1. Page 1 8 Oct 2004 IT Security Awareness Dangers in the Networked World Lai Zit Seng NUS School of Computing

2. Page 2 8 Oct 2004 Topics History: Recent Worms What is Security Why Worry What’s Happening in SOC

3. Page 3 8 Oct 2004 History – Code Red Struck on 12th Jul 2001 –Public announcement on 17th Jul 2001 –CERT announcement on 19th Jul 2001, and again on 26th Jul 2001 Exploited buffer overflow in IIS –CERT published advisory on 19th Jun 2001 –Patch available from MS since 18th Jun 2001 Estimated $2B in damages (Aug 2001) –Source: Computer Economics (quoted by NewsFactor.com)

4. Page 4 8 Oct 2004 History – Slammer Worm Struck on 25 th Jan 2003 Infected 75K hosts Our own NUSNET “melted down” for hours –Elsewhere: Disrupted ATMs, 911 systems Exploited MS-SQL and MSDE vulnerabilities –Patch available from MS since 10 th Jul 2002 –CERT advisory 29 th Jul 2002 Estimated US$1B in damages –Source: Mi2g

5. Page 5 8 Oct 2004 History – W32/Blaster Struck on 11 th Aug 2003 Exploits RPC vulnerabilities –CERT advisory on 17 th Jul 2003 –Patch available from MS since 16 th Jul 2003 Unprecedented damages –Mi2g estimates $32.8B in economic damages (together with other malware of Aug 2003)

6. Page 6 8 Oct 2004 History – Other Incidents Apache/mod_ssl worm –CERT advisory 14 th Sep 2002 –Vulnerability published by CERT since 30 th Jul 2002 Nimda worm –CERT announced 18 th Sep 2001 –Exploits vulnerability for which patch available from MS since 29 th Mar 2001

7. Page 7 8 Oct 2004 Security Triad Confidentiality: Ensuring that data contained in an information system is accessible only to those authorized. Integrity: Ensuring that data contained in or functions carried out by an information system is correct. Availability: Ensuring that an information system is accessible to those authorized to use it.

8. Page 8 8 Oct 2004 Why Worry Advances in technology: Convenience, cost, availability Pervasiveness of networked computing Network convergence: Single network for Voice, Video and Data Human Issues: –Social Engineering

9. Page 9 8 Oct 2004 Why Worry – cont’d Infrastructure/Operations –ATMs, Power Grid etc exposed to Internet Various risk exposures: Confidentiality, Integrity, Availability Zero-Day exposures Phishing attacks Risks are outstripping safeguards

10. Page 10 8 Oct 2004 Changes in Intrusion Profile 1988 Exploiting passwords Exploiting known vulnerabilities Today Exploiting protocol flaws Examining source code for security flaws Abusing public servers Installing sniffers Source address spoofing DoS, DDoS Widespread automated scanning

11. Page 11 8 Oct 2004

12. Page 12 8 Oct 2004 Incidents Reported to CERT/CC From: CERT/CC Website

13. Page 13 8 Oct 2004 How many incidents? From: 2004 CSI/FBI Computer Crime and Security Survey

14. Page 14 8 Oct 2004 How many incidents from Outside? From: 2004 CSI/FBI Computer Crime and Security Survey

15. Page 15 8 Oct 2004 How many incidents from Inside? From: 2004 CSI/FBI Computer Crime and Security Survey

16. Page 16 8 Oct 2004 SOC IDS Activity Statistics for 1 st Oct 2004: 238155 IDS log entries 42578 runs of portscanning activities 12908 incidences of Windows/SMB traffic anomaly 209 accesses to our honeypot

17. Page 17 8 Oct 2004 SOC Network VA Statistics As on 8 th Oct 2004: 37 machines denied network access (due to enforcement) 185 critical vulnerabilities unfixed

18. Page 18 8 Oct 2004 Security Lab Objective: –Enable learning and experimentation relating to IT Security –Setting up experiments and playground for anyone interested in IT Security –Activities relating to SIG^2 NUS Chapter Servers, desktop computers and network equipment Look out for upcoming news

19. Page 19 8 Oct 2004 Questions and Answers Lai Zit Seng Email: laizs@comp.nus.edu.sg