1. Network Security Lewis R. Folkerth, P. E. Consumers Energy Energy Management Systems lrfolkerth@cmsenergy.com

2. Overview Why Network Security? Types of Security Network Configurations Intrusion Detection Maintaining Security

3. Why Network Security? EMS as installed: –no outside connections –no or limited dialup –few threats

4. Why Network Security? EMS today –Network connections Company Internet –Dialup –More threats “Hackers” Competitors Terrorists

5. Types of Security Host Security –Passwords –OS –Vulnerability Analysis –Intrusion Detection Network Security –Firewalls –Packet Filtering –Vulnerability Analysis –Intrusion Detection

6. Common EMS Network

7. Add a Layer of Protection

8. Add Intrusion Detection

9. Isolate the Intrusion Detection

10. Firewalls Commercial product is probably best Consider location when choosing brand and type –Parallel implementations Use same type and brand as main Internet firewall –Series implementations Use different brand from main firewall

11. Packet Filtering Available in most routers Used where a firewall is overkill More difficult to maintain

12. Vulnerability Analysis Host based –COPS (UNIX) –ASET (Solaris) –SCE (NT) –Commercial Network Based –SATAN –nmap –Commercial

13. Intrusion Detection Host Based –Tripwire (UNIX) –Commercial (Other) Network Based –SHADOW –Commercial

14. Building an Intrusion Detection System (IDS) Obtain Software Obtain Hardware –Sensor Requirements –Analysis Station Requirements Install the sensor –OS –tcpdump, libpcap, ssh, SHADOW –Configure Install the analysis system –OS –tcpdump, libpcap, ssh, apache, browser, SHADOW –Configure

15. Maintaining Security Keep up with the latest exploits Ongoing education Newsletters Incident Response Groups NIPC - Infragard