How to Create an IT How to Create an IT Security ProgramSecurity Program

Tracy MitranoTracy MitranoSteve SchusterSteve SchusterR. David VernonR. David Vernon

Copyright Tracy Mitrano, Steven Schuster and David Vernon, 2004. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

OutlineOutline

History History The policy componentThe policy component Security office todaySecurity office today

Setting the StageSetting the Stage

Why worry?Why worry? Increased reliance on IT to support the Increased reliance on IT to support the

teaching, research and business teaching, research and business functions of Cornellfunctions of Cornell

Nature of the IT tools being usedNature of the IT tools being used Operating systemsOperating systems Cornell as an ISPCornell as an ISP IP networksIP networks Vast application suites Vast application suites

Why Worry …Why Worry …

National scrutinyNational scrutiny Post 9/11Post 9/11

Recording industry / copyright issuesRecording industry / copyright issues Higher education as a “scapegoat” …Higher education as a “scapegoat” … Peer pressure (Educause, I2, University Peer pressure (Educause, I2, University

presidents …)presidents …) HIPAA, FERPA … HIPAA, FERPA … General liability specter of changing lawsGeneral liability specter of changing laws And, of course, increase in attacks …And, of course, increase in attacks …

What do Our Peers Think a What do Our Peers Think a Security Program Should Security Program Should

Do?Do?

Surveyed Members of the Common Surveyed Members of the Common Solution group.Solution group. R1 / Ivy …R1 / Ivy …

What are your “top 10” Information What are your “top 10” Information Technology Security service needs?Technology Security service needs?

1) Information Technology 1) Information Technology Security Audits / Security Audits /

AssessmentsAssessments Vulnerability scanning Vulnerability scanning System hardware and application System hardware and application

architecture reviewarchitecture review Patch statusPatch status Open E-mail relay notificationOpen E-mail relay notification

2) Information Technology 2) Information Technology Security Tool Provisioning Security Tool Provisioning

Virus software distribution Virus software distribution Firewall software distribution / firewall Firewall software distribution / firewall

hardware provisioninghardware provisioning Custom security tool kit developmentCustom security tool kit development Secure network (VPN) servicesSecure network (VPN) services Secure machine room services (Collocation)Secure machine room services (Collocation) Central E-mail filtering (Spam and virus)Central E-mail filtering (Spam and virus)

3) Incident Response3) Incident Response

Coordination and information Coordination and information dissemination dissemination Internal & external partiesInternal & external parties

Damage control / isolation Damage control / isolation Forensic analysisForensic analysis ResolutionResolution Post incident reviewPost incident review

4) 4) Information Technology Information Technology Security AwarenessSecurity Awareness

Classes / TrainingClasses / Training TechnicalTechnical ExecutiveExecutive General patronGeneral patron

Publications (Online and paper)Publications (Online and paper) SpeakersSpeakers Alerts: – virus / worm notifications.Alerts: – virus / worm notifications. ConsultingConsulting

TechnicalTechnical ExecutiveExecutive

5) Intrusion Detection5) Intrusion Detection

Network monitoringNetwork monitoring Network and central application Network and central application

log examination log examination

6) Authentication / 6) Authentication / Authorization Services Authorization Services

Certificate signing / authorityCertificate signing / authority Cryptographic key handling / Cryptographic key handling /

escrowescrow Access controlAccess control

7) Information Technology 7) Information Technology Policy Enforcement and Policy Enforcement and

Abuse Response.Abuse Response. Copyright infringement notificationCopyright infringement notification Response to abuse of applications / Response to abuse of applications /

hardware hardware Authority to enforce policy via Authority to enforce policy via

technical means and university technical means and university governancegovernance Formalized liaison role with legal / Formalized liaison role with legal /

and select university authorities. and select university authorities.

