Security Essentials for Desktop System Administrators.

Security Essentials for Desktop System Administrators

Civilization Is Made Of People …Civilization Is Made Of People …

Civilization is Risk.-- Not Big Brother

December 8, 2011December 8, 2011 Security Essentials for Desktop System AdministratorsSecurity Essentials for Desktop System Administrators 22

Dave Barry On Civilization …Dave Barry On Civilization …

New Technology Is Invented LargelyTo Overcome Previous "Advances"

Fields -> Trees -> Caves -> HousesFields -> Trees -> Caves -> Houses

Houses -> Windows -> GlassHouses -> Windows -> Glass

Glass -> Drapes -> Tents (in Fields!)Glass -> Drapes -> Tents (in Fields!)

Fireplaces -> Microwaves -> Bean BurritosFireplaces -> Microwaves -> Bean Burritos

Computer Security …Computer Security …

Essentially A People ProblemEssentially A People Problem

Internet

A Basic “People Problem”A Basic “People Problem”

Privacy

Internet

A Slightly More Precise ViewA Slightly More Precise View

Privacy

Blog Rants (tl;dr)

Bruce SchneierBruce Schneier

Once the technology is in place, there willalways be the temptation to use it ...

(Secrets and Lies, 2000)

Once the technology is in place, there willalways be the temptation to use it ...

(Secrets and Lies, 2000)

Technology

How Technology WorksHow Technology Works

SurprisingUses

Surprising Technology UseSurprising Technology Use

Surprising Technology Non-UseSurprising Technology Non-Use

MUDFLAPSSO I HERD U LIEK THEM

Surprising Technology UseSurprising Technology Use

Technology

Technology And RiskTechnology And Risk

SurprisingUses

Technology

Technology And RiskTechnology And Risk

SurprisingUses

MaliciousActivity*

* not to scale

Bruce SchneierBruce Schneier

And it is poor civic hygiene to installtechnologies that could somedayfacilitate a police state.

xkcd …xkcd …

… xkcd… xkcd

Dealing With RiskDealing With Risk

Recognize | Reduce | RecoverRecognize | Reduce | Recover

Dealing With RiskDealing With Risk

Recognizing RisksRecognizing Risks

High BandwidthEnormous StoragePosh .gov Location

Nothing Marketable

Nothing Marketable*

Caching warezSending SPAMSpreading malwareBeing/controlling botsCommitting/suffering DDoS attacks

Destruction Of DataWaste Of BandwidthWaste Of TimeFrustration

Default admin privsVisiting malicious sitesPromiscuous USB sharingLack of gruntlement

Newer ThreatsNewer Threats

CarrierIQ / mobile device surveillanceQR Code attacksCarrierIQ / mobile device surveillanceQR Code attacks

Newer ThreatsNewer Threats

Grace Hopper

Life was simple before World War II.After that we had systems.

TLAs for TCB: ISM? DID!TLAs for TCB: ISM? DID!

Integrated Security Management (ISM)

Defense In Depth (DID)

Integrated Security Management (ISM)

Defense In Depth (DID)

Reducing Risks: DIDReducing Risks: DID

Perimeter ControlsAuto-blockingMail virus scanningCentral Authentication (via LDAP/Kerberos)

Reducing Risks: DIDReducing Risks: DID

Patch and configuration mgmtCritical VulnerabilitiesPrompt response via FCIRTIntelligent and informed usersGeneral and special enclaves

Recognizing Risks: ISMRecognizing Risks: ISM

Computer Security not an add-onNot “one size fits all”Largely common sense

Reducing Risks: ISMReducing Risks: ISM

Primary passwords off the netSingle turn-off pointNo visible services without Strong AuthenticationLab systems scanned for compliance

Recovery: ISMRecovery: ISM

General Computer Security Coordinators (Listed at http://security.fnal.gov/ )Work with Computer Security TeamDisseminate informationDeal with incidents

What About Us Users?What About Us Users?

