1. Copyright, 2005 Pinnacle Entertainment, Inc. 1 Auditing the Windows Network Bart A. Lewin Chief Technology Officer Pinnacle Entertainment, Inc. CS 3-2

2. Copyright, 2005 Pinnacle Entertainment, Inc. 2 Introduction Today, PC based networks contain mission critical applications and data. PC’s are also the gateway to applications and data contained on non-PC hosts. Auditing networks is essential to their security. Today you will learn the why, how and positive results of network audits. But first, let me know a little about you.

3. Copyright, 2005 Pinnacle Entertainment, Inc. 3 Agenda Discover the specific reasons why an organization should regularly audit its networks. –What is a network? –Why should a network be audited? Examine the most common techniques used to audit networks, what they uncover, and why. –Scanners –Blockers –Live Intrusion –Interviews Discuss a case study and examine actual audit results. Discuss appropriate remediation for audit findings.

4. Copyright, 2005 Pinnacle Entertainment, Inc. 4 Why Regularly Audit a Network?

5. Copyright, 2005 Pinnacle Entertainment, Inc. 5 Why Regularly Audit a Network? What are We Trying to Prevent? –Hampered Network Services Viruses Denial of Service Attacks –Information Theft Hacking Spyware Trojan Horses, etc.

6. Copyright, 2005 Pinnacle Entertainment, Inc. 6 Why Regularly Audit a Network? Why are We Trying to Prevent this? –Hampered Network Services Loss of Revenue Loss of Labor Productivity –Information Theft Loss of Trade Secrets Loss of other Confidential Business Information Legal Liability

7. Copyright, 2005 Pinnacle Entertainment, Inc. 7 Why Regularly Audit a Network? Top Ten Windows System Vulnerabilities from www.sans.org involve: www.sans.org –W1 Web Servers & ServicesW1 Web Servers & Services –W2 Workstation ServiceW2 Workstation Service –W3 Windows Remote Access ServicesW3 Windows Remote Access Services –W4 Microsoft SQL Server (MSSQL)W4 Microsoft SQL Server (MSSQL) –W5 Windows AuthenticationW5 Windows Authentication –W6 Web BrowsersW6 Web Browsers –W7 File-Sharing ApplicationsW7 File-Sharing Applications –W8 LSAS ExposuresW8 LSAS Exposures –W9 Mail ClientW9 Mail Client –W10 Instant MessagingW10 Instant Messaging

8. Copyright, 2005 Pinnacle Entertainment, Inc. 8 Why Regularly Audit a Network? $ Effort Cost of Not Securing Cost of Securing Security Aversion Risk Aversion Acceptance, Mitigation, Transference, Avoidance Chart adapted from http://www.theiia.org/eSAC/pdf/BMA_1426.pdf, page 50http://www.theiia.org/eSAC/pdf/BMA_1426.pdf

9. Copyright, 2005 Pinnacle Entertainment, Inc. 9 Auditing Techniques Scanners –Security scanners test network nodes for vulnerabilities and report them. Free scanners include Nessus (www.nessus.org) and the Microsoft Baseline Security Analyzers (http://www.microsoft.com).www.nessus.orghttp://www.microsoft.com Commercial scanners (i.e., www.eEye.com) Include the ability to automate scans and report variances from stated security policies. –Advantage of assisting to preempt attacks.

10. Copyright, 2005 Pinnacle Entertainment, Inc. 10 Auditing Techniques Verify Blockers are in Place (Scanners usually do this) –Blockers Stop Incoming Threats Include Spam, spyware, trojan horse blockers. Firewalls –Prevents known threats, but are little help with unknown threats.

11. Copyright, 2005 Pinnacle Entertainment, Inc. 11 Auditing Techniques Live Intrusion –Attempting to gain network access information as an outside party confederate. –Utilizing from outside the firewalls to attempt to gain access. –Assessing the security of physical devices. –Assessing the loyalty of employees.

12. Copyright, 2005 Pinnacle Entertainment, Inc. 12 Auditing Techniques Threats to InformationOccurrence Laptop Theft29% Virus28% Insider Abuse of Network11% Telecommunications Fraud6% Financial Fraud4% System Penetration4% Theft of Proprietary Information4% Unauthorized Insiders4% Sabotage3% Denial of Service3% Telecommunications Eavesdropping2% Active Wiretapping? Source: http://www.theiia.org/eSAC/pdf/BMA_1426.pdf, page 49http://www.theiia.org/eSAC/pdf/BMA_1426.pdf

13. Copyright, 2005 Pinnacle Entertainment, Inc. 13 Auditing Techniques Interviews –Interviewing those responsible for the entry, maintenance and custody of IT systems will assist with: Identifying potential security risks. Identifying the costs of the risk.

14. Copyright, 2005 Pinnacle Entertainment, Inc. 14 Case Study

15. Copyright, 2005 Pinnacle Entertainment, Inc. 15 Remediation

16. Copyright, 2005 Pinnacle Entertainment, Inc. 16 Questions?

17. Copyright, 2005 Pinnacle Entertainment, Inc. 17 Where to Get More Information Other training sessions List books, articles, electronic sources Consulting services, other sources