1. Vulnerability, Attack, Defense Split Tunneling Cross-Site Request Forgery And You Mary Henthorn OIT Senior Technology Analyst February 8, 2007

2. Thoughts for Today The Vulnerability  Split Tunneling An Attack  Cross-Site Request Forgery The Defense  You!

3. Split Tunneling Vulnerability What? When? Why

4. Virtual Private Network Secure path between server and client usually described as a tunnel

5. Split Tunnel Connection to an outside system Can use client as agent to deliver payload

6. Split Tunnels Happen Client device connects to:  Internet  Network application  Local devices  Local network

7. Why Have Split Tunnels? Performance Bandwidth conservation Multi-tasking habits Access to local network Access to printers Internet Connection Sharing (ICS) VPN as a Band-Aid

8. An Attack VPN as a Band-Aid Doesn’t completely isolate sessions

9. Cross-Site Request Forgery Can defeat VPN Facilitated by Split Tunneling Facilitated by XSS vulnerabilities Can be delivered by worms Can be delivered by botnets  Fast - Resilient Complexity depends on target application

10. CSRF by Any Other Name CSRF XSRF Injection, code injection Session riding Hostile linking CSRF – pronounced “sea surf” One click attack Confused deputy attack

11. CSRF Attacker tricks client (agent) into sending the malicious request

12. CSRF Attack Study target application Forge the attack Make attack available to agent Let agent deliver attack “Veni, vidi, vici.”, Samy

13. Code that Picks the Lock

14. You! Good Network Defender! Educate users Apply security patches and updates Use anti-virus protection Use firewalls Keep browser security high Develop safe applications Alternate access to services

15. Best Defense No Split Tunneling Cisco Nortel Citrix UC Davis Thomas Shinder – ISA Server Thomas Berger – Univ. of Salzburg

16. Defense-in-Breadth Defense-in-Depth as implemented  On or off  Expect 100%  Even 90% can be costly Synergistic Security  Multiple complimentary controls  Each < 100%  Combination increases security

17. Split-Tunneling, Good Practice Educate users Client security Firewalls Risk vs. Cost Multiple solutions

18. Vulnerabilities = Attacks