Page 1 8 Oct 2004 IT Security Awareness Dangers in the Networked World Lai Zit Seng NUS School of Computing

Page 2 8 Oct 2004 Topics History: Recent Worms What is Security Why Worry What’s Happening in SOC

Page 3 8 Oct 2004 History – Code Red Struck on 12th Jul 2001 –Public announcement on 17th Jul 2001 –CERT announcement on 19th Jul 2001, and again on 26th Jul 2001 Exploited buffer overflow in IIS –CERT published advisory on 19th Jun 2001 –Patch available from MS since 18th Jun 2001 Estimated $2B in damages (Aug 2001) –Source: Computer Economics (quoted by NewsFactor.com)

Page 4 8 Oct 2004 History – Slammer Worm Struck on 25 th Jan 2003 Infected 75K hosts Our own NUSNET “melted down” for hours –Elsewhere: Disrupted ATMs, 911 systems Exploited MS-SQL and MSDE vulnerabilities –Patch available from MS since 10 th Jul 2002 –CERT advisory 29 th Jul 2002 Estimated US$1B in damages –Source: Mi2g

Page 5 8 Oct 2004 History – W32/Blaster Struck on 11 th Aug 2003 Exploits RPC vulnerabilities –CERT advisory on 17 th Jul 2003 –Patch available from MS since 16 th Jul 2003 Unprecedented damages –Mi2g estimates $32.8B in economic damages (together with other malware of Aug 2003)

Page 6 8 Oct 2004 History – Other Incidents Apache/mod_ssl worm –CERT advisory 14 th Sep 2002 –Vulnerability published by CERT since 30 th Jul 2002 Nimda worm –CERT announced 18 th Sep 2001 –Exploits vulnerability for which patch available from MS since 29 th Mar 2001

Page 7 8 Oct 2004 Security Triad Confidentiality: Ensuring that data contained in an information system is accessible only to those authorized. Integrity: Ensuring that data contained in or functions carried out by an information system is correct. Availability: Ensuring that an information system is accessible to those authorized to use it.

Page 8 8 Oct 2004 Why Worry Advances in technology: Convenience, cost, availability Pervasiveness of networked computing Network convergence: Single network for Voice, Video and Data Human Issues: –Social Engineering

Page 9 8 Oct 2004 Why Worry – cont’d Infrastructure/Operations –ATMs, Power Grid etc exposed to Internet Various risk exposures: Confidentiality, Integrity, Availability Zero-Day exposures Phishing attacks Risks are outstripping safeguards

Page 10 8 Oct 2004 Changes in Intrusion Profile 1988 Exploiting passwords Exploiting known vulnerabilities Today Exploiting protocol flaws Examining source code for security flaws Abusing public servers Installing sniffers Source address spoofing DoS, DDoS Widespread automated scanning

Page 11 8 Oct 2004

Page 12 8 Oct 2004 Incidents Reported to CERT/CC From: CERT/CC Website

Page 13 8 Oct 2004 How many incidents? From: 2004 CSI/FBI Computer Crime and Security Survey

Page 14 8 Oct 2004 How many incidents from Outside? From: 2004 CSI/FBI Computer Crime and Security Survey

Page 15 8 Oct 2004 How many incidents from Inside? From: 2004 CSI/FBI Computer Crime and Security Survey

Page 16 8 Oct 2004 SOC IDS Activity Statistics for 1 st Oct 2004: IDS log entries runs of portscanning activities incidences of Windows/SMB traffic anomaly 209 accesses to our honeypot

Page 17 8 Oct 2004 SOC Network VA Statistics As on 8 th Oct 2004: 37 machines denied network access (due to enforcement) 185 critical vulnerabilities unfixed

Page 18 8 Oct 2004 Security Lab Objective: –Enable learning and experimentation relating to IT Security –Setting up experiments and playground for anyone interested in IT Security –Activities relating to SIG^2 NUS Chapter Servers, desktop computers and network equipment Look out for upcoming news

Page 19 8 Oct 2004 Questions and Answers Lai Zit Seng