1. SNA, Step 2, 10/31 Survivable Network Analysis Oracle Financial Management Services Ali Ardalan Qianming “Michelle” Chen Yi Hu Jason Milletary Jian Song

2. SNA, Step 2, 10/31 Overview Essential User Capabilities Summary of Essential Components Firewall Type Essential Components Diagram Essential Scenarios Essential Component Details Next Steps

3. SNA, Step 2, 10/31 Essential User Capabilities Essential Capabilities performed by 300 dedicated users Dedicated users must have access to financial service applications Core Financial Applications Application Desktop Integrator Applications Feeder systems must integrate with financial applications Primary actions performed by users are: Billing, reporting & reconciliation of budgets and expenses

4. SNA, Step 2, 10/31 Summary of Essential Components Kerberos Domain Controller (authentication) Acis.as.cmu.edu (public access points) Mistral (db server) Tandem (print & e-mail) Chinook (backup server)

5. SNA, Step 2, 10/31 Logical Proxy (Application Gateway) Firewall SCP HTTPS … Oracle Connection Mgr. Acis.as. cmu.edu (Sun Sparc Cluster) LPR (print) SSH SMTP (e-mail) Tandem CAMPUS NETWORK PRIVATE NETWORK (External)(Internal) 1.Restricts traffic based upon packet content 2.Application specific

6. SNA, Step 2, 10/31 Essential Components Diagram Kerberos SCP HTTPS … Oracle Connection Mgr. Kerberos Domain Contriller Acis.as. cmu.edu (Sun Sparc Cluster) LPR (print) SSH SMTP (e-mail) Tandem O. DB HTTP … O. Listener Mistral (databse server) SQL Net O. Forms CITRIX FTP LPR (print) SSH SMTP (e-mail) O. DB HTTP … O. Listener Chinook (Backup) SQL Net O. Forms CITRIX FTP LPR (print) SSH SMTP (e-mail) CAMPUS NETWORK Cyert Computer Center 6555 Penn Ave FIBER

7. SNA, Step 2, 10/31 Essential Components [1] Acis.as.cmu.edu: Cluster of Sun Sparc Servers Public Access Points Support services Oracle Connection Manager HTTP, Telnet, FTP, HTTPS(some Kerberos authenticated) SCP (Secure Copy Protocol – unix) SSH Web DB, Big Brother (Monitoring software), …

8. SNA, Step 2, 10/31 Essential Components [2] Mistral: Database Server Hosts main Oracle Server: HTTP Oracle Listeners, Names, Database CITRIX Application Server NFS(data sharing), SMTP (e-mail) LPR (printer) & Fs (other printer) SQL net, FTP, SSH(file upload)…

9. SNA, Step 2, 10/31 Essential Components [3] Tandem Print & E-mail gateway No user accounts on this machine Services provided: SSH (Administrator Connections) LPD (Printing) SMTP (email)

10. SNA, Step 2, 10/31 Essential Components [4] Chinook Disaster Recovery Machine: standby database Located offsite at 6555 Penn Ave. Test & Development machine Mirroring of Development database every 5-minutes Existing passive fiber link between campus and this location. Exact Same HW & SW as Mistral

11. SNA, Step 2, 10/31 Essential Scenarios – Budget Spreadsheet Kerberos SCP HTTPS Oracle Connection Mgr. Kerberos Domain Contriller Acis.as. cmu.edu (Sun Sparc Cluster) LPR (print) SSH SMTP (e-mail) Tandem O. DB HTTP O. Listener Mistral (Databse Server) O. Forms CITRIX CAMPUS NETWORK (out)

12. SNA, Step 2, 10/31 Essential Scenarios – Feeder System Kerberos SCP HTTPS Oracle Connection Mgr. Kerberos Domain Contriller Acis.as. cmu.edu (Sun Sparc Cluster) LPR (print) SSH SMTP (e-mail) Tandem O. DB HTTP O. Listener Mistral (Database Server) O. Forms Secure Directory CAMPUS NETWORK LPR (print) SMTP (e-mail)

13. SNA, Step 2, 10/31 Essential Components – DB Mirroring O. DB O. Mirroring Software Mistral (Database Server)Chinook (Backup) O. DB O. Mirroring Software Automatic mirroring of development database changes every 5-minutes

14. SNA, Step 2, 10/31 Ongoing Steps Client & Users 3 rd client meeting to verify essential services and components On-going interviews of Business Managers with and w/o feeder systems Within Our Group Development of potential intrusion detection scenarios & attacker profiles Identify compromisable components Physical visit to 6555 Penn Ave. Backup facility

15. SNA, Step 2, 10/31 A potential security threat Business Managers: 30+ business managers SCS, MCS, CIT, etc… Determine exactly who is able to obtain various forms of access to areas of the oracle financial system For example, MCS: College Manager 7 Business Managers Provide access to 2-3 individuals (regular users)