Malicious Surprises aboundUse reasonable cautionMalicious Surprises aboundUse reasonable caution

Users: We Get MailUsers: We Get Mail

You haven’t won $10MDon’t open (most) attachmentsBest not to click links in mailDisable scripting for mail

Users: We Get MailUsers: We Get Mail

Can you trust the (so-called) sender?Can you trust the (so-called) sender?Received: from [123.28.41.241] (unknown [123.28.41.241]) by hepa1.fnal.gov (Postfix) with ESMTP id 808F76F247 for <baisley@fnal.gov>; Thu, 01 Apr 2010 09:41:02 -0500 (CDT)From: Wayne E Baisley <baisley@fnal.gov>To: Wayne E Baisley <baisley@fnal.gov>

route: 123.28.32.0/19descr: VietNam Post and Telecom Corporation (VNPT)address: Lo IIA Lang Quoc te Thang Long, Cau Giay, Ha Noi

Can you trust the (so-called) sender?Can you trust the (so-called) sender?Received: from [123.28.41.241] (unknown [123.28.41.241]) by hepa1.fnal.gov (Postfix) with ESMTP id 808F76F247 for <baisley@fnal.gov>; Thu, 01 Apr 2010 09:41:02 -0500 (CDT)From: Wayne E Baisley <baisley@fnal.gov>To: Wayne E Baisley <baisley@fnal.gov>

route: 123.28.32.0/19descr: VietNam Post and Telecom Corporation (VNPT)address: Lo IIA Lang Quoc te Thang Long, Cau Giay, Ha Noi

Users: Pass the WordUsers: Pass the Word

Use strong passwords Longer is betterUse different passwords Or variants, at least

Royko any social engineering attemptsRoyko any social engineering attempts

Users: DataUsers: Data

Decide what data requires protectionHow to be recovered, if neededArrange backups with SysadminsOr do your own backupsOccasionally test retrieval

The Incidental ComputistThe Incidental Computist

Some non-Lab-business Surprising Use is allowed:

http://security.fnal.gov/ProperUse.htm (I prefer personal iPhone/iPad/Droid

via an external network …)

Some non-Lab-business Surprising Use is allowed:

http://security.fnal.gov/ProperUse.htm (I prefer personal iPhone/iPad/Droid

via an external network …)

Activities to AvoidActivities to Avoid

Services like Skype and BitTorrentnot forbidden but very easy to misuse!Services like Skype and BitTorrentnot forbidden but very easy to misuse!

Activities to AvoidActivities to Avoid

Anything that:Is illegalIs prohibited by Lab/DOE policyMay embarrass the LabInterferes with job performanceConsumes excessive resources

Which Brings Us To SysadminsWhich Brings Us To Sysadmins

That wrench ain’t gonna swing itself.That wrench ain’t gonna swing itself.

Sysadmins Get Risk-RoledSysadmins Get Risk-Roled

System manager for securityAssist and instruct users to do it rightVigilant observer of your systems (and sometimes users’) behavior

NOISE, n.NOISE, n.

…The chief product and authenticatingsign of civilization.

Ambrose Bierce, The Devil’s Dictionary

…The chief product and authenticatingsign of civilization.

Ambrose Bierce, The Devil’s Dictionary

Data PrivacyData Privacy

Generally, Fermilab respects privacyYou are required to do likewiseSpecial cases for Sysadmins during Security IncidentsOthers must have Directorate approval

Privacy of Email and FilesPrivacy of Email and Files

May not use information in anotherperson’s files seen incidental to anyactivity (legitimate or not) for any

purpose w/o explicit permission of theowner or “reasonable belief the file

was meant to be accessed by others.”

May not use information in anotherperson’s files seen incidental to anyactivity (legitimate or not) for any

purpose w/o explicit permission of theowner or “reasonable belief the file

was meant to be accessed by others.”

Offensive MaterialsOffensive Materials

Material on computer ≈ Material on deskA line management concernNot a computer security issue per se

Software LicensingSoftware Licensing

Fermilab is strongly committed torespecting intellectual property rights.Use of unlicensed commercial software

is a direct violation of lab policy.

Fermilab is strongly committed torespecting intellectual property rights.Use of unlicensed commercial software

is a direct violation of lab policy.

Patch/Configuration ManagementPatch/Configuration Management

Baselines: Linux, Mac, WindowsAll systems must meet their baselineAll systems must be regularly patchedNon-essential services offWindows, especially, must run AV

Patch/Configuration ManagementPatch/Configuration Management

Exceptions/Exemptions: Documented case why OS is “stuck” Patch and manage as securely

Critical VulnerabilitiesCritical Vulnerabilities

Active exploits declared criticalPose a clear and present dangerMust patch by a given date or be blockedHandled via TIssue events

Computer Security IncidentsComputer Security Incidents

Report suspicious events to x2345 or computer_security@fnal.govFollow FCIRT instructions during incidentsKeep infected machines off the networkPreserve system for expert investigationNot to be discussed!

