Security Essentials for Desktop System Administrators.

Security Essentials for Desktop System Administrators


Civilization Is Made Of People …Civilization Is Made Of People …

Civilization is Risk.-- Not Big Brother

Civilization is Risk.-- Not Big Brother

December 8, 2011December 8, 2011 Security Essentials for Desktop System AdministratorsSecurity Essentials for Desktop System Administrators 22

Dave Barry On Civilization …Dave Barry On Civilization …

New Technology Is Invented LargelyTo Overcome Previous "Advances"

New Technology Is Invented LargelyTo Overcome Previous "Advances"



Fields -> Trees -> Caves -> HousesFields -> Trees -> Caves -> Houses



Houses -> Windows -> GlassHouses -> Windows -> Glass



Glass -> Drapes -> Tents (in Fields!)Glass -> Drapes -> Tents (in Fields!)



Fireplaces -> Microwaves -> Bean BurritosFireplaces -> Microwaves -> Bean Burritos



-> ->


Computer Security …Computer Security …

Essentially A People ProblemEssentially A People Problem


Internet

A Basic “People Problem”A Basic “People Problem”


Privacy

Internet

A Slightly More Precise ViewA Slightly More Precise View


Privacy

Blog Rants (tl;dr)

Bruce SchneierBruce Schneier

Once the technology is in place, there willalways be the temptation to use it ...

(Secrets and Lies, 2000)

Once the technology is in place, there willalways be the temptation to use it ...

(Secrets and Lies, 2000)


Technology

How Technology WorksHow Technology Works


SurprisingUses

Surprising Technology UseSurprising Technology Use


Surprising Technology Non-UseSurprising Technology Non-Use


MUDFLAPSSO I HERD U LIEK THEM

MUDFLAPSSO I HERD U LIEK THEM

Surprising Technology UseSurprising Technology Use


Technology

Technology And RiskTechnology And Risk


SurprisingUses

Technology

Technology And RiskTechnology And Risk


SurprisingUses

MaliciousActivity*

* not to scale

Bruce SchneierBruce Schneier

And it is poor civic hygiene to installtechnologies that could somedayfacilitate a police state.

And it is poor civic hygiene to installtechnologies that could somedayfacilitate a police state.


xkcd …xkcd …


… xkcd… xkcd


Dealing With RiskDealing With Risk

Recognize | Reduce | RecoverRecognize | Reduce | Recover


Dealing With RiskDealing With Risk


Recognizing RisksRecognizing Risks

High BandwidthEnormous StoragePosh .gov Location

Nothing Marketable


Nothing Marketable




Nothing Marketable*


Nothing Marketable*



Caching warezSending SPAMSpreading malwareBeing/controlling botsCommitting/suffering DDoS attacks

Caching warezSending SPAMSpreading malwareBeing/controlling botsCommitting/suffering DDoS attacks



Destruction Of DataWaste Of BandwidthWaste Of TimeFrustration

Destruction Of DataWaste Of BandwidthWaste Of TimeFrustration



Default admin privsVisiting malicious sitesPromiscuous USB sharingLack of gruntlement

Default admin privsVisiting malicious sitesPromiscuous USB sharingLack of gruntlement


Newer ThreatsNewer Threats

CarrierIQ / mobile device surveillanceQR Code attacksCarrierIQ / mobile device surveillanceQR Code attacks


Newer ThreatsNewer Threats


Grace Hopper

Grace Hopper

Life was simple before World War II.After that we had systems.

Life was simple before World War II.After that we had systems.


TLAs for TCB: ISM? DID!TLAs for TCB: ISM? DID!

Integrated Security Management (ISM)

Defense In Depth (DID)

Integrated Security Management (ISM)

Defense In Depth (DID)


Reducing Risks: DIDReducing Risks: DID

Perimeter ControlsAuto-blockingMail virus scanningCentral Authentication (via LDAP/Kerberos)

Perimeter ControlsAuto-blockingMail virus scanningCentral Authentication (via LDAP/Kerberos)


Reducing Risks: DIDReducing Risks: DID

Patch and configuration mgmtCritical VulnerabilitiesPrompt response via FCIRTIntelligent and informed usersGeneral and special enclaves

Patch and configuration mgmtCritical VulnerabilitiesPrompt response via FCIRTIntelligent and informed usersGeneral and special enclaves


