1. Information Technology at Emory Information Technology Division Technical Services IT Briefing Agenda 1/20/05 iCommand & Remedy Update SESA Overview & Demo Win ’98 Support OID Update & Demo Security Scan Demo NetCom (Wireless) Update Karen Jenkins Craig Myers Stu Lipkin Mark Parten Andy Efting Paul Petersen

2. Information Technology at Emory S ymantec E nterprise S ecurity A rchitecture Craig Myers ITD, Client Services Development

3. Information Technology at Emory Information Technology Division Technical Services Symantec Enterprise Security Architecture Presentation Outline Desktop Antivirus Managed Antivirus SESA Event Manager for AV SESA and Event Manager Diagrams and Demo Real-world Experiences by Derek Spransy

4. Information Technology at Emory Information Technology Division Technical Services AntiVirus Spring 2005 Symantec Antivirus Corporate Edition version 9.0.2.1000 Norton Antivirus for Macintosh (with “nonag”) version 9.0.3 (6)

5. Information Technology at Emory Information Technology Division Technical Services Managed AV Support thousands of PCs PCs get Virus Definitions from Server and/or via LiveUpdate Events are logged by the Parent Server Quick display of current versions, which definitions are in use, last scan performed and virus alerts. Can schedule scans without user being logged in. Can configure client settings per machine or by group. With Alert Management Service (AMS), can get email when a machine gets a virus. Lacks reporting ….

6. Information Technology at Emory Information Technology Division Technical Services Managed AV –Campus parent server available to departmental servers for updates –Virus definitions updated hourly via Intelligent Updates. –Investigating installing a managed faculty/staff server and/or student server to provide management to campus entities without a local managed AV server … thoughts?

7. Information Technology at Emory Information Technology Division Technical Services SESA Scalable solution that integrates multiple Symantec Security and third party products. Provides granular alerting of events. Query, filter and sort data for charting and reporting. Relatively new, still growing.

8. Information Technology at Emory Information Technology Division Technical Services SESA Architecture

9. Information Technology at Emory Information Technology Division Technical Services Event Manager for Antivirus SESA integration product. Enables centralized, cross-tier logging, alerting and reporting between the SESA event management system and Symantec Antivirus.

10. Information Technology at Emory Information Technology Division Technical Services SESA with Event Manager Collector on each parent AV server passes logged data to the SESA Manager via an Agent. The Manager stores the event data into the Data store. The Manager uses a directory to manage the devices, users and permissions. Access to the Manager is through a SESA console, which is java based. All SESA components are Java based except the Data store and Directory (Oracle and DB2).

11. Information Technology at Emory Information Technology Division Technical Services SESA DEMO

12. Information Technology at Emory Information Technology Division Technical Services SESA Requirements Prerequisites –Department must be running Symantec AV Server version 9 or better. –Must allow Java SDK 1.3.1_09 to be installed. –Departmental server must be win32-based (ie. Win2K, XP, 2003). –Must have a designated contact. ITD Responsibilities –Create an OU and an access account. –Provide on-site installation assistance. –Provide on-site training at the time of installation. Install and training take about 1 hour and does not require a server reboot.

13. Information Technology at Emory Information Technology Division Technical Services SESA Procedure ESR Form Method –Go to the Electronic Support Request (ESR) form. http://help.emory.eduhttp://help.emory.edu –Login using your campus id and password. –Select the General Emory Helpdesk. –Select the Request Type of General / Other. –Use "Please add my managed AV server to SESA. in the Additional Details box.

14. Information Technology at Emory Information Technology Division Technical Services SESA Procedure (cont.) Magic Method –Create a new incident using your name. –Set Subject to Software. –Enter "Please add my managed AV server to SESA." in the incident description. –Assign the call to EU_ITD_CLIENT_SERVICES_TIER_2 queue. Someone from CSD will respond to your request within three business days. We will verify the prerequisites and setup an installation time.