And Finally -And Finally -

8) Security Related Internet 8) Security Related Internet Standards WorkStandards Work

9) Information Technology Policy 9) Information Technology Policy DevelopmentDevelopment

10) Contingency Planning10) Contingency Planning Disaster recoveryDisaster recovery

Business continuity Business continuity

Within CornellWithin Cornell

List is not unexpectedList is not unexpected Nice outline of ideal service scopeNice outline of ideal service scope However what is “obvious” is not However what is “obvious” is not

always simple …always simple … Nature of Cornell’s decentralized control Nature of Cornell’s decentralized control

of ITof IT Nature of IT technologyNature of IT technology Budget constraints, etcBudget constraints, etc Demand for new servicesDemand for new services

Cornell GuidanceCornell Guidance

Security TaskforceSecurity Taskforce Charged by VP of ITCharged by VP of IT Examine current structures and Examine current structures and

recommend changes if needed.recommend changes if needed. Members included:Members included:

JA, CU Police, Legal Council,JA, CU Police, Legal Council, Audit Office, Audit Office, Financial systems, Policy advisor, FABIT, CCD’s, Financial systems, Policy advisor, FABIT, CCD’s, Planning Information & Policy Analysis, OIT and Planning Information & Policy Analysis, OIT and CIT.CIT.

Taskforce Concluded Taskforce Concluded

Create an Information Technologies Create an Information Technologies Security Office Security Office

Appoint an Information Technologies Appoint an Information Technologies Security Officer to direct the ITSO Security Officer to direct the ITSO

Merge CIT virus, abuse and security Merge CIT virus, abuse and security functions under the ITSO functions under the ITSO

Office would be charged to …Office would be charged to …

•Be the locus of information technology security at Cornell. •Have formal authority to act on the University’s behalf to assure adoption of relevant University Policy and appropriate response to IT threats that could act to violate University policies or laws.

•Identify campus-wide IT security needs.

•Act to coordinate campus-wide information technology security services. •Provide proactive services, such as education and monitoring for network anomalies. •Provide reactive services, such as incident response and damage control.

•Enable coordinated response from key University agents, such as Cornell Police, Audit, JA, Legal Counsel and other related parties.

•Act as an interface with external agents, such as local, state and federal law enforcement.

•Work in close partnership with campus agents responsible for policy and infrastructure development.

•Work to optimize institutional investment in IT tools to assure broad utility, such as authentication, authorization and encryption applications.

•Be a diplomatic liaison to assure best response from within a highly decentralized campus.

RecapRecap

Security LocusSecurity Locus CollaborativeCollaborative PartneringPartnering ProactiveProactive EducatingEducating Diplomat – (But with just enough Diplomat – (But with just enough

“teeth”…)“teeth”…)

However What is “Obvious” However What is “Obvious” is Not Always Simple – is Not Always Simple –

Revisited.Revisited. GivenGiven

Limited resourcesLimited resources Smart independent departmentsSmart independent departments Workforce planningWorkforce planning Nature of IP, poor default OS security, E-mail ...Nature of IP, poor default OS security, E-mail ... National pressures National pressures And a strong desire not to “throw the baby out And a strong desire not to “throw the baby out

with the bathwater.”with the bathwater.” What do we do?What do we do?

First StepsFirst Steps

Taskforce perspective is correctTaskforce perspective is correct Hire a director!Hire a director!

““Top Ten” list as a service targetTop Ten” list as a service target Triage – identify areas of greatest risksTriage – identify areas of greatest risks Form guidance groupsForm guidance groups

ExecutiveExecutive Taskforce members Taskforce members

OperationalOperational Technical talent throughout CornellTechnical talent throughout Cornell

First Steps Continued …First Steps Continued …

Work within the Cornell policy process to Work within the Cornell policy process to identify the balance between evasive identify the balance between evasive control and users expectations for privacy control and users expectations for privacy and open access.and open access.

