1. Safeguarding OECD Information Assets Frédéric CHALLAL Head, Systems Engineering Team OECD

2. Agenda  Network Security  Remote Access  Anti-Virus Protection  E-mail Content Filtering and Blocking  Possible Future Directions

3. Network Security

4. Private Network External Firewall Internal Firewall Internet DMZ Extranet DMZ SITA X25 InternetInternet

5. Network Security  2 levels of firewalls for access control  2 separate DMZs to protect sensitive information  Outgoing Internet access through application relays  Intrusion detection systems on both DMZs  Vulnerability scanning on a regular basis

6. Intrusion Detection System  Network sensor watching for attack signatures  Responses to suspicious activity:  Connection termination  Alerts sent by E-mail  Session recorded  Other …

7. Intrusion Detection System

8. Centrally Managed Security Policies

9. Remote Access

10. Exchange Web SQL

11. Remote Access Home users Mission users

12. Remote Access  For portables and Outlook Web Access users to access the OECD network, two- factor authentication based on:  A PIN number (known by the user)  An authenticator (either hardware or software)  Also based on Windows authentication to access network resources

13. Anti-Virus Protection

14. NetworkServer Gateway & Firewall Internet Point of Entry E-mail & SMTP relay Client

15. Prevention And Detection  Anti-Virus products from 2 different vendors installed on:  Desktops and laptops  File Servers  E-mail Servers  SMTP Relays  Signature updates on a weekly basis  Scanning on PCs and servers on a weekly basis  User Education  Being Prepared  Basic Network Security  Standard Disaster Recovery Procedures

16. E-mail Content Filtering and Blocking

17.  Implemented after the ILOVEYOU virus  SMTP relay level filtering of all incoming and outgoing Internet messages:  Scan for viruses  Block « program » attachments and HTML scripts for 2 days  Search for « suspicious » text strings in subject  Reporting to management

18. E-mail Content Filtering and Blocking

19. W32/Navidad W32/Navidad-B

20. Possible Future Directions  Outsource detection and reporting of network vulnerabilities  SSL for Outlook Web Access  Use RTBL to prevent spamming  Content inspection on HTTP/FTP downloads

21. Comments and Questions?