Debra Saunders White

1

HAMPTON UNIVERSITY
Securing the Enterprise A Strategic Alliance with
K-16 Solutions A Case Study

• Debra Saunders White
• Assistant Provost for Technology
• Debra.white_at_hamptonu.edu
• 757.728.6988

2
Outline

• University Overview
• Goals and Business Drivers for Managed Service
  Markets
• Technical Approach
• Partnership with K-16 Solution and Mightyview
• Product Overview
• Concluding Remarks

3
University Profile

• University Information
• Founded in 1868
• HBCU
• Located in Hampton, Virginia
• Core Competencies
• Masters Level II
• 5,700 FTE
• Advanced Degrees
• PH.D Physics, Nursing and Physical Therapy
• PHARM.D

4
Security Goals, Policy and Requirements

• What are our goals?
• Fast deployment
• Additional support
• Turn key solution?
• Integrated into Enterprise Systems Management
  solution
• What are we trying to detect/protect?
• Are there specific threats? Internal? External?
• Are we looking for a baseline for decision
  support?
• Do we want to collect forensics for prosecution?
• Are we looking for internal system misuse?

5
Market Drivers

• Expensive, experienced EM professionals are
  challenging to obtain, train and retain.
• Issues that contribute to failures
• No one product meets all requirements
• Huge capital investment of software
• Costly to build, integrate and maintain breath of
  products
• EM Solutions are complex as the solutions they
  are designed to manage.
• 56.5 of companies now outsource one or more of
  their applications (e-week 9/00)
• 70 of EM projects fail Gartner

6
Technical Needs

• Executives
• Improve Security Posture
• Reduce down time
• Determine real-time status of enterprise
• Service Level Agreement (SLA) management
• Technical Managers
• Find performance and security issues before they
  become problems
• Determine top security issues in enterprise
• Determine where to focus support teams efforts
• Planning for future services

7
Technical Needs (contd.)

• Engineers and Administrators
• Faster resolution of problems
• Real time tools and reporting to proactively
  resolve issues
• Key Technical Features
• Real Time Event Management
• Determine how well services are delivered to
  Internet and internal customers
• Security Status of Enterprise
• Real Time Root Cause Analysis
• Embedded alerting, asset management, and
  configuration control management
• Information needed for sound designs

8
Security Management Philosophy

• End to End Defense in Depth approach across the
  enterprise

Is some one internally attacking us?
Internal Vulnerabilities?
Are business transactions secure?
Internet Vulnerabilities?
Intranet
Extranet
Business Transactions
VPN Service
Internet
B2B
Are my firewalls properly configured? Are we
monitoring for intrusion attempts?
Intranet Enterprise
Can I connect to partners securely? Are my
servers safe?
Are viruss stopped before they arrive
internally or being forwarded to a customer?
9
K-16 Solutions - A Partnership

• Minority Firm
• Higher Education experience
• Culturally sensitive to our environment
• Systems Integration
• Packaged offerings with Mightyview
• Seamless support infrastructure
• Valued Product Offerings

10
Real Time Critical Alerting

• End to End Detailed Status of Enterprise

Detailed Enterprise Status
Ownership
Event History
Root Cause Real Time Tools
11
Real Time NIDS Critical Alerting

• End to End Detailed Security Status of Enterprise

Security Event History
Which IDS sensor of many in the enterprise?
Tuned Alerting Detailed
Detailed Information
12
Real Time Critical Alerting

• In depth description and resolution

Which NIDS sensor of many in the enterprise?
Easy to understand explanations and
recommendations
Key Detailed Security Information
13
Online Historical Repository

• Baselining and Security Analysis

Select Time Frame Date
14
Executive SLA Reports

• Top attack types by class
• Top attack types by service group
• Top Destination Addresses
• Top 5 Signatures Detected

15
Technical Manager Reports

• Most Active IP addresses attacking
• Most popular targets
• Most popular destination ports
• Attack distribution by NIDS sensor

16
Online Historical Repository

• Baselining and Third Party Verification

Select Time Frame Date
17
Engineering Reports

• Capacity Planning to the process level

Top 20 Health Performance Issues
Detailed Server Resource usage
Which processes were consuming resources?
18
Example Exchange Application Health Report

• Manage and plan email services

Exchange Application Resources Usage
19
Example Network Management Report

• Top Network Issues

Top Network Issues
Trend Analysis
20
Example Network Management Report

• Detailed Network Device Management

Network Device Resource Usage Drill Down
21
Concluding Remarks

• Mitigation of security risks improves service
  delivery
• No security solution is 100
• Consider the following when thinking of security
• The Price of Security is Eternal Vigilance