The need for Security ? InternetWeek: 50% of Corporations have had 30 or more penetrations, 60% lost up to $200K/intrusion Federal Computing World: Over 50% of Federal agencies report unauthorized access (some are massive numbers) FBI/Computer Security Institute: 48% of all attacks originated from within the organization WarRoom Research Survey: 90% of Fortune 500 companies surveyed admitted to inside security breaches
Common IT Security Shortcomings Enterprise wide patch management system Intrusion Detection systems on both inside and outside of the perimeter No firewalls / weak firewalls in place All / few servers directly open to the internet Outgoing email server doesn’t require authentication Partial Content management / prevention solution Outdated / un-patched mail servers
Patch Management : Why reaction time matters… Reaction time is critical in preventing viruses and worms, which can cost organizations billions. Forrester says that organizations typically require more than 300 days to fully deploy patches for most of these issues after the fix is available. The race begins when the technical details of an issue (such as a security bulletin or release of exploit code) are made public. WormNumber of days from release of exploit to worm appearance Scalper (2002, FreeBSD) (*early disclosure) 11 days Blaster (2003, Windows) 16 days Code Red (2001, Windows) 24 days Lion (2001, Linux) 53 days Slapper (2002, Linux) 58 days Melissa (1999, Windows) 64 days Nimda (2001, Windows) 172 days Slammer (2003, Windows) 180 days Ramen (2001, Linux) 208 days
The SQL Slammer Worm: What Happened?? -MS SQL Vulnerability and patch released July, 2002 -Worm Released at 5:30 GMT, January 25, 2003 -Saturation point reached within 2 hours of start of infection -250,000 – 300,000 hosts infected -Internet Connectivity affected worldwide -Not easily detected by anti-virus since it did not write itself to disk
The SQL Slammer Worm: 30 Minutes After “Release” - Infections doubled every 8.5 seconds - Spread 100X faster than code red - At peak, scanned 55 million hosts per second.
The RPC Blaster Worm: What Happened?? -RPC Vulnerability and patch published by Microsoft on July 16 th, 2003. -Vulnerability affects NT 4.0, WinXP, Win2000, and Win2003 Server. -Blaster worm released Monday August 11, 2003 – Main target is only WinXP, Win2000. -+330,000 hosts infected in less than a week -Microsoft had to make network changes to avoid DDOS attack -Worm Variants Appearing Lovsan.B, Lovsan.C
Lessons Learned Applying patches must be done quickly and thoroughly – If vulnerability applies to clients these must be patched – One infected machine can scan and infect 1000s of victims The network must be configured with QOS and have the intelligence to filter and control traffic when needed Complements to patches such as Host-Based Security Agents must be considered
WindowsUpdate InternetIntranet Running SUS Windows: Critical Security Updates, Security Rollups, Service Packs Configured via web based admin tool. Admin Approves Updates Sync Updates Download and install Updates Download and install Approved Updates Corporate Servers, Desktops and Laptops with the Automatic Updates Client Central Client Config SUS 1.0: How it Works
Windows Update Choosing a Patch Management Solution Functionality versus IT Resources Based Selection Choose the solution that provides the best balance of functionality versus IT resource constraints for your specific needs IT Resources & Administration Skill Level Breadth of Functionality SUS SMS LowHigh High
Additional Measures Good and effective Anti-Virus Server and Anti-Spam Server on the gateway Install Intrusion Detection Software on the internal as well as external networks Implement firewalls Good Content Management as well as traffic management system Network Monitoring and management software.
Internet connections have increased as a frequent point of attack (from 59% in 2000 to 79% in 2003.) Of those reporting attacks, we learn : 27% say they don't know if there had been unauthorized access or misuse – no network information! 21% reported from two to five incidents 58% reported ten or more incidents – something isn’t working! Computer Security Institute & FBI Report March, 2003 Network Security Problems are Growing
Why Integrated Network Security? Attackers take advantage of new, complex networks and sophisticated services In this environment, Everything is a target: – Routers, Switches, Hosts, Networks (local and remote), Applications, Operating Systems, Security Devices, Remote Users, Business Partners, Extranets, etc. New breed of network attacks have multiple vectors that cannot be blocked by one device Network security requires an integrated system Layers of security are required Embedded security throughout the network Integrated security in network devices Network management and reporting must be secure
2) Secure 1) Security Policy 3) Monitor and Respond 4) Test/Assess 5) Manage and Improve Security is a business process requiring continuous improvement and automation...
The 7 Top Management Errors that Lead to Computer Security Vulnerabilities 1.Assign untrained people to maintain security and provide neither the training nor the time to make it possible to do the job. 2.Fail to understand the relationship of information security to the business problem -- they understand physical security but do not see the consequences of poor information security. 3.Fail to deal with the operational aspects of security: make a few fixes and then not allow the follow through necessary to ensure the problems stay fixed. 4.Reply primarily on a firewall. 5.Fail to realize how much money their information and organizational reputations are worth. 6.Authorize reactive, short-term fixes so problems re-emerge rapidly. 7.Pretend the problem will go away if they ignore it. http://www.sans.org/resources/errors.php