CS460 Final Project Service Provider Scenario David Bergman Dong Jin Richard Bae Scott Greene Suraj Nellikar Wee Hong Yeo Virtual Customer: Mark Scifres

Introduction Scenario Overview Security Policies Design Overview Firewall Router CALEA

Scenario Overview Customer: CMOT, mid-level Internet service provider Goal of New Architecture Ease of use and low maintenance Comply with Rules-CALEA Limiting bad traffic from customers New profitable security services

Scenario Overview Requirements of ISP environment High uptime, Good quality Avoid Denial of Service (DOS) attack Customers Segmentation Protecting customers from other infected customers (virus, spam)‏ Preserving confidentiality of information among customers, and between customers and CMOT Protecting privacy

Security Policies Purpose is to protect assets customer personal information customer usage data company documents quality of service Guideline Recommended Internet Service Provider Security Services and Procedures

Security Policies How to prevent traffic taking unauthorized routes into or via your network? Are the networks that support your production services, your server customers, and your transit customers segmented? How to protect your Internet facing equipment providing production services from attacks such as Denial of Service attacks,break-ins or spoofing? Do you have a monitoring system that detects host and/or network attacks? How do you notify customers of security vulnerabilities in the services you provide?

Design Overview Client Hosts Cisco 2600 Routers Cisco PIX Firewall GatewayInternet DMZ (Servers)‏

Component - Firewall By default denies all incoming traffic, only permitted clients-initiated connections Protect the internal network from DOS attacks. Network Address Translation (NAT)‏ limited routable address exposed to the external world private addresses from a pool for the customers Prevent smurf attacks by dropping packets with unknown source ip Authenticate, authorize and account (AAA) users accessing servers in DMZ Disable source routing to prevent inside hosts from circumventing the firewall

Component - Router Vlans provide traffic isolation among hosts keep servers and the hosts separate prevent spreading of virus or attacking the internal network prevents packet sniffing from malicious users inside the network QoS provide different levels of service for the customers. Monitor bandwidth usage to detect if the tenants are running outside of their agreements

Component - Others Generates syslogs and store in a syslog server for monitoring purposes Provide wiretapping facility to adhere to CALEA Promptly apply security patches and updates on the network devices Ensure hosts have the latest antivirus softwares installed

CALEA CALEA Overview –Communication-Identifying Information (CII)  dialed digits (voice calls)‏  subject login (data)‏  network addresses (data)‏ –content of communications  audio content of voice call  packets to/from subject [source: Educause - Industry technical strategies, approaches and challenges associated with CALEA compliance (ID: NMD0613)]

CALEA Required Features Active interception and passive collection of both telephony and IP transmissions Data and voice interception High availability and backup mechanisms ETI Connect, SS8, Verint provide CALEA compliant solutions

CALEA Options we considered Active 'fingerprinting' of traffic Recording the IP addresses of every communication Our final decision included Record all MAC->IP allocations Record full traces at sample periods with short windows Allow access to LE for real-time sampling

April 20, 2006An Update on CALEA14 Cisco’s LI (Lawful Intercept) Architecture Source: ppt CALEA Implementation

Conclusion Scenario Overview Security Policies Design Overview Firewall Router CALEA

Questions?