus Protection

NetworkServer Gateway & Firewall Internet Point of Entry & SMTP relay Client

Prevention And Detection  Anti-Virus products from 2 different vendors installed on:  Desktops and laptops  File Servers  Servers  SMTP Relays  Signature updates on a weekly basis  Scanning on PCs and servers on a weekly basis  User Education  Being Prepared  Basic Network Security  Standard Disaster Recovery Procedures

Content Filtering and Blocking

 Implemented after the ILOVEYOU virus  SMTP relay level filtering of all incoming and outgoing Internet messages:  Scan for viruses  Block « program » attachments and HTML scripts for 2 days  Search for « suspicious » text strings in subject  Reporting to management

Content Filtering and Blocking

W32/Navidad W32/Navidad-B

Possible Future Directions  Outsource detection and reporting of network vulnerabilities  SSL for Outlook Web Access  Use RTBL to prevent spamming  Content inspection on HTTP/FTP downloads

Comments and Questions?