What do you know about your network Or maybe you don’t know who’s really there

October 2004 By Dennis Peasley CISSPDigital Government Who Controls Your Security Priority Vendors and Magazines control what people are talking about when it comes to Information Security Vendors and Magazines control what people are talking about when it comes to Information Security Each one is trying to sell you something Each one is trying to sell you something Each one selling a technology or service Each one selling a technology or service

October 2004 By Dennis Peasley CISSPDigital Government What is important to you Every device on your network can be a vulnerability Every device on your network can be a vulnerability Every Device is active Every Device is active In most cases, every device can talk to every other device. At least locally In most cases, every device can talk to every other device. At least locally What devices are on your network? What devices are on your network?

October 2004 By Dennis Peasley CISSPDigital Government IP, Internet Protocol Because we all use the Internet Protocol now, everything is connected Because we all use the Internet Protocol now, everything is connected The Sapphire Worm was the fastest computer worm in history. As it began spreading throughout the Internet, it doubled in size every 8.5 seconds. It infected more than 90 percent of vulnerable hosts within 10 minutes. The Sapphire Worm was the fastest computer worm in history. As it began spreading throughout the Internet, it doubled in size every 8.5 seconds. It infected more than 90 percent of vulnerable hosts within 10 minutes.

October 2004 By Dennis Peasley CISSPDigital Government The Key to Vulnerabilities No Operator inter-action needed No Operator inter-action needed As fast as the network allows As fast as the network allows Who is on your network Who is on your network

October 2004 By Dennis Peasley CISSPDigital Government Who’s on your network Plenty of Dynamically Provided Addresses Plenty of Dynamically Provided Addresses No requirements needed to get an address No requirements needed to get an address No membership or authorization needed No membership or authorization needed Microsoft Domains are not a block Microsoft Domains are not a block

October 2004 By Dennis Peasley CISSPDigital Government Who is on Your Network? In 2003 Herman Miller Inc. won the RSA conference, Best Security Practice of the year, for preventing a computer without up-to-date Anti-Virus remotely accessing the network. In 2003 Herman Miller Inc. won the RSA conference, Best Security Practice of the year, for preventing a computer without up-to-date Anti-Virus remotely accessing the network. We have been infected with each of the major Worms since then. We have been infected with each of the major Worms since then. What’s up with That? What’s up with That?

October 2004 By Dennis Peasley CISSPDigital Government Worms and Virus August 2003 –Blaster August 2003 –Blaster May Sasser emerged May Sasser emerged Each of these worms found hosts on our network that we did not know existed. Each of these worms found hosts on our network that we did not know existed. We began a one year search for computers we did not know were on our network. We began a one year search for computers we did not know were on our network.

October 2004 By Dennis Peasley CISSPDigital Government Check with the vendors Most major vendors said they could find every computer on our network. Most major vendors said they could find every computer on our network. The key is how fast. The key is how fast. Many laptops, many computers turned On and Off Many laptops, many computers turned On and Off How big is your address range How big is your address range We use 10.x.x.x - 16,777,214 possible host addresses We use 10.x.x.x - 16,777,214 possible host addresses

October 2004 By Dennis Peasley CISSPDigital Government Too many places to scan All of these addresses are not live All of these addresses are not live But who do we believe when we decide not to check them But who do we believe when we decide not to check them Gota check’em all Gota check’em all

October 2004 By Dennis Peasley CISSPDigital Government Who talks to Who Routers talk to all of them Routers talk to all of them They can tell you of every one who talks to anyone else on the network They can tell you of every one who talks to anyone else on the network Ask the routers who’s there Ask the routers who’s there They know every computer that talks on the network They know every computer that talks on the network With this information you can find your network occupants With this information you can find your network occupants

October 2004 By Dennis Peasley CISSPDigital Government Find Them – Scan Them We scanned each host looking for Windows but no Anti-Virus program We scanned each host looking for Windows but no Anti-Virus program We found computers that we couldn’t talk to. We did not have rights. We found computers that we couldn’t talk to. We did not have rights. Policies? Do your Windows System administrators have the right to access all client computers. Policies? Do your Windows System administrators have the right to access all client computers. What happens when you find the computers that will be there. What happens when you find the computers that will be there.

October 2004 By Dennis Peasley CISSPDigital Government Each Network has these Unknown Hosts These hosts are: These hosts are: Unmanaged Unmanaged Unpatched? Unpatched? Not backed up Not backed up Running unknown software Running unknown software Running unknown services Running unknown services Waiting to be used by the next worm Waiting to be used by the next worm Where are the real risk’s Where are the real risk’s

October 2004 By Dennis Peasley CISSPDigital Government Vendor’s and Magazine’s There are many risk’s running a modern technology ecology. There are many risk’s running a modern technology ecology. The risks will never go away. The risks will never go away. Set the priorities Set the priorities Where will you focus your teams Where will you focus your teams

October 2004 By Dennis Peasley CISSPDigital Government Security is like Quality Security must be built in Security must be built in Security must be part of all management Security must be part of all management Security must have measurable goals Security must have measurable goals Operations teams are not usually measured by quality or security Operations teams are not usually measured by quality or security Separation of duties makes sense Separation of duties makes sense Security should be equal to operations, development and Infrastructure Security should be equal to operations, development and Infrastructure OR outside of IT OR outside of IT