1. Security Update at KEK since Oct-2002 Fukuko Yuasa/KEK nwg Kiyoharu Hashimoto/KEK nwg 23 October 2003 HEPiX/HEPNT2003 at TRIUMF

2. 2 Plan of Talk KEK SecureNet MAC address registration KEK VPN Protection against Virus/Worm

3. 3 KEK SecureNet In Aug. 2002, we had –About 1370 incoming hosts –About 4620 outgoing hosts Since Aug. 2002 to Aug. 2003, about 130 hosts moved from the incoming class to KEK DMZ. –Linux 40%, Win 19%, BSD 13%, Solaris 9.3% The rest becomes outgoing hosts

4. 4 blue:registration magenta: policy

5. 5 MAC address registration Since Aug. 2003, MAC address registration is required to use KEK network –Without the registration, packets are not transferred –4642 MAC address registered The port of the switch is configured dynamically –One MAC address belongs to one VLAN Also in the wireless LAN, MAC address registration is required since Apr. 2002. –KEK stuff: 150 and Collaborator: 728 –68 Cisco Aironet stations –WEP –Annual registration renewal

6. 6 C6509 Edge SW VMPS server CNR (DHCP server) C6509 VMPS client VMPS Database VMPS server (secondary)

7. 7 KEK VPN Cisco VPN5000 Ipsec + NAT mode # of users:294 –KEK stuff: 283 –Collaborators: 11 Annual account renewal New Server: Cisco VPN3000 Lab.IPSecNAT mode CERNOK FNALOK BNL (office) XOK BNL (dorm) OK SLACOK DESYXOK

8. 8 Average : about 2900 connections/month

9. 9 Internet CA 130.87.35.33 dcs00 LDAP 130.87.105.38 dcs01 Port710 Port709/829 Enrollment Web 130.87.105.40 dcs03 Enrollment VPN 130.87.105.39 dcs02 Port389 Port80 RA 130.87.35.32 130.87.4.67 130.87.30.1 FWVPN3030 DMZ KEK Intranet ＶＰＮ + ＰＫＩ + eToken

10. 10 C=JP O=KEK OU=KEK-CertAuth Directory Tree OU=VPN- Users CN=Security Officer Policy CN=ASH Policy OU=VPN- Admin OU=VPN- Servers CN=End User Policy CN=CRL1 CN=First Officer CN=Administrator Policy CN=ASH Service CN=TEST USER CN=VPN Connector OU=VPNServersOU=VPNAdmi n OU=VPNUsers CN=Kiyoharu Hashimoto CN=Kiyoharu2 Hashimoto CN=Atsushi Manabe CN=VPN3K A CN=Fukuko Yuasa CN=Yoshiyuki Watase CN=Nobu Katayama CN=Hironori Nakao

11. 11 Security Incidents at KEK since Oct. 2002 – Oct. 2003 Worm : 64%, unix root exploit: 28%

12. 12 Protection against virus/worm 42 windows are infected by Welchi worm in Sep. and Oct 2003. We checked all PCs using –KB823980Scan.exe in Aug. –KB824146Scan.exe in Sep. SOBIG.F: max. 700 virus mail per day –6601 (Aug) + 2930 (Sep) = 9531 total –These are blocked by InterScan VirusWall UNIX at KEK central mail server AntiVirus software + windows update –Scan is managed by Computing Research center System Update Service inside KEK

13. 13