System Security Roadmap

Diomidis Spinellis
 Department of Management Science and Technology
Athens University of Economics and Business
Athens, Greece
dds@aueb.gr

Welcome

System Security Implementation

Schedule

Παρασκευή 5 Νοεμβρίου 2004

Σάββατο 6 Νοεμβρίου 2004

Overview

Notes

Security Infrastructure

Security Infrastructure Investment

Getting the management commitment

Management Errors

The 7 Top Management Errors that Lead to Computer Security Vulnerabilities

As determined by the 1,850 computer security experts and managers meeting at the SANS99 and Federal Computer Security Conferences held in Baltimore May 7-14, 1999
From http://www.sans.org/newlook/resources/errors.htm (http://www.sans.org/newlook/resources/errors.htm)

Security Mission Statement

The security mission statement is determined by a number of factors:

Security Awareness Training

Example of a CERT Advisory

Subject: CERT Summary CS-2002-02
Date: Tue, 28 May 2002 14:50:15 -0400 (EDT)
From: CERT Advisory <cert-advisory@cert.org>
Organization: CERT(R) Coordination Center - +1 412-268-7090
To: cert-advisory@cert.org

CERT Summary CS-2002-02

   May 28, 2002

   Each  quarter, the CERT Coordination Center (CERT/CC) issues the CERT
   summary  to  draw  attention  to  the types of attacks reported to our
   incident  response  team,  as  well  as  other noteworthy incident and
   vulnerability information. The summary includes pointers to sources of
   information for dealing with the problems.

   Past CERT summaries are available at http://www.cert.org/summaries/.
   ______________________________________________________________________

Recent Activity

   Since  the  last  regularly scheduled CERT summary, issued in February
   2002  (CS-2002-01),  we  have  released  several advisories addressing
   vulnerabilties   in   Microsoft's  IIS  server,  Oracle  Database  and
   Application  Servers, Sun Solaris cachefsd, and MSN Instant Messenger.
   In  addition,  we  have  published statistics for the first quarter of
   2002,  numerous  white  papers,  and  a collection of frequently asked
   questions about the OCTAVE Method.

   For  more  current  information  on  activity  being  reported  to the
   CERT/CC,  please  visit the CERT/CC Current Activity page. The Current
   Activity  page  is  a  regularly updated summary of the most frequent,
   high-impact  types  of  security  incidents  and vulnerabilities being
   reported  to the CERT/CC. The information on the Current Activity page
   is reviewed and updated as reporting trends change.

    1. Exploitation of Vulnerabilities in Microsoft SQL Server

       The  CERT/CC  has  received  reports  of systems being compromised
       through  the  automated  exploitation  of  null or weak default sa
       passwords  in Microsoft SQL Server and Microsoft Data Engine. This
       activity  is  accompanied by high volumes of scanning, and appears
       to  be  related  to recently discovered self-propagating malicious
       code,  referred  to  by  various  sources  as Spida, SQLsnake, and
       Digispid.

       CERT Incident Note IN-2002-04:
       Exploitation of Vulnerabilities in Microsoft SQL Server
       http://www.cert.org/incident_notes/IN-2002-04.html

[...]

Security Support Personnel Duties

Security log example

Subject: istlab.dmst.aueb.gr security check output
Date: Sat, 15 Jun 2002 03:01:02 +0300 (EEST)
From: Charlie Root <root@istlab.dmst.aueb.gr>
To: undisclosed-recipients:;

Checking setuid files and devices:


Checking for uids 

Checking setuid files and devices:


Checking for uids of 0:
root 0
toor 0


Checking for passwordless accounts:


istlab.dmst.aueb.gr kernel log messages:
> Jun 14 17:21:29 istlab su: dds to root on /dev/ttyp0
> Jun 14 23:30:02 istlab sendmail[65649]: g5EKU1a65648: Truncated MIME Content-Disposition header due to field size (length = 23) (possible attack)


istlab.dmst.aueb.gr login failures:


istlab.dmst.aueb.gr refused connections:

Coordination with ISP

Subject: Re: Prospatheia hacking
Date: Mon, 15 Jan 2001 12:49:33 +0200
From: OTEnet Network Abuse Team <abuse@otenet.gr>
To: Diomidis Spinellis <dds@host.gr>

On Mon, Jan 15, 2001 at 11:30:06AM +0200, Diomidis Spinellis wrote:
> Ο παρακάτω χρήστης σας προσπάθησε το Σάββατο να παραβιάσει το μηχάνημα
> XXX.XXX.XXX.XXX:
> 
> Jan 13 01:28:17 inet popper[20009]: ddl@athe530-q166.otenet.gr: -ERR
> Unknown command: "close".
> Jan 13 01:28:19 inet popper[20009]: Possible probe of account ddl from
> host
> athe530-q166.otenet.gr
> Jan 13 01:28:31 inet popper[20010]: dds@athe530-q166.otenet.gr: -ERR
> Unknown command: "l".
> Jan 13 01:28:33 inet popper[20010]: dds@athe530-q166.otenet.gr: -ERR
> Unknown command: "r".
> 
> Παρακαλώ να με ενημερώσετε για τις ενέργειές σας.
> 
> Φιλικά,
> 
> Δ. Σπινέλλης

-- 
Agaphte Kyrie

Meta apo e3etash twn log files pou mas exete steilei, exoume entopisei ton
syndromhth mas ekeino, o opoios empleketai sthn en logw apopeira kai exoume 
pra3ei ta deonta prokeimenou na mhn epanalhfthoun sto mellon tetoies energeies 
apo merous tou.

OTEnet Network Abuse Team

Complaint

Subject: [Spam mail]
Date: Tue, 22 Jan 2002 12:56:20 +0200
From: XXX@yyy.gr
To: abuse@isp.gr
CC: abuse@host.gr

Aytos fainetai (me traceroute) oti pairnei grammh apo esas. Epeidh oi idioi
einai spammers sas stelnw esas to complaint.

To spam einai attached.
Eyxaristw.

-- 

