Protecting K12 Networks

1
Protecting K-12 Networks
2
Protecting School Networks

• We are vulnerable
• K12 is easy
• Resources limited
• Networks are more sophisticated
• Practice ground
• 1st experience with hackers

3
It Hurts!!

• Cost of cleanup due to a virus, trojan, or worm
  incident
• Lost productivity
• Missed or delayed schedules
• Computer resources - servers slowing down or
  crashing

4
Potential Attacks Hacks

• From Inside
• Staff
• Students
• Physical Security
• Access to your servers and routers
• Passwords
• ½ are inside jobs

5
Who Are Your Attackers?

• Hackers
• Crackers
• Script Kiddie

6
Potential Attacks Hacks

• From the outside
• Viruses
• Trojans
• Worms
• Denial of Service
• SPAM
• Port Scanning
• Use and Abuse Kazaa, Napster, PtoP

7
Potential Attacks Hacks

• What Is a Computer Virus?
• A computer virus is a program a piece of
  executable code that has the unique ability to
  replicate.
• They can attach themselves to just about any type
  of file
• Virus payload.
• display messages or images, destroy files,
  reformat your hard drive, or cause other kinds of
  damage.

8
Potential Attacks Hacks

• What Is a Trojan?
• Remember the Trojan Horse?
• It is a program which does an unauthorized
  function, hidden inside an authorized program.
• It does something other than what it claims to
  do, usually something malicious

9
Potential Attacks Hacks

• What Is a Worm?
• programs which reproduce by copying themselves
  over and over
• system to system, using up resources and
  sometimes slowing down the systems.
• self contained and use the networks to spread, in
  much the same way viruses use files to spread.
• use holes and vulnerabilities in software

10
Potential Attacks Hacks

• Some recent attacks
• Slammer
• Melissa
• Code Red
• Sir Cam
• NIMDA
• Klez

11
Ive been hacked!!!

• How do you know?
• Today we are always on
• Unusual Activity

12
(No Transcript)
13
Ive been hacked!!!

• How do you know?
• UNKNOWN ACCOUNTS, FILES,FOLDERS
• EXCESSIVE LOG-ON FAILURES
• UNEXPECTED CRASHES or reboots
• MISSING LOGS
• HEAVY TRAFFIC
• SYSTEM LOGS FILL UP
• SLOW PERFORMANCE
• ALERTS
• WIRELESS

14
Building The Fort

• Physical
• Authentication
• Internet
• eMail
• Virus

15
What can we do?

• Hack Yourself
• Virus Scanners
• Trojan Port Scanners
• Use Firewalls NAT
• Monitor Your Network Know Your System
• Regularly update software, patches
• Turn off risky services if not in use

16
Know Your Vulnerabilities Before Someone Else Does

• FBI top 20 list of vulnerabilities
• www.sans.org/top20/

17
Intrusion Detection System

• Snort - open source network intrusion detection
  system
• Freeware

18
Traffic Grapher

• Security Administrators need to have a baseline
  of what normal traffic should look like and use
  network management reporting tools, like
  CyberGauge, to monitor the network for
  abnormalities. 

19
Physical Security

• Keeping Infrastructure behind locked doors
• Limiting Access
• Disabling unused network access points
• Limiting access to PCs

20
Authentication Security

• Enforce a strong passwords policy
• Periodic changing of passwords
• The higher access Ids should be changed more
  frequently
• Rename/Disable of default accounts
• Limit number of stations that log into the
  network

21
Internet Security

• Limit access to interior systems from the
  Internet
• Poor Mans Fire Wall
• http//www.zdnet.com.au/newstech/enterprise/story/
  0,2000025001,20263906,00.htm
• Private IP addressing

22
eMail Security

• Limiting who can use your system
• Limiting who can relay emails through you
• Monitoring eMail content
• SPAM 35-45 of our traffic
• Protecting eMail from Viruses

23
Virus Security

• Layered Protection
• PCs
• Servers
• eMail system
• Backup system
• Firewall

24
Log File Management

• You should review your logs daily, preferably
  first thing in the morning
• Look for probes to ports that have no application
  services running on them
• Look at the IP addresses that are being rejected
  and dropped
• Look for unsuccessful logins to your firewall or
  to other mission-critical servers that it
  protects
• Look for suspicious outbound connections
• Look for source-routed packets