Leverage national relationshipsLeverage national relationships Computer Policy and LawComputer Policy and Law I2/ Educause I2/ Educause Other national resources (CERT…)Other national resources (CERT…)

First Steps Continued …First Steps Continued …

Embrace the notion of desktop Embrace the notion of desktop stewardshipstewardship Principle problem at Cornell todayPrinciple problem at Cornell today Assume that the Internet is and will Assume that the Internet is and will

always be insecurealways be insecure Story of CIT and desktop stewardshipStory of CIT and desktop stewardship

Oh Yes, and …Oh Yes, and …

P2P / CopyrightP2P / Copyright EducationEducation

Pervasive mobile devices / wirelessPervasive mobile devices / wireless Registry / Network AuthenticationRegistry / Network Authentication

Digital asset managementDigital asset management Control of digital assets outside of Cornell’s domainControl of digital assets outside of Cornell’s domain

FingerprintingFingerprinting Authorization / Authentication outside of Cornell’s Authorization / Authentication outside of Cornell’s

domaindomain Expectation to be a national leaderExpectation to be a national leader

Need to balance with internal demandsNeed to balance with internal demands

Closing ThoughtsClosing Thoughts

Recognition of current workRecognition of current work DepartmentsDepartments CIT & the office of the VP of IT (OIT)CIT & the office of the VP of IT (OIT)

CIT Security, Abuse and Virus supportCIT Security, Abuse and Virus support OIT Policy programOIT Policy program

Ponder the value of net billing Ponder the value of net billing generated awarenessgenerated awareness

The “Workforce Planning” contextThe “Workforce Planning” context

Closing Thoughts …Closing Thoughts …

Balance, Balance, Balance …Balance, Balance, Balance … Challenge may shift over timeChallenge may shift over time Formal authority (Nice to have, but Formal authority (Nice to have, but

ideally should never be needed.)ideally should never be needed.) Ramifications of ad-hoc IT securityRamifications of ad-hoc IT security Campus desires more support, but Campus desires more support, but

the program will fail without the the program will fail without the support of campussupport of campus

Cornell’s Security Cornell’s Security Program:Program:

The Policy ComponentThe Policy Component

Tracy MitranoTracy Mitrano

Director of IT PolicyDirector of IT Policy

Computer Policy and Law ProgramComputer Policy and Law Program

Policy: Big “P” and Little “p”Policy: Big “P” and Little “p”

Big PBig P National arenaNational arena EDUCAUSE’s position on FBI’s petition to the FCC EDUCAUSE’s position on FBI’s petition to the FCC

to extend CALEA to data networksto extend CALEA to data networks National security policyNational security policy

Little PLittle P Institutional policyInstitutional policy IT security policies: a piece of a larger wholeIT security policies: a piece of a larger whole IT security policies not the same thing as IT security policies not the same thing as

national security national security

Policy Picture at CornellPolicy Picture at Cornell

University Policy OfficeUniversity Policy Office Centralized office for a decentralized Centralized office for a decentralized

institutioninstitution http://www.univco.cornell.edu/policy/current.http://www.univco.cornell.edu/policy/current.

htmlhtml Formulation and Issuance of university Formulation and Issuance of university

policypolicy http://www.univco.cornell.edu/policy/pop.htmlhttp://www.univco.cornell.edu/policy/pop.html

Volume 5: Information TechnologiesVolume 5: Information Technologies http://www.cit.cornell.edu/oit/policy/drafts/http://www.cit.cornell.edu/oit/policy/drafts/

Security ofInformation Technology

Resources

Responsible Use ofInformation Technology

Resources

EncryptionKey Escrow

Recording and Registrationof Domain Names

ReportingSecurityIncidents

NetworkRegistry

Authentication and Authorization

Access toElectronic

Mail

Privacy of Networkand Network

FlowLogs

Use of EncryptionEscrowKeys

Mass ElectronicMailing

Network Registry

Color Key

Bright Green: ExistingUniversity Policy

Turquoise: Existing Policy,scheduled for revision

Light Green: EPRGapproved, scheduled forpromulgation early 2004

Light Yellow: PAGapproved, schedule for

EPRG review early 2004Tan: Impact Statementapproved, drafting with

stakeholdersBright Blue: OIT drafting

impact statement

Four Policies for IT SecurityFour Policies for IT Security

Escrow of Encryption KeysEscrow of Encryption Keys http://www.univco.cornell.edu/policy/eek.for.htmlhttp://www.univco.cornell.edu/policy/eek.for.html

Reporting Security IncidentsReporting Security Incidents http://www.univco.cornell.edu/policy/http://www.univco.cornell.edu/policy/

