1. 1 University of WashingtonComputing & Communications CAMPUS NETWORKING & SECURITY UPDATE Terry Gray 16 Dec 2004

2. 2 University of WashingtonComputing & Communications AGENDA 1. Campus Wireless Initiative 2. Project 172 with NAT 3. TippingPoint Intrusion Prevention System 4. Logical Firewall Enhancements 5. C&C Managed Firewall Services 6. UTAC Minimum CompSec Standards project 7. Campus Risk Management Assessment

3. 3 University of WashingtonComputing & Communications Campus Wireless Initiative UTAC and Provost Initiative: 3yr roll-out Funded by Provost, Departments, and STF Goals: –24x7 managed wireless infrastructure –Consistent access control model –Funding model includes ops/upgrade costs Status: –Endorsed by UTAC, ATAC, BoD, Provost, etc. –Official announcement from Provost in January –ATAC setting deployment priorities –C&C working on deployment plan

4. 4 University of WashingtonComputing & Communications Project 172 with NAT Required border router upgrade, now complete Currently in beta with law school and C&C Plan to enable across the net "soon” Phase-out web proxy server? Contact: CustomerCare@CaC

5. 5 University of WashingtonComputing & Communications TippingPoint Intrusion Prevention System Advantages: –Avoids "should we or shouldn't we" block debates –TP filters catch all variants of exploit Goals: –Not a substitute for proper host management –Improve S/N ratio of internal IDS logs –Buy time for certain kinds of attacks Outside: dialin, wireless, dorms, & alas, UWB Status: –Testing successful (modulo HDD failure) –Not yet in final configuration –Started blocking spyware this week

6. 6 University of WashingtonComputing & Communications Logical Firewall Enhancements New LFW option: Tiny subnets, one per host, to block or filter intra-workgroup traffic Can use for smallish PPTP VPN deployments Uptime example: 406 days (since OS upgrade) Using bridging variation for med-ctr FW pilot Using same model for C&C-managed firewalls...say what??

7. 7 University of WashingtonComputing & Communications C&C Managed Firewall Services Ironies abound :) Inline subnet-perimeter firewall option Adjunct to LFW and P172 options Goal: meet special security needs while still letting us manage network core end-to-end Anti-goal: still not a substitute for managed hosts Two flavors –Basic (one time fee) –Custom (monthly fee) Contact: CustomerCare@CaC

8. 8 University of WashingtonComputing & Communications UTAC Minimum CompSec Standards UTAC-chartered sub-committee: PASSC, reps from ATAC, OR, FacSenate Builds on: UW Security Policy Only one piece: also need InfoSec std and BPs Audience: Users, Owners, SysAds Initial proposal submitted to UTAC UTAC authorized 30-day campus review

9. 9 University of WashingtonComputing & Communications Details... Scope: computing devices (not info) –UW-owned or not –attached to UW net –or connecting to non-public UW resources Essence: –host-firewall or equivalent –disable unneeded services –auto-update if avail, or equivalent –active malware mitigation –don't install anything that exposes non-pub info

10. 10 University of WashingtonComputing & Communications Enterprise Security Risk Assessment PASS Council initiative Based on workshops led by UW Risk Mgt Office Goal: identify high-likelihood, high-impact risks Biggie: “under-managed” computers Seeking incident data from y’all Contact: passc@u

11. 11 University of WashingtonComputing & Communications Questions/Comments?