1. Network Security and Audits LITN Fall Conference 2006 Presented by Katie Givens Mosaic

2. © 2006 Mosaic. All rights reserved. Network Security and Audits  Network Security in Today’s Environment  Network Security Tools  Network Security Policies and Practices  Network Security Audits  Physical Network Security  Helpful Links  Conclusion

3. © 2006 Mosaic. All rights reserved. Network Security in Today’s Environment  The Internet  Innovative exchange and storage of information  Reliance on the Internet  Opportunity for security breaches  The Future of Security Problems  Security needs will continue to grow  New security measures bring new ways to get around them

4. © 2006 Mosaic. All rights reserved. Network Security in Today’s Environment  No Guarantees  No way to ever be 100% secure  Even the best are still vulnerable  Basic Solutions  Firewalls  Tripwires  Patch security holes  Backups  Encryption  Use Linux and Open Source to secure Microsoft

5. © 2006 Mosaic. All rights reserved. Network Security Tools  Firewall – Cisco PIX (Private Internet Exchange)  Network layer firewall  Protects your network from unwanted traffic  Packet filtering  Place at the connection to the Internet

6. © 2006 Mosaic. All rights reserved. Network Security Tools  Intrusion Detection – SNORT  Detect the presence of an intruder and accountability for their actions  Several options for setup – switches, hubs, outside firewall, behind firewall  Oinkmaster – keep your rules updated

7. © 2006 Mosaic. All rights reserved. Network Security Tools  Security Scanner – Nessus  Free and 100% customizable  Server-client architecture  Plug-in architecture  Complete reports

8. © 2006 Mosaic. All rights reserved. Network Security Tools  Intrusion Detection – Tripwire  Tool that checks to see what has changed on your system  Monitors key attributes of files that should not change, i.e., binary signature, size, expected change of size, etc.  Invisible camera on your network  Con – alerts you after the attack – does not prevent. Can also help you to assess the damage  Can also be used for integrity assurance, change management, policy compliance, and more

9. © 2006 Mosaic. All rights reserved. Network Security Tools  Antivirus – Clam Antivirus  Integrates with mail servers (attachment scanning)  Flexible and scalable  Command-line scanner  Tool for automatically updating through the Internet

10. © 2006 Mosaic. All rights reserved. Network Security Tools  Spam Protection – Spam Assassin  Popular open source spam fighting tool  Highly customizable  Integrates with many different mail servers, including exchange  Regularly maintained and updated by the open source world

11. © 2006 Mosaic. All rights reserved. Network Security Tools  System Monitoring – Nagios  Open Source  Network monitoring application software  Monitors network services  Monitors host resources  Plug-ins available to allow for development of own service checks  Ability to define host hierarchy  Reports, dashboards, and network diagrams

12. © 2006 Mosaic. All rights reserved. Network Security Policies & Practices  Access Permissions  Users – one account per users  Groups – assigned permissions to access folders, files, etc.  Special Accounts – SQL Service, backup, etc.  Network Account Policies  Lockout – 30 day, 60 day, 90 day  Number of bad log on attempts  Password requirements  Length of lockout

13. © 2006 Mosaic. All rights reserved. Network Security Policies & Practices  Security Office  Security Officer (HIPAA)  Security Office Team  HIPAA Security Standards Matrix and Implementation Plan  Review security incidents  Supported by Senior Leadership and includes the HIPAA Privacy Officer

14. © 2006 Mosaic. All rights reserved. Network Security Audits  Security Audits  Unused accounts  File Access  Log on  Bad log on attempts

15. © 2006 Mosaic. All rights reserved. Physical Network Security  Password protected screen saver  Secure access to the server room  ReadyAccess: disconnect session after 15 minutes and terminate after 90 minutes

16. © 2006 Mosaic. All rights reserved. Acknowledgements Thanks to Thain Eischeid, Larry Gerlt, and Steve Kohrs for sharing their expertise on network security and audits.

17. © 2006 Mosaic. All rights reserved. Helpful Links  Webbing – manage nearly all system services from a web interface  www.webmin.comwww.webmin.com  Big Brother – monitor your network from printers to servers right down to a specific service  www.bb4.comwww.bb4.com  Net filter – iptables for linux  www.netfilter.orgwww.netfilter.org  Tripwire – intruder detection  www.tripwire.orgwww.tripwire.org  Ethereal – packet sniffer utility to monitor network traffic  www.ethereal.comwww.ethereal.com  SANS Internet Storm Center – cyber threat monitor and alert system  isc.sans.org

18. © 2006 Mosaic. All rights reserved. Helpful Links  CERT – coordination center of Internet security  www.cert.orgwww.cert.org  Linux Security – Linux community for security  www.linuxsecurity.comwww.linuxsecurity.com  Revolution OS – get the story on the open source movement  www.revolution-os.comwww.revolution-os.com  Snort – Intrusion Detection System  www.snort.orgwww.snort.o  Oinkmaster – Snort rules manager / updater  oinkmaster.sourceforge.net  Nessus – system security scanner  www.nessus.orgwww.nessus.org

19. © 2006 Mosaic. All rights reserved. Helpful Links  Samba – file and printer sharing server  www.samba.orgwww.samba.org  qmail – safe and secure Mail Transport Agent (MTA)  www.qmail.orgwww.qmail.org  qmail-scanner – content scanner for qmail  qmail-scanner.sourceforge.net  Clam Antivirus – open source antivirus scanner  www.clamav.netwww.clamav.net  SpamAssassin – a mail filter to identify spam  www.spamassassin.org

20. © 2006 Mosaic. All rights reserved. The End