ISS SiteProtector and Internet Scanner LanAdmin Group Meeting 12/8/2005

SiteProtector SiteProtector is an enterprise command, control and monitoring system. It allows us to use vulnerability assessment information to protect our operations ahead of the threat.

Internet Scanner Internet Scanner minimizes our risk by identifying the security holes, or vulnerabilities, in our network so we can protect them before an attack occurs. Once all of our networked devices are identified, Internet Scanner analyzes the configurations, patch levels, operating systems and installed applications to find vulnerabilities that could be exploited by hackers trying to gain unauthorized access.

Benefits to UTMB from SiteProtector/Internet Scanner Scanner Configuration Multiple in-line scanners Less time and network traffic More scanning Different scan configurations “Local” (10.10.x.x) scans Centralized scan management

Benefits to UTMB from SiteProtector/Internet Scanner “Enterprise” Configuration Logical group scanning User roles Distributed visibility of our security posture Compliance and remediation monitoring Departmental scanning capability

Benefits to UTMB from SiteProtector/Internet Scanner Process Flow Discovery scans Certification scans On-line query and reports Self scans - remediation Exception Documentation

Scanning Processes Current scanning process is under review and revision due to: Improved capability of tools (ISS) Staffing and priority changes Changing institutional requirements Best practices in response to changing environment

Scanning Processes Discovery Scan Identification & Grouping Vulnerability Scans Remediation Scans Remediation Reporting Identify new systems Initiated by NSS Schedule to be determined Feeds Cert. & Accreditation process NSS / Department collaboration Initiated by NSS (vulnerability assessments/system certifications) and/or Audit Services (server reviews) Servers - Quarterly Workstations/printer - Yearly Initiated by Department or NSS Verify status of remediation efforts On-line!! Exception/Risk Acceptance notes Available to Department Management, IS Security and Audit Services

Scanning Processes Patch Scan Delta Scan Exception Reports Verify Patch Management Initiated by Department with Admin. Credentials Schedule to be determined (Quarterly, as needed) Ad-hoc Processes Track Changes to system configuration Schedule to be determined Verify Exception processing Working with ISS to develop process 30-days to request Exception, then yearly review

Significant Events SiteProtector 2.0, SP6 release – 12/6/05 Scanner deployment – December 2005 Initial Group Configurations - Dec. ’05 – Jan. ’06 Department POC Training – Dec. ’05 – Jan. ’06 Transition to Group Scanning – March-April 2005

Q & A additional questions and system inventory to: Network & Security Services