FCIRTFCIRT

Triage initial reportsCoordinate investigationWork with local Sysadmins, expertsMay take control of affected systemsMaintain confidentiality

Mandatory Sysadmin RegistrationMandatory Sysadmin Registration

All Sysadmins must be registeredPrimary Sysadmin is responsible for configuring and patchinghttp://security.fnal.gov -> “Verify your node registration”

Do Not Want: Prohibited ActivitiesDo Not Want: Prohibited Activities

Blatant disregard of computer securityUnauthorized or malicious actionsUnethical behaviorRestricted central servicesSecurity & cracker toolshttp://security.fnal.gov/policies/cpolicy.html

We Want To Avoid This …We Want To Avoid This …

Role of SysadminsRole of Sysadmins

Manage your systems sensibly, securelyServices comply with Strong Auth rulesReport potential incidents to FCIRTAct on relevant bulletinsKeep your eyes open

We Can Do It …We Can Do It …

We Can Do It. Statistically.We Can Do It. Statistically.

Questions?Questions?

nightwatch@fnal.govfor questions about security policy

computer_security@fnal.govfor reporting security incidents

http://security.fnal.gov/

nightwatch@fnal.govfor questions about security policy

computer_security@fnal.govfor reporting security incidents

http://security.fnal.gov/

Security Essentials for Desktop System Administrators

Security Essentials for Desktop System Administrators.

Documents

Transcript of Security Essentials for Desktop System Administrators.

COURSE MAPPING - TestOut · 1 TestOut Office Pro to Desktop Pro Course Mapping Office Pro 6.0 Desktop Pro 4.1 1.0 ONLINE ESSENTIALS 1.1 The Information Age 1.1.1 Introduction to Desktop

CERTIFICATIONS IN THE UK - Cyber Security and Legal IT Event … · Cyber Essentials and Cyber Essentials Plus certifications. With our mobile and desktop apps, the questionnaire

Personnel Essentials Presented by V. Wayne Young Executive Director and General Counsel Kentucky Association of School Administrators November 2008.

COURSE MAPPING · 1 TestOut Office Pro to Desktop Pro Course Mapping Office Pro 6.0 Desktop Pro 4.1 1.0 ONLINE ESSENTIALS 1.1 The Information Age 1.1.1 Introduction to Desktop Computer

Augmenting VMware View Horizon (VDI) with Micro … Requirements . . . . . . . . . . . ... administrators to deploy virtual desktop images on machines running Windows XP, Windows Vista,

Security Essentials for Desktop System Administrors.

Security Essentials for Desktop System Administrators

Proofpoint Essentials Administrator Guide for End …Essentials)Administrator)Guide)for)End)Customers User&Access&& It is currently accepted by the vast majority of administrators

The LIFELONG LEARNING REGISTRY: Essentials for District ... › sites › default › files › 2019-10 › LifelongLearnin… · Lifelong Learning Registry (LLR) Administrators are

HOW TO AVOID THE 7 DEADLY SINS OF APP AND DESKTOP VIRTUALIZATION · 2020-03-23 · many IT administrators have learned, there’s a catch: The benefits of desktop and app virtualization

Getting Started with ArcGIS Pro Pro Essentials for ArcMap Users... · ArcGIS Desktop Desktop Web Device Server Online Content and Services Portal ArcMap ArcCatalog ArcScene ArcGlobe

Apple Remote Destkop · 2009-08-01 · Apple Remote Desktop is easy-to-use, powerful, desktop management software for all your networked Macs. System administrators can remotely control

Essentials Virtual Desktop EN ESPAÑOL.

Proofpoint Essentials Administrator Guide · About this Guide This guide introduces Proofpoint Essentials, ... The Administration Console provides tools that help service administrators

ClassLink Presents Desktop Virtualization using …utilizing multiple grade types (such as Knowledge, Skill, Daily Work Ethics, and Professional Development), ClassMate provides administrators

Court Administrators Seminar - TMCEC · and personnel in municipal court. Presentations and materials will cover management essentials, presentation skills, and development of strong

PLCS & THE CONNECTION TO RESPONSE TO INTERVENTION Essentials for Administrators Sept. 27, 2012.

visionapp Remote Desktop (vRD) Remote Desktop (vRD) ... you can tailor visionapp Remote Desktop to your individual ... > In database mode, administrators can work simultaneously with

Salesforce CPQ Admin Essentials for Experienced Administrators

Security Essentials for Desktop System Administrors