1. Gaspar Modelo-Howard NEEScomm Cybersecurity Software Engineer Saurabh Bagchi NEEScomm Cybersecurity Officer

2.  Scanning of Remote Sites  Incident Response Procedure  Best Security Practices  Remote Authentication Service  NEEScomm Security Operational Duties GOAL  Ensure that NEEScomm can operate and maintain its IT resources to serve the NEES community

3.  Objective: To check the security of the IT resources at the sites  Guiding principles: ◦ Be proactive ◦ Minimize impact to the sites’ activities  Will be done once per year ◦ Remote (non-intrusive) scans from “inside” the network ◦ Limited to site IT assets from inventory ◦ Time schedule determined between SIM and CSO

4.  Candidate scanners to be used: Nessus, Nikto, web app scanners  Critical vulnerabilities will be immediately identified and reported to SIM with mitigation hints  Each discovered vulnerability will follow an incident report procedure  Results of the scan will be documented in a comprehensive archival report

5.  If it pertains to operation of NEES IT resources, at earliest possible opportunity  Form available from http://nees.org (not working yet)  Telephone line set up 1-877-644-1381 ◦ Report the incident via a voice message ◦ Greeting message will prompt for required information and will trigger a ticket which will notify NEEScomm IT support ◦ NEEScomm IT will contact the person reporting the cybersecurity incident to gather standard information, primarily IP and description of incident ◦ Information will be recorded in the current ticketing system and will be tagged as a cybersecurity incident

6.  A team for resolving the incident will be developed by the CSO in consultation with the SIM  Criticality level of the incident will be determined: critical, important, moderate, low  Site IT resource may be taken offline to prevent spread of the security incident  Record will be kept of the incident progression through the ticketing system  Incidents of a grave nature will need to be reported to NSF, as per agreement with NSF

7.  Modification of previous remote authentication service (gridauth.cgi) by Karan Bhatia ◦ Objective was to make as few changes (to users) as possible  Accessible thru https://neesws.neeshub.org:9443  Complete URL: https://neesws.neeshub.org:9443/GRIDAUTH /gridauth.cgi?username=uuuuuuu&password =ppppppp

8.  User account administration  NEEScomm servers audit ◦ Source code  File integrity checker  Intrusion detection system

9. 1. Encourage difficult to guess, easy to remember passwords, especially administrators accounts 2. Keep your systems up-to-date with patches and updated software versions 3. Monitor system logs periodically 4. Have backup and disaster recovery processes 5. Create educational sessions for users – we can help 6. Screen lock on unattended user terminals 7. Decide from which IP addresses you will allow users to connect to your critical IT assets  Sites’ feedback is appreciated

10. Contact: Gaspar Modelo-Howard 765-494-5515 / gmodeloh@purdue.edu Saurabh Bagchi, PhD 765-494-3362 / sbagchi@purdue.edu

12. gama.neeshub.org www.neeshub.org Existing Accts.: 222 Migrated: 1258 NOT migrated: 367 Migrated: 1258 neesforge.neeshub.org Migrated: 159 NOT migrated: 138 ml.neeshub.org Migrated: zero NOT migrated: 1788 Migrated: 159 Migrated: zero Total Number of Accounts: 1639

13.  Unix47%  Windows44%  Others9%