SECREP.for.june1.htmlSECREP.for.june1.html Security of Information Technology ResourcesSecurity of Information Technology Resources

http://www.univco.cornell.edu/policy/SEC.for.htmlhttp://www.univco.cornell.edu/policy/SEC.for.html Network RegistryNetwork Registry

http://www.univco.cornell.edu/policy/NR.for.htmlhttp://www.univco.cornell.edu/policy/NR.for.html

Escrow of Encryption KeysEscrow of Encryption Keys

Cornell University expects stewards, Cornell University expects stewards, custodians, and users of institutional custodians, and users of institutional

administrative data who deploy administrative data who deploy software or algorithmic programs for software or algorithmic programs for encryption to establish procedures encryption to establish procedures

ensuring that the university has ensuring that the university has access to all such records and data.access to all such records and data.

Reporting Security IncidentsReporting Security Incidents

Users of Information Technology Users of Information Technology devices connected to the Cornell devices connected to the Cornell network must report all electronic network must report all electronic security incidents promptly and to security incidents promptly and to

the appropriate party or office.the appropriate party or office.

Security of Information Security of Information Technology ResourcesTechnology Resources

Cornell University expects all Cornell University expects all individuals using information individuals using information

technology devices connected to the technology devices connected to the Cornell network to take appropriate Cornell network to take appropriate measures to manage the security of measures to manage the security of

those devices.those devices.

Network RegistryNetwork Registry

Cornell University requires network Cornell University requires network administrators or users to register all administrators or users to register all devices (including wireless hubs and devices (including wireless hubs and switches) connected to the Cornell switches) connected to the Cornell network in a continuously updated network in a continuously updated

central CIT network registry service.central CIT network registry service.

ConclusionConclusion

IT security policy is a piece of the IT policy IT security policy is a piece of the IT policy puzzle, which is itself another piece of the puzzle, which is itself another piece of the

larger whole of university policy designed to larger whole of university policy designed to preserve and protect institutional assets and preserve and protect institutional assets and

interests, comply with all applicable laws, interests, comply with all applicable laws, and contribute to the citizenship experience and contribute to the citizenship experience of membership to the university community.of membership to the university community.

http://http://www.cit.cornell.edu/oit/policy/framework.htmlwww.cit.cornell.edu/oit/policy/framework.html

Cornell’s Security Cornell’s Security Program:Program:

The Security Office TodayThe Security Office Today

Steve SchusterSteve Schuster

ObjectivesObjectives

What is an effective security What is an effective security program?program?

Describe the broad elements of the Describe the broad elements of the Cornell IT Security OfficeCornell IT Security Office Discuss current prioritiesDiscuss current priorities Outline some specific efforts and Outline some specific efforts and

servicesservices Some emerging lessons learnedSome emerging lessons learned

An Effective IT Security An Effective IT Security Program Must:Program Must:

Aid in the establishment of security Aid in the establishment of security policiespolicies that are that are enforceable, understandable and implementableenforceable, understandable and implementable

TrainTrain faculty, staff and students with respect to IT security faculty, staff and students with respect to IT security policies and their responsibilities to protect IT resources and policies and their responsibilities to protect IT resources and datadata

Implement an Implement an infrastructureinfrastructure that enforces the principles that enforces the principles articulated in the policies and protects the IT resources and articulated in the policies and protects the IT resources and data within the institutiondata within the institution

Implement sound Implement sound risk assessmentrisk assessment practices to identify IT practices to identify IT security risks and vulnerabilities within the IT infrastructuresecurity risks and vulnerabilities within the IT infrastructure

Provide Provide monitoring and analysismonitoring and analysis of the infrastructure to of the infrastructure to identify unauthorized activitiesidentify unauthorized activities

Develop appropriate analysis and Develop appropriate analysis and response proceduresresponse procedures to to efficiently respond and effectively manage IT security incidentsefficiently respond and effectively manage IT security incidents

Develop Develop business continuitybusiness continuity plans that ensure the plans that ensure the appropriate availability of critical IT resources appropriate availability of critical IT resources