15. Information Technology at Emory Information Technology Division Technical Services SESA

16. Information Technology at Emory Client Services Update Stu Lipkin

17. Information Technology at Emory Information Technology Division Technical Services Discontinuing Support For Windows 98 and Mac OS 9 Mainstream support from MS ceased for these products June 30, 2002 and December 31, 2003. Fee-for-service extended support is available but no future development is planned for these products. Microsoft will only provide critical security updates for above products posted on the Windows Update web site. Hotfixes for non-critical updates will be available on request only. No further development and support for Mac OS 9.x is indicated from Apple. Mac OS 10.2 is the recommended platform for Apple computers.

18. Information Technology at Emory Information Technology Division Technical Services Windows 98 Support from Microsoft OPERATING SYSTEM Windows 98 Windows 98 SE Windows ME END OF SUPPORT June 30, 2002 December 31, 2003 Only paid incident support is available until December 31 2006. http://support.microsoft.com/default.aspx?scid=fh;[ln];LifeWin http://support.microsoft.com/gp/lifean1

19. Information Technology at Emory Information Technology Division Technical Services Proposed End of Support We propose to end support for Mac OS 9.x, Windows 98, 98 SE and Windows ME on May 31 st, 2005.

20. Information Technology at Emory Information Technology Division Technical Services Impact of discontinuation of stated OS support No phone or desktop support from ITD would be provided for customers running Win 98, Win 98 2nd ed., ME, Mac OS 9.x No support provided for ITD applications running on stated OS Development of installers would not be written for above OS Enterprise applications and continuing development would not need to consider the above OSes as included in the technical specifications

21. Information Technology at Emory Information Technology Division Technical Services Impact There should be no immediate effect on users. There is no immediate plan to change services so that they are incompatible with these Windows and Macintosh Operating Systems. Users should expect that newer applications introduced in the preceding months may not operate on older systems and may require Windows 2000 or Mac OS 10.2 or higher.

22. Information Technology at Emory Information Technology Division Technical Services Proposed Communication Plan present at IT Briefing January 2005 present at Desknet in January 2005 prepare announcement to end users mid-February post announcement in ER/Wheel February/March email to Local-l, All-emory, various Learnlink conferences (LL Demigods, SCC Technology, and Emory Announcements) last business day of Jan, Feb, Mar, Apr post on defined page on it.emory.edu/Desktop Computing

23. Information Technology at Emory Oracle Names to Oracle Internet Directory Mark Parten

24. Information Technology at Emory Self-Service Vulnerability Scanning A new service from your ITD Security Team

25. Information Technology at Emory Information Technology Division Technical Services Introduction Utilizes the Nessus Vulnerability Scanning Tool Specifically for use by System Administrators and Local Support Personnel Can scan both desktop and server machines Reports vulnerabilities and gives possible solutions / fixes

26. Information Technology at Emory Information Technology Division Technical Services Getting Started For more information on requesting the ability to do a Self-Service Scan, go to the following URL: http://it.emory.edu/showdoc.cfm?docid=4248 The ITD Security Team will work with System Administrators and Local Support Personnel to get them set up and scanning once a request has been received

27. Information Technology at Emory Information Technology Division Technical Services Overview Network Vulnerability Scanning Self-Service OverviewOverview :: FAQFAQ ITD Security offers Network Vulnerability Scanning Self-Service using Nessus from a centralized scanning server in the DMZ. To request the ability to scan your network, please send the following information to the security team at SecurityTeam-L@listserv.emory.edu:SecurityTeam-L@listserv.emory.edu 1. Name and organization you support 2. The IP address range on your network that you would like to scan 3. Phone number and e-mail address 4. Your network ID We will confirm this information, send a link for the latest Nessus scanning client, and provide a password to use when you connect to the system.

28. Information Technology at Emory Information Technology Division Technical Services How to Use GUI to connect to the Scanning Server Use network ID and Nessus password to authenticate Create scan session (which nodes, options, etc) Run scan, view results, create report

29. Information Technology at Emory Information Technology Division Technical Services Documentation Can be found at: http://www.nessus.org/documentation/

30. Information Technology at Emory Information Technology Division Technical Services Self-Service Scanning

31. Information Technology at Emory Information Technology Division Technical Services NetCom