1. Cyber Security Awareness Academic Freedom vs. Operations vs. Security CERN Computer Security Team (2010) S. Lopienski, S. Lüders, R. Mollon, R. Wartel “Protecting Office Computing, Computing Services, GRID & Controls”

2. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Basics On Security Security is as good as the weakest link: ► Attacker chooses the time, place, method ► Defender needs to protect against all possible attacks (currently known, and those yet to be discovered) Security is a system property (not a feature) Security is a permanent process (not a product) Security cannot be proven (phase-space-problem) Security is difficult to achieve, and only to 100%-ε. ► At CERN, YOU define ε !!!

3. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Basics On Security Security is as good as the weakest link: ► Attacker chooses the time, place, method ► Defender needs to protect against all possible attacks (currently known, and those yet to be discovered) Security is a system property (not a feature) Security is a permanent process (not a product) Security cannot be proven (phase-space-problem) Security is difficult to achieve, and only to 100%-ε. ► At CERN, YOU define ε !!! BTW: Security is not a synonym for safety. YOU are responsible for securing your services & systems: ► As user, developer, system expert or administrator ► As a project manager or line manager ► As part of the CERN or your experiment hierarchy

4. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” CERN is under permanent attack… even now. Servers accessible from Internet are permanently probed: ► …attackers trying to brute-force passwords; ► …attackers trying to break Web applications; ► …attackers trying to break-in servers and obtain administrator rights. Users are not always aware/cautious/proactive enough: ► …attackers trying to harvest credentials outside CERN; ► …attackers trying to “phish” user passwords. Incidents happen: ► Web sites & web servers, data-base interfaces, computing nodes, mail accounts, … ► The office network is very liberal: free connection policy and lots of visitors. Thus, there are always devices being infected/compromised. Under Permanent Attack

5. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” CERN is under permanent attack… even now. Servers accessible from Internet are permanently probed: ► …attackers trying to brute-force passwords; ► …attackers trying to break Web applications; ► …attackers trying to break-in servers and obtain administrator rights. Users are not always aware/cautious/proactive enough: ► …attackers trying to harvest credentials outside CERN; ► …attackers trying to “phish” user passwords. Incidents happen: ► Web sites & web servers, data-base interfaces, computing nodes, mail accounts, … ► The office network is very liberal: free connection policy and lots of visitors. Thus, there are always devices being infected/compromised. Under Permanent Attack YOU are responsible for preventing incidents happening: ► As user, developer, system expert or administrator ► As a project manager or line manager ► As part of the CERN or your experiment hierarchy

6. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Be Vigilant & Stay Alert !!! Email addresses can easily be faked ! Stop “Phishing” attacks: No legitimate person will EVER ask for your credentials ! Do not trust your web browser !

7. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Do not trust your web browser ! What links to www.ebay.com ? http://www.ebay.com\cgi-bin\login?ds=1%204324@%31%33%37 %2e%31%33%38%2e%31%33%37%2e%31%37%37/p?uh3f223d http://www.ebaỵ.com/ws/eBayISAPI.dll?SignIn http://scgi.ebay.com/ws/eBayISAPI.dll?RegisterEnterInfo&siteid=0& co_partnerid=2&usage=0&ru=http%3A%2F%2Fwww.ebay.com&rafId=0 &encRafId=default http://secure-ebay.com    This IS Not EVEN obvious FOR professionals !

8. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Unpatched oscilloscope (running Win XP SP2) Security risks are everywhere !!! Lack of input validation & sanitization Confidential data on Wiki, webpages, CVS… Negligence of the “Rule of Least Privilege”

9. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” An Incident in September A defaced (new) web-page… Oops !!??? …a user listing

10. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Violation of Basic Principles ! Configuration well documented in Google… Neglected “Rule of Least Privileges”: Everyone could upload whatever he/she wants… Lack of input validation & sanitization

11. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Who owns the consequences ? How long does it take you to reinstall your system, if requested right now ? Are you prepared to take full responsibility? Are you in the position to really take it ? Can you allow for loss of ► functionality ► control or safety ► efficiency & beam time ► hardware or data ► reputation…?

12. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” YOU ► Patch immediately (manage centrally) ► Keep passwords secret & change them regularly ► “Rule of least privilege”: Control access to all your assets ► Apply proper coding & configuration practices YOU&US ► Do incident forensics ► Leave “ON”, disconnect & don’t touch ► Recover… ► Analyze causes & apply lessons learned ► Monitor traffic ► Deploy intrusion detection (host-, network-based) ► Maintain up-to-date anti-virus software ► Enable & monitor system logging ► Be vigilant & stay alert ► Deploy “Defense-in-Depth” ► Segregate networks ► Tighten down firewalls ► Be vigilant & stay alert Mitigation: A Permanent Process Budget & Resources YOU Response Prevention Protection Detection

13. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Operational Circular #5 http://cern.ch/ComputingRules

14. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Stick to the “Rule of Least Privilege”: ► Protect accounts/files/services/systems against unauthorised access ► Passwords must not be divulged or easily guessable (your “toothbrush”) ► Protect access to unattended equipment E-Mail users must not: ► Send mail bombs, SPAM, chain letters or forge e-mail or news articles PC users must: ► Run anti-virus software and upgrade/patch systems regularly ► Act immediately to contain and mitigate security incidents Network users must: ► Collaborate to investigate problems detrimental to CERN’s network ► Not make unauthorised changes to CERN’s network infrastructure Operational Circular #5 http://cern.ch/ComputingRules

15. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Personal use is tolerated or allowed provided: ► Frequency and duration is limited and resources used are minimal ► Activity is not illegal, political, commercial, inappropriate, offensive, or detrimental to official duties ► Activity does not violate applicable laws in CERN's Host States ► Not allowed: the consultation of pornographic and other illicit material (e.g. paedophilia, inciting to violence, discrimination, racism) Restricted personal use: ► Applications known to cause security and/or network problems ► e.g. Skype, IRC, file sharing (eDonkey, BitTorrent, …) Respect confidentiality and copyrights ► Illegal or pirated data (software, music, video, etc.) is not permitted Operational Circular #5 (cont’d) http://cern.ch/ComputingRules

16. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Personal use is tolerated or allowed provided: ► Frequency and duration is limited and resources used are minimal ► Activity is not illegal, political, commercial, inappropriate, offensive, or detrimental to official duties ► Activity does not violate applicable laws in CERN's Host States ► Not allowed: the consultation of pornographic and other illicit material (e.g. paedophilia, inciting to violence, discrimination, racism) Restricted personal use: ► Applications known to cause security and/or network problems ► e.g. Skype, IRC, file sharing (eDonkey, BitTorrent, …) Respect confidentialty and copyrights ► Illegal or pirated data (software, music, video, etc.) is not permitted Operational Circular #5 (cont’d) http://cern.ch/ComputingRules

17. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Security is a permanent process and can only be achieved by 100%-ε. YOU are responsible for securing your service(s) (i.e. ε): ► As user, developer, system expert or administrator ► As a project manager or line manager Therefore: ► Be vigilant and stay alert ! ► Close vulnerabilities: prevent incidents from happening ► Check access rights and stick to the “Rule of Least Privilege” ► Make security a system property: Review configuration & coding practices ► Provide funding and resources The Computer Security Team can provide assistance. Summary

18. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Security is a permanent process and can only be achieved by 100%-ε. YOU are responsible for securing your service(s) (i.e. ε): ► As user, developer, system expert or administrator ► As a project manager or line manager Therefore: ► Be vigilant and stay alert ! ► Close vulnerabilities: prevent incidents from happening ► Check access rights and stick to the “Rule of Least Privilege” ► Make security a system property: Review configuration & coding practices ► Provide funding and resources The Computer Security Team can provide assistance. Summary

19. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” Training Courses on Security https://cern.ch/security/training/en/index.shtml

20. Dr. Stefan Lüders (CERN IT/CO) ― DESY ― 20. Februar 2007 Computer.Security@cern.ch — “Computer Security Awareness” http://cern.ch/security Computer.Security@cern.ch Pierre Charrue (BE), Peter Jurcso (DSU), Brice Copy (EN), Folke Wallberg (FP), Timo Hakulinen (GS), Catharina Hoch (HR), Stefan Lüders (IT), Joel Closier (PH), Gustavo Segura (SC), Vittorio Remondino (TE) Peter Chochula (ALICE), Mike Capell (AMS), Giuseppe Mornacchi (ATLAS), Frans Meijers (CMS), Gerhart Mallot (COMPASS), Niko Neufeld (LHCb), Alberto Gianoli (NA62), Francesco Cafagna (TOTEM), Technical-Network Admins. More Information… CERN Computing Rules OC#5, subsidiary service rules & Computer Security information: Please report incidents to: Security contacts (Departments): Security contacts (Experiments):