Security Program ElementsSecurity Program Elements

Security is a process – not a product

Security Policy and User

Awareness

Security Policy and User

Awareness

Secure InfrastructureImplementation

Secure InfrastructureImplementation

Business Continuity And

Disaster Recovery

Business Continuity And

Disaster Recovery

Continuous Risk Assessment &Penetration Testing

Continuous Risk Assessment &Penetration Testing

Security MonitoringAnd

Analysis

Security MonitoringAnd

Analysis

Incident ResponseProcesses

And Procedures

Incident ResponseProcesses

And Procedures

Responsible use, acceptable behavior and expected results

Building security and services into the infrastructure

Risks assessments performed regularlyWithin the infrastructure

Monitoring of processing components, network characteristis and intrusion detection systems

Complementary infrastructure, process and procedures

Clean andConsistent

Security Policy and Security Policy and AwarenessAwareness

Support for the Development of Support for the Development of University PoliciesUniversity Policies Reporting of Security IncidentsReporting of Security Incidents Security of IT ResourcesSecurity of IT Resources Network RegistryNetwork Registry Authentication/AuthorizationAuthentication/Authorization

Security Policy and Security Policy and AwarenessAwareness

Support for the Development of Support for the Development of University PoliciesUniversity Policies

Security Education ProgramSecurity Education Program Travelers of the Electronic Highway Travelers of the Electronic Highway

(TEH)(TEH) General user awarenessGeneral user awareness Support of local service providersSupport of local service providers

Security Policy and Security Policy and AwarenessAwareness

Support for the Development of Support for the Development of University PoliciesUniversity Policies

Security Education ProgramSecurity Education Program University Best Practices GuidelinesUniversity Best Practices Guidelines

Security configurations Security configurations Security incident response methodsSecurity incident response methods

Security Policy and Security Policy and AwarenessAwareness

Support for the Development of Support for the Development of University PoliciesUniversity Policies

Security Education ProgramSecurity Education Program University Best Practices GuidelinesUniversity Best Practices Guidelines Technical Response to LegislationTechnical Response to Legislation

HIPAAHIPAA FERPAFERPA GLBGLB

Security InfrastructureSecurity Infrastructure

Network infrastructuresNetwork infrastructures Participate in the emerging uses and Participate in the emerging uses and

capabilities of Cornell’s computing capabilities of Cornell’s computing infrastructures (LAN, WLAN, Dial-up, infrastructures (LAN, WLAN, Dial-up, public labs, etc)public labs, etc)

Security InfrastructureSecurity Infrastructure

Network infrastructuresNetwork infrastructures Security ApplicationsSecurity Applications

Anti-Virus Anti-Virus Personal firewallsPersonal firewalls ScanningScanning System analysis/forensicsSystem analysis/forensics

Security InfrastructureSecurity Infrastructure

Network infrastructuresNetwork infrastructures Security ApplicationsSecurity Applications Authentication/AuthorizationAuthentication/Authorization

University authentication requirementsUniversity authentication requirements Risk assessmentRisk assessment

Security InfrastructureSecurity Infrastructure

Network infrastructuresNetwork infrastructures Security ApplicationsSecurity Applications Authentication/AuthorizationAuthentication/Authorization Network Access Control (Firewalls)Network Access Control (Firewalls)

Restricted addressingRestricted addressing Edge ACL’s (push security closer to the Edge ACL’s (push security closer to the

edge)edge) Traditional firewall service (still not there)Traditional firewall service (still not there)

Security InfrastructureSecurity Infrastructure

Network infrastructuresNetwork infrastructures Security ApplicationsSecurity Applications Authentication/AuthorizationAuthentication/Authorization Network Access Control (Firewalls)Network Access Control (Firewalls) Direct Department SupportDirect Department Support

Specific security or incident related issuesSpecific security or incident related issues Secure architecture developmentSecure architecture development

Business Continuity and Business Continuity and Disaster RecoveryDisaster Recovery

Participate in current BC/DR Participate in current BC/DR development effortsdevelopment efforts Ensure current efforts included system Ensure current efforts included system

compromise and infections as compromise and infections as addressable eventsaddressable events

Business Continuity and Business Continuity and Disaster RecoveryDisaster Recovery

Participate in current BC/DR Participate in current BC/DR development effortsdevelopment efforts

