Electronic Security Initiative 2005 Security Assessment & Security Services 23 August 2005

2 Internet Assessment l Results of the Internet Assessment discovered a total of 44 vulnerabilities (Affecting 206 Systems) l High risk exposures were corrected by IEEE IT Staff as soon as they were found.

3 Wireless and Dial-up Wireless Assessment Remediation Summary HighMediumLowTotal Issues Found Issues Resolved Outstanding Issues0000 Percent of Issues Resolved100% l Results of the Wireless & Dialup Assessment discovered a total of 23 vulnerabilities l E&Y did not identify any rouge data carriers on IEEE’s dial-up infrastructure

4 Web Applications l Results of the Web Applications Assessment discovered a total of 39 vulnerabilities across 3 web applications. l The development staff responsible for these applications is working to remediate these security issues.

5 Web Applications (Cont’d)

6 Remediation: XPLORE Security Issues (11 Security Issues Remain) l High Risk (1 issue) - No encryption for application login (TBR 1Q 2006) Username & Password: Clear Text Risk: possible lost of information. Explore Team willing to take the risk

7 Web Applications (Cont’d) Remediation of XPLORE Security Issues l Medium Risk (5 issues) - Username Passed in Clear Text Cookie (TBR 1Q 2006) Risk: User credentials can be compromised - Arbitrary URL Redirection (TBR 1Q 2006) Risk: Facilitates phishing/social engineering attacks - AutoComplete - Not Disabled (TBR 3Q 2006) Risk: Username and Password is Cached - Weak Passwords (TBR 3Q 2006) Risk: Passwords can be guessed - Inadequate Lockout Policy (TBR 3Q 2006) Risk: Enable brute force attacks to guess user passwords

8 Web Applications (Cont’d) Remediation of XPLORE Security Issues l Solving security issues require programming changes, testing and QA. - Most of the critical issues are scheduled to be remediated by 1Q 2006, with the next release of XPLORE. - All remaining issues are to be remediated by 3Q 2006, with future releases of Xplore.

9 Web Applications (Cont’d) Remediation: Renewal Security Issues (7 Security Issues Remain) l High Risk (3 issues) −Option exists for unencrypted authentication (TBR 9/1/2005) Risk: User credentials are sent in cleartext −Application does not enforce password complexity (TBR 9/1/2005) Risk: Passwords can be guessed −Username and Password exposed in the URL (TBR 9/1/2005) Risk: This information can be easily retrieved from a browser history or log file

10 Web Applications (Cont’d) Remediation of Renewal Security Issues l Med Risk (3 issues) - AutoComplete not disabled (TBR 9/1/2005) Risk: Username and Password is cached in the browser - Cross-site Scripting Vulnerabilities (TBR 9/1/2005) Risk: Scripts can be injected into the Renewal application - Inadequate Account Lockout Policy (TBR 9/1/2005) Risk: Enable brute force attacks to guess user passwords

11 Web Applications (Cont’d) Remediation of Renewal Security Issues The High & Medium risk issues are scheduled to be addressed with the next release of Renewal –1 Sep 2005

12 Web Applications (Cont’d) Remediation: Catalog Security Issues (7 Security issues remain) High Risk (1 issue) −Option exists for unencrypted transaction (TRB 9/1/2005) Risk: Sensitive information could be captured by an attacker üActual transmission of Credit Card information is encrypted

13 Web Applications (Cont’d) Remediation of Catalog Security Issues Medium Risk (3 issues) − AutoComplete is not disabled (TBR 9/1/2005) Risk: Username and Password is Cached in the browser − Arbitrary URL Redirection (Remediation Not Possible) Risk: Facilitates phishing/social engineering attacks üRemediation not possible due to limitations of the tools in use. (Commerce Server) üWill no longer exist after BMS takes over the Shop function, scheduled for May − Inadequate Account Lockout Policy (Remediation Not Possible) Risk: Enables brute force attacks to guess user passwords üRemediation not possible due to limitations of the tools in use to authenticate users üWill no longer exist after BMS takes over the Shop function, scheduled for May 2006.

Security Assessment Next Steps l IEEE has remediated all vulnerabilities not requiring programming changes. The final E&Y report will be delivered by COB Wednesday August 23 th. - Original scheduled delivery date: 12 Aug 2005 (Missed) - Vendor requested extension due to: ASC close down – Blackhat/Defcon Lead IEEE tester out of the office (Personal Matter) Additional time to confirm fixes (re-testing) l Complex security issues, requiring programming changes, have been prioritized for implementation.