Computer Security Status Update FOCUS Meeting, 28 March 2002 Denise Heagerty, CERN Computer Security Officer
Incident Summary, 31 Dec Incident Type 859 Security holes exploited (includes worms) 36 web servers, 11 linux kernels, 8 ssh, 4 ftp servers 8642 Compromised CERN accounts sniffed or guessed passwords 8(26) DoS (Denial of Service) attacks 25 caused by Code Red Worm (counted above) 1813 Unauthorised use of file servers insufficient access controls 915 Serious SPAM incidents CERN addresses are regularly forged 911 Serious Viruses several new viruses are released each day 1711 Miscellaneous security alerts Total Incidents
Conclusions Security holes and discovered passwords are CERN’s biggest security risks Security related actions reduced the number and impact of incidents at CERN Incidents remained constant at CERN whilst they doubled across the Internet as a whole in 2001 Code Red and Nimda worms were eliminated in less than half a day due to effective security tools CERN avoided disruptive worms, e.g. Code Red II Intensive security campaigns from Aug-Dec 2001: Code Red, Nimda, Linux kernel, ftp, ssh Disconnecting insecure systems has been essential for assuring CERN’s Internet access (e.g. Xmas) Security needs to become integrated throughout CERN’s working methods
Open Issues Ensuring software is secured and patches are regularly applied systems directly visible in the firewall expose the site All systems are at risk (worms traverse firewalls) Outdated/unsupported systems are a serious security risk! Risk from privately installed software Often directly visible to the general Internet (high port nos) Can offer unauthorised access (e.g. file sharing) Can contain viruses and backdoor access for intruders Passwords need to be encrypted for all applications telnet, ftp, X, mail applications expose password in clear text Protecting CERN’s critical systems Currently at risk on a regular basis Ensuring correct data is registered and updated for systems on the CERN network Contact name who can react quickly MAC address required for mobile devices Ensuring an audit trail to identify causes of incidents Protecting the site during Xmas shutdown Volunteer effort is not sufficient
Security proposals currently under discussion Strengthen firewall protection protect access to sensitive high numbered ports Improve computer security information and its dissemination knowledge of security is an important tool Define minimum rules for connecting systems to CERN’s network correct registration data, configuration checklist, … Require regular successful security checks for systems directly visible in the firewall frequent security scans of systems with INCOMING access Require security reviews for systems considered as critical for CERN’s mission need to ensure these are and remain sufficiently protected Define an agreed procedure to block network access for insecure systems attempt to inform an agreed set of people