Develop BC/DR plans that includeDevelop BC/DR plans that include Identification of critical assetsIdentification of critical assets Processes and procedures to be followed Processes and procedures to be followed

when compromise occurs on a critical when compromise occurs on a critical resourceresource

Risk AssessmentsRisk Assessments

Central Security Assessments Central Security Assessments Service or infrastructure assessments Service or infrastructure assessments

(wireless, IP, etc)(wireless, IP, etc) Network and System ScanningNetwork and System Scanning

Risk AssessmentsRisk Assessments

Central Security AssessmentsCentral Security Assessments System scanning at time of System scanning at time of

registrationregistration Scan student systems upon registrationScan student systems upon registration Limit or revoke network access upon Limit or revoke network access upon

unclean scanunclean scan

Risk AssessmentsRisk Assessments

Central Security AssessmentsCentral Security Assessments System scanning at time of System scanning at time of

registrationregistration Promote and support for localized Promote and support for localized

scanningscanning Distribute scanning software to local Distribute scanning software to local

support providerssupport providers Train support providers as necessaryTrain support providers as necessary

Security Monitoring and Security Monitoring and AnalysisAnalysis

Development of Automated ReportsDevelopment of Automated Reports Processing of network management logsProcessing of network management logs Network usage reportsNetwork usage reports Net alarmsNet alarms Billing alertsBilling alerts

Security Monitoring and Security Monitoring and AnalysisAnalysis

Development of Automated ReportsDevelopment of Automated Reports Intrusion Detection Intrusion Detection

Network Based Anomaly Detection (NBAD)Network Based Anomaly Detection (NBAD) For central operation and some distributed viewsFor central operation and some distributed views More easily operationalized than IDSMore easily operationalized than IDS

NIDSNIDS Some local IDS for critical systems or Some local IDS for critical systems or

infrastructuresinfrastructures Operations and response is more difficult hereOperations and response is more difficult here

Security Monitoring and Security Monitoring and AnalysisAnalysis

Development of Automated ReportsDevelopment of Automated Reports Intrusion Detection Intrusion Detection Honey PotHoney Pot

Use of some “empty” networks for Use of some “empty” networks for scanning identificationscanning identification

Some early experience with honey pot Some early experience with honey pot operationsoperations

Security Monitoring and Security Monitoring and AnalysisAnalysis

Development of Automated ReportsDevelopment of Automated Reports Intrusion Detection Intrusion Detection Honey PotHoney Pot Identification and response to Identification and response to

specific events or system behaviorspecific events or system behavior Algorithms to identify worm infected Algorithms to identify worm infected

systemssystems

Incident ResponseIncident Response

Backline SupportBackline Support NOCNOC Help DeskHelp Desk NUBBNUBB

Incident ResponseIncident Response

Backline SupportBackline Support University IT Operational ProceduresUniversity IT Operational Procedures

Operational procedures with CU PoliceOperational procedures with CU Police Operational procedures with Federal Operational procedures with Federal

AgenciesAgencies

Incident ResponseIncident Response

Backline SupportBackline Support University IT Operational Procedures University IT Operational Procedures Direct Support for Departments as Direct Support for Departments as

necessarynecessary IdentificationIdentification AnalysisAnalysis ResponseResponse

Incident ResponseIncident Response

Backline SupportBackline Support University IT Operational Procedures University IT Operational Procedures Direct Support for Departments as Direct Support for Departments as

necessarynecessary Support for University-Wide Security Support for University-Wide Security

Incident Response mechanismsIncident Response mechanisms Virus response Virus response

A Growing Set of Lessons A Growing Set of Lessons LearnedLearned

Community trust is paramountCommunity trust is paramount It’s OK to crawl before you walk… before you It’s OK to crawl before you walk… before you

run…run… All elements described above should move All elements described above should move

together at the same pacetogether at the same pace The distributed nature of our environment does The distributed nature of our environment does

not need to mean less security but rather a not need to mean less security but rather a different security strategydifferent security strategy

Consolidating security operations and security Consolidating security operations and security budget provide both leverage and budget provide both leverage and accountabilityaccountability

QuestionsQuestions

?