Recognizing Risks: ISMRecognizing Risks: ISM

Computer Security not an add-onNot “one size fits all”Largely common sense

Computer Security not an add-onNot “one size fits all”Largely common sense


Reducing Risks: ISMReducing Risks: ISM

Primary passwords off the netSingle turn-off pointNo visible services without Strong AuthenticationLab systems scanned for compliance

Primary passwords off the netSingle turn-off pointNo visible services without Strong AuthenticationLab systems scanned for compliance


Recovery: ISMRecovery: ISM

General Computer Security Coordinators (Listed at http://security.fnal.gov/ )Work with Computer Security TeamDisseminate informationDeal with incidents

General Computer Security Coordinators (Listed at http://security.fnal.gov/ )Work with Computer Security TeamDisseminate informationDeal with incidents


What About Us Users?What About Us Users?

Malicious Surprises aboundUse reasonable cautionMalicious Surprises aboundUse reasonable caution


Users: We Get MailUsers: We Get Mail

You haven’t won $10MDon’t open (most) attachmentsBest not to click links in mailDisable scripting for mail

You haven’t won $10MDon’t open (most) attachmentsBest not to click links in mailDisable scripting for mail


Users: We Get MailUsers: We Get Mail

Can you trust the (so-called) sender?Can you trust the (so-called) sender?Received: from [123.28.41.241] (unknown [123.28.41.241]) by hepa1.fnal.gov (Postfix) with ESMTP id 808F76F247 for <[email protected]>; Thu, 01 Apr 2010 09:41:02 -0500 (CDT)From: Wayne E Baisley <[email protected]>To: Wayne E Baisley <[email protected]>

route: 123.28.32.0/19descr: VietNam Post and Telecom Corporation (VNPT)address: Lo IIA Lang Quoc te Thang Long, Cau Giay, Ha Noi

Can you trust the (so-called) sender?Can you trust the (so-called) sender?Received: from [123.28.41.241] (unknown [123.28.41.241]) by hepa1.fnal.gov (Postfix) with ESMTP id 808F76F247 for <[email protected]>; Thu, 01 Apr 2010 09:41:02 -0500 (CDT)From: Wayne E Baisley <[email protected]>To: Wayne E Baisley <[email protected]>

route: 123.28.32.0/19descr: VietNam Post and Telecom Corporation (VNPT)address: Lo IIA Lang Quoc te Thang Long, Cau Giay, Ha Noi


Users: Pass the WordUsers: Pass the Word

Use strong passwords Longer is betterUse different passwords Or variants, at least

Use strong passwords Longer is betterUse different passwords Or variants, at least


Royko any social engineering attemptsRoyko any social engineering attempts


Users: DataUsers: Data

Decide what data requires protectionHow to be recovered, if neededArrange backups with SysadminsOr do your own backupsOccasionally test retrieval

Decide what data requires protectionHow to be recovered, if neededArrange backups with SysadminsOr do your own backupsOccasionally test retrieval


The Incidental ComputistThe Incidental Computist

Some non-Lab-business Surprising Use is allowed:

http://security.fnal.gov/ProperUse.htm (I prefer personal iPhone/iPad/Droid

via an external network …)

Some non-Lab-business Surprising Use is allowed:

http://security.fnal.gov/ProperUse.htm (I prefer personal iPhone/iPad/Droid

via an external network …)


Activities to AvoidActivities to Avoid

Services like Skype and BitTorrentnot forbidden but very easy to misuse!Services like Skype and BitTorrentnot forbidden but very easy to misuse!


Activities to AvoidActivities to Avoid

Anything that:Is illegalIs prohibited by Lab/DOE policyMay embarrass the LabInterferes with job performanceConsumes excessive resources

Anything that:Is illegalIs prohibited by Lab/DOE policyMay embarrass the LabInterferes with job performanceConsumes excessive resources


Which Brings Us To SysadminsWhich Brings Us To Sysadmins

That wrench ain’t gonna swing itself.That wrench ain’t gonna swing itself.


Sysadmins Get Risk-RoledSysadmins Get Risk-Roled

System manager for securityAssist and instruct users to do it rightVigilant observer of your systems (and sometimes users’) behavior

System manager for securityAssist and instruct users to do it rightVigilant observer of your systems (and sometimes users’) behavior


NOISE, n.NOISE, n.

…The chief product and authenticatingsign of civilization.

Ambrose Bierce, The Devil’s Dictionary

…The chief product and authenticatingsign of civilization.

