1. WINS Monthly Meeting 5/7/2004 WINS Monthly Meeting 5/7/2004

2. Agenda Introductions Introductions Sasser Worm Sasser Worm SANS SANS SAN Presentation SAN Presentation Fortinet Garnet Valley Update Fortinet Garnet Valley Update Summer Activities Summer Activities Question & Answers Question & Answers

3. Introductions Name Name Title Title Location Location

4. Sasser Worm This self-executing worm spreads by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)] This self-executing worm spreads by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)] The worm spreads with the file name: avserve.exe. Unlike many recent worms, this virus does not spread via email. No user intervention is required to become infected or propagate the virus further. The worm works by instructing vulnerable systems to download and execute the viral code. The worm spreads with the file name: avserve.exe. Unlike many recent worms, this virus does not spread via email. No user intervention is required to become infected or propagate the virus further. The worm works by instructing vulnerable systems to download and execute the viral code. For manual protection, it may be advisable to block TCP ports 139, 445, 5554, and 9996 at network gateways. Patches highlighted in Microsoft Security Bulletin MS04-011 address the issue exploited by Sasser. For manual protection, it may be advisable to block TCP ports 139, 445, 5554, and 9996 at network gateways. Patches highlighted in Microsoft Security Bulletin MS04-011 address the issue exploited by Sasser.

5. SANS Disaster Recovery Disaster Recovery Server Back-up Server Back-up 30 servers and 500 GIG per district? 30 servers and 500 GIG per district? What can we afford? What can we afford? DAS – NAS – Fiber CH SAN – IP SAN DAS – NAS – Fiber CH SAN – IP SAN How to best use the district fiber backbone? How to best use the district fiber backbone?

6. SAN Presentation DCIU working with Dell Brent Bailey DCIU working with Dell Brent Bailey Brent will meet with me to discuss Brent will meet with me to discuss Tim Slattery of CNI introduced : Tim Slattery of CNI introduced : Lefthand Networks IP SAN Solution Lefthand Networks IP SAN Solution http://www.lefthandnetworks.com/index.php http://www.lefthandnetworks.com/index.php http://www.lefthandnetworks.com/index.php ePlus - Nick D'Archangelo Presents ePlus - Nick D'Archangelo Presents

7. Fortinet Garnet Valley Update Cutover unsuccessful due to port tagging config Cutover unsuccessful due to port tagging config Lab testing at Widener with Fortinet Lab testing at Widener with Fortinet Properly configured Fortigate to resolve tagging Properly configured Fortigate to resolve tagging Resolved Transparent Mode IP management Resolved Transparent Mode IP management Resolved Spanning Tree issues Resolved Spanning Tree issues Ready to return the week of the May 11 th Ready to return the week of the May 11 th Stay tuned!! Stay tuned!!

8. Summer Activities Nortel 8600 Upgrade Nortel 8600 Upgrade 64 M on CPU replaced with 256 M SIMM 64 M on CPU replaced with 256 M SIMM Software upgrade to 3.5.1 (now 3.2.1) Software upgrade to 3.5.1 (now 3.2.1) Shasta 3 rd Generation Testing Shasta 3 rd Generation Testing DCIU Sidewinder FW install ( today ) DCIU Sidewinder FW install ( today )

9. Questions & Answers Next Meeting Friday June 4th! Next Meeting Friday June 4th!