STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Desktop Security Strategy Common Solutions Group September 19, 2006 Bill Clebsch

STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES 9/19/06page 1 Agenda Why Do Universities Need Firewalls? What are the Other Methods? What Is Stanford’s Firewall Design? How Does the R1 Community Proceed?

STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES 9/19/06September 2006 Common Solutions Group Meetingpage 2 How are Universities Targeted? ● tracks data breaches reported since the ChoicePoint incident, February 2005 ●Between 2/15/05 to 2/20/06 there were 125 incidents reported, 53 million records compromised ●46% of these incidents were at colleges/universities ●The breach pattern at colleges/universities 65% hacking 21% stolen computers 10% exposed online/sent 4%dishonest insider

STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES 9/19/06September 2006 Common Solutions Group Meetingpage 3 What Is The Cost of An Incident? The Cost of Incidents ●Breach of medical privacy award against U of WV: $2.3M ●Privacy settlement for Mental Health Provider: $3.5M ●Fundraising at Ohio University drops in response to security breaches: 25% reduction in donations (May-June 2005 vs 2006) The Cost of Incidents at Stanford ●Campus-wide [non-destructive] infection: ($2M) ●Credit card data: Next incident (~1.6M) ● shut down: missed grant deadline: (Much bigger) ●Stolen laptop: 5 donors notified: (Priceless) What is the Experience at Your School ?

STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES 9/19/06September 2006 Common Solutions Group Meetingpage 4 Steps to Secure Stanford’s Network SolutionWhat It DoesWhy Do We Need More? Network Self Registration Only clean machines can register to the network Prevents “sick” machines from registering to the network – protects against an “inside out” attack Still vulnerable to malicious attacks (whether internal or external) A point-in-time guarantee that the machine was clean BigFix Keeps machines clean, automatically Automatically distributes and installs critical security patches to Microsoft machines Voluntary program, not all computers covered (just getting to students) Data Center Firewalls Data Center resources are protected Protects applications and data located inside the Data Center, primarily used for administrative applications and data Departmental data not in Data Center still at risk o Departmental Firewalls Resources inside defined perimeter are protected Protects applications and data within boundaries of defined perimeter (eg: department, internet, students, etc.) and allows custom, flexible, solutions for different environments Restricted data may still need to be encrypted And we can add IDP Are You Taking Similar Steps?

STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES 9/19/06September 2006 Common Solutions Group Meetingpage 5 What Does the Firewall Solution Look Like?

STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES 9/19/06September 2006 Common Solutions Group Meetingpage 6 What are the Best Ways to Protect University and Personal Desktops & Laptops?