Office of Campus Information Security Incident Response Briefing Jeffrey Savoy, CISSP

Roadmap OCIS Incident Response Background Infringement Reports Situational Awareness Reports Information Incident Reporting Policy Nessus Self Service Scans AppScan Self Service Scans

OCIS Incident Response Background OCIS Incident Response Reports Help Desk, NOC, etc 2 FTE and 2 part time students Handle some reports directly and forward others WiscNIC Statistics posted at Wide range of reports

Infringement Reports Volume:

Infringement Reports Complainants:

Infringement Reports Campus locations:

Situational awareness reports A wide variety of reports can be sent to The following are specific reports that either we signup or implement locally Goal is to reduce exposure time Each source contains different raw evidence Each potential of false positive Based on experience, harder to track in NAT environment We can tune local alerts In most cases, worth investigation

Situational awareness reports Web-Spam Searches OCIS has a process that queries Google daily (M-F) for signs web spam on wisc.edu sites. The spam may be indicative of a compromised web server or a site that allows public comments which is being abused.

Situational awareness reports Example: “OCIS has identified the below URLs recently found in Google to be consistent with providing or re-directing to web spam.” Include (in part): Why getting this (WiscNic) Suspicious url What might indicate Google cache removal instructions Statistics: 29 confirmed reports since January 2009 (about 4 a week)

Situational awareness reports Sophos Alerts OCIS receives alerts of spam originating from the University of Wisconsin - Madison from Sophos honeypots installed world wide. Often these alerts are indicative of a compromised personal computer that is being used to send out spam. We have access to this service as the result of WiscMail purchase of Sophos for filtering.

Situational awareness reports Example: “Our spam scanning software has detected the following spam was sent from your network I have attached a part of the raw data below for your review. Please note that all dates and times are in unless otherwise noted. Could you please look into this possible spam, and let us know what actions you take to resolve.” Statistics: 150 alerts in last 9 months (about 4 a week)

Situational awareness reports Alerts from our campus border flow analysis OCIS staff process alerts of suspicious activity daily (M-F). These alerts may be indicative of compromised server or personal computer, however, they may sometimes be the result of end activity, eg P2P file sharing, Skype, etc. The current alerts look for a variety of conditions, eg suspicious SMTP/DNS activity, connections to suspicious IP addresses as listed by REN-ISAC (Research and Education Network Info Sharing and Analysis Center), etc.

Situational awareness reports Example: “Our flow analysis tool is alerting on a possible suspicious activity Originating from This may be a sign of a compromise, infection, or user activities, eg peer to peer applications, etc. “ Include (in part): Network flows Why suspicious, eg connecting to known cc server, etc Statistics: 34 in last two months (about 4 a week)

Situational awareness reports Project HoneyPot Alerts OCIS staff receives alerts of spam, dictionary web attacks, etc for UW System from the Project Honey Pot service ( OCIS pays a small amount yearly for this subscription.

Situational awareness reports Example: X.X (SPAM) - Sat, 26 Jan :56: DCC-MsgId: 426a2a78 5bfc2ebc e9c189b8 40c608fb - Subject: Armchair Vegas - From: "ClubVIP Casino." Statistics: 280 in last 20 months (about 3 a week)

Situational awareness reports REN-ISAC OCIS staff receive alerts of possible "bots" or otherwise compromised machines directly from REN-ISAC operations that their system may identify.

Situational awareness reports Example: The host(s) listed at the bottom of this message have been identified as likely bot infected. The host(s) were observed attempting to connect to a known botnet controller at tcp port Please examine this machine for signs of break-in. IP Address Timestamp X.X :54:47-UTC-5 Statistics: 125 in last 22 months (about 1 a week)

Situational awareness reports Shadowserver Foundation OCIS staff receive alerts for the University of Wisconsin- Madison from additional honeypots installed around the world and maintained by security volunteers running the Shadowserver Foundation ( The types of reports that we may receive are listed at this url: eports

Situational awareness sources Example: Statistics: 118 reports in the last 10 months (about 3 a week)

Information Incident Reporting Policy UW-Madison employees, contractors and users of UW-Madison information resources must report incidents in which there is a reasonable belief that UW-Madison sensitive information may have been accessed by unauthorized persons. Reportable incidents include but are not limited to: intrusion by malware or other unauthorized access via the network into computer systems or devices, where it is reasonable to believe that sensitive information was accessed by unauthorized persons.

Information Incident Reporting Policy Sensitive data defined: Institutional Data that could, by itself or in combination with other such Data, be used for identity theft, fraud, or other such crimes. It includes Data defined as Restricted Data. Restricted Data includes information with Personal Identifying Information (PII) as specified in Wisconsin’s data Breach Notification Law (statute Section ) Institutional Data whose public disclosure is restricted by law, contract, University policy, professional code, or practice within the applicable unit, discipline, or profession Etc

Information Incident Reporting Policy

Nessus self service scans Purpose: A convenient way to obtain a baseline scan of campus devices on the network without having to purchase and maintain Nessus software Location: Statistics: Over 200 scans requested since January 2008

Nessus self service scans

Limitations: Scans done without local credentials Firewalls (host and network) need to be open Limited effectiveness with those using NAT Verbose reports

IBM AppScan self service scans Purpose: A convenient way to obtain a baseline scan of web servers without having to purchase and maintain Appscan software. Location: Statistics: Over 100 scans requested since January 2008

IBM AppScan self service scans

Limitations: Scans done without credentials to web site, eg pubcookie, etc Firewalls (host and network) need to be open Verbose reports Crawling large sites may result in long scan times Load on web server Default form values used by Appscan may result in false negatives

Lockdown 2009!

Questions?