Ambrose Bierce, The Devil’s Dictionary


Data PrivacyData Privacy

Generally, Fermilab respects privacyYou are required to do likewiseSpecial cases for Sysadmins during Security IncidentsOthers must have Directorate approval

Generally, Fermilab respects privacyYou are required to do likewiseSpecial cases for Sysadmins during Security IncidentsOthers must have Directorate approval


Privacy of Email and FilesPrivacy of Email and Files

May not use information in anotherperson’s files seen incidental to anyactivity (legitimate or not) for any

purpose w/o explicit permission of theowner or “reasonable belief the file

was meant to be accessed by others.”

May not use information in anotherperson’s files seen incidental to anyactivity (legitimate or not) for any

purpose w/o explicit permission of theowner or “reasonable belief the file

was meant to be accessed by others.”


Offensive MaterialsOffensive Materials

Material on computer ≈ Material on deskA line management concernNot a computer security issue per se

Material on computer ≈ Material on deskA line management concernNot a computer security issue per se


Software LicensingSoftware Licensing

Fermilab is strongly committed torespecting intellectual property rights.Use of unlicensed commercial software

is a direct violation of lab policy.

Fermilab is strongly committed torespecting intellectual property rights.Use of unlicensed commercial software

is a direct violation of lab policy.


Patch/Configuration ManagementPatch/Configuration Management

Baselines: Linux, Mac, WindowsAll systems must meet their baselineAll systems must be regularly patchedNon-essential services offWindows, especially, must run AV

Baselines: Linux, Mac, WindowsAll systems must meet their baselineAll systems must be regularly patchedNon-essential services offWindows, especially, must run AV


Patch/Configuration ManagementPatch/Configuration Management

Exceptions/Exemptions: Documented case why OS is “stuck” Patch and manage as securely

Exceptions/Exemptions: Documented case why OS is “stuck” Patch and manage as securely


Critical VulnerabilitiesCritical Vulnerabilities

Active exploits declared criticalPose a clear and present dangerMust patch by a given date or be blockedHandled via TIssue events

Active exploits declared criticalPose a clear and present dangerMust patch by a given date or be blockedHandled via TIssue events


Computer Security IncidentsComputer Security Incidents

Report suspicious events to x2345 or [email protected] FCIRT instructions during incidentsKeep infected machines off the networkPreserve system for expert investigationNot to be discussed!

Report suspicious events to x2345 or [email protected] FCIRT instructions during incidentsKeep infected machines off the networkPreserve system for expert investigationNot to be discussed!


FCIRTFCIRT

Triage initial reportsCoordinate investigationWork with local Sysadmins, expertsMay take control of affected systemsMaintain confidentiality

Triage initial reportsCoordinate investigationWork with local Sysadmins, expertsMay take control of affected systemsMaintain confidentiality


Mandatory Sysadmin RegistrationMandatory Sysadmin Registration

All Sysadmins must be registeredPrimary Sysadmin is responsible for configuring and patchinghttp://security.fnal.gov -> “Verify your node registration”

All Sysadmins must be registeredPrimary Sysadmin is responsible for configuring and patchinghttp://security.fnal.gov -> “Verify your node registration”


Do Not Want: Prohibited ActivitiesDo Not Want: Prohibited Activities

Blatant disregard of computer securityUnauthorized or malicious actionsUnethical behaviorRestricted central servicesSecurity & cracker toolshttp://security.fnal.gov/policies/cpolicy.html

Blatant disregard of computer securityUnauthorized or malicious actionsUnethical behaviorRestricted central servicesSecurity & cracker toolshttp://security.fnal.gov/policies/cpolicy.html


We Want To Avoid This …We Want To Avoid This …


Role of SysadminsRole of Sysadmins

Manage your systems sensibly, securelyServices comply with Strong Auth rulesReport potential incidents to FCIRTAct on relevant bulletinsKeep your eyes open

Manage your systems sensibly, securelyServices comply with Strong Auth rulesReport potential incidents to FCIRTAct on relevant bulletinsKeep your eyes open


We Can Do It …We Can Do It …


We Can Do It. Statistically.We Can Do It. Statistically.


Questions?Questions?

[email protected] questions about security policy

[email protected] reporting security incidents

http://security.fnal.gov/

[email protected] questions about security policy

[email protected] reporting security incidents

http://security.fnal.gov/


Security Essentials for Desktop System Administrators.

Documents

Transcript of Security Essentials for Desktop System Administrators.