Integrating Network Security into your Site

Transcription

1 Integrating Network Security into your Site Rich Pinder Los Angeles Cancer Surveillance Progra m [email protected] N A ACCR Annual Meeting Informatics: Methodology June 12, 2002 Toronto

2 O bjectives Big Picture thoughts on Security Co m ponents of organization wide security Rich s Top 10

3 Big Picture thoughts on Security Security - it s TO O co m plicated!!!

4 Doing nothing no longer acceptable. Its HUGE. But why not take itpiece meal? So mething BETTER than nothing! Little money? Few hours of the techies? Couple days time?? Hire a techie??? YOU CAN DO IT!!!

5 Start s m all go to the inform ational websites (look for.org and.gov sites) and search for getting started. D ecide w hich steps you can handle Consultants sources Attend local user groups - _nix Los Angeles costs ~ 100/hr

6 O bjectives Big Picture thoughts on Security Co mponents of organization wide security Rich s Top 10

7 Co mponents User authentication and environ m ent Filtering Port & Process control Fire walls Encryption VPN & Tunneling

8 User authentication and environ m ent Password protect ALL machines! One point login using to multiple system s can be dangerous (breach on weak machines obtains sam e password used on hardened machines). Long. Co mplex. Changing (???). Use password policy progra m s Bio metrics pro mises both higher security and easier use.

9 User authentication and environ m ent (cont) Environment User Training & Awareness Part of your annual confidentiality briefings Ramifications of bad practices User Accountability Commitment to compliance

10 Filtering Port & Process control C o ntrol the doors to your com p uters Should be done for all syste m s. Should be done for all ALL A L L major syste ms! Software to do this exists for your system (IPSec on WinNT/2k IPChains/IPTables on Linux) Rules: Inco ming O utgoing Forward.. For ALL start with D E N Y

11 Filtering Port & Process control (cont) Limit what s running on your co mputer KILL Unecessary Services! (watch default installs) Port Scans reports tell which doors open Threat assess ment goes one better tells you what s open, and what to D O about it. Even so m e Auto mated Mitigation software to take action on the threat assess ment report Co mputer Virus considered uncontrolled processes

12 Fire walls There are really no flames involved! Firewall is Centralized Filtering typically hardware and software solution. (Same software as we discussed for Filtering) Two NIC s pass through design Not a panacea! As soon as they re in place, requests to bypass them come in! M odifications can induce error.

13 Encryption Why send info in plain text when you can send it Encrypted? Pgp public key type encryption we ve heard about for a long tim e (GPG better alternative?) public key algorith m necessary to share with others with out knowing the key. But it s slow for highly efficient applications, still use sy m m etric based keys

14 Virtual Private Network (V P N) & Tunneling Defines a secure interconnected conduit between geographically separated system s Based on encryption Includes Filtering concepts Allows multiple (and future) applications to operate securely similar in concept to using your server at work Often imple mented to allow secure e mail and network access for ho me users

15 O bjectives Big Picture thoughts on Security Co m ponents of organization wide security Rich s Top 10

16 Top 10 M ake a security co m mitm ent to do so mething when you get ho me! Start a Security Procedures manual docu ment what you do. Do User Training & Authentication Hardening access control Don t use Telnet & Ftp. Get SSL enabled apps to substitute. (SSH, SCP) Use (and keep CURRE N T) virus control software (Sy mantec or McAffee) Encrypt ALL confidential data that you send fro m your organization. O S diligence upgrade m achines to at least windo ws NT. Install current patches. Docu ment. Consider using alternatives to Brother Bill s operating syste ms.

17 Top 10 R un vulnerability scanners (ie Nessus). Compare reports to the SA N S /FBI top 20 vulnerabilities list and be SURE to mitigate the biggies Port filtering Cheap: Install / configure IPSec for windo ws servers & IPChains or IPTables for Linux servers. Expensive: Do Cheap AND install dedicated Firewall machine. Router: Have your network folks be sure the routers and switches are configured properly Wireless? Secure the access point! (they com e initially wide open). If not implemented yet,look at b spec with W E P 2 security. D SL connections. Ho me lines use personal firewall software, or VPN if possible.

18 Security Resources SANS GREAT site w w.sans.org/ Syste m Ad ministration, Networking and Security - since 1989 SANS incident site: w.incidents.org/ Good starting place: w.sans.org/newlook/publications/road map.ht m Top 20 security issues: w w.sans.org/top20.htm Technical Tutorials w w.systemexperts.com /tutorial.html Hodgepodge tutorial..great for showing what OTHE R S are looking to do to get into your site. Good source of info: (not just for linux) w w.linuxsecurity.co m /

19 Security Resources (cont) G overn ment / U niversity inform ation sources National Security Agency w w.nsa.gov/isso/infosec Windows 2000 security guidelines, including actual.inf files that can be applied to deal with config / do main /ad min stuff CERT Carnegie melon Software Engineering Institute See the tech tips section sign up for mailing list National Infrastructure Protection Center w w.nipc.gov/ Co mputer Security Institute (CSI) w w.cisecurity.org Fee based - $250/yr (but som e good stuff for free)

20 Security Resources (cont) Filtering port and process control w w.nessus.org/ Nessus port scaner and threat assess ment tool w w.tinysoftware.co m relatively inexpensive - $39 for new version. Zonealar m has free version still but best versions around sa me price. Deerfield, Norton (Sy mantec), Black Ice, Zonealarm, Tiny Personal firewall all available w w.citadel.co m Hercules a threat mitigation tool Locating user groups Linux user groups: ww w.ssc.co m/glue Unix user groups: w w.netip.co m Keith Pal mgren page Check out Articles & Security links pages Virtual Private networks w w.vpnlabs.org see their Primers section how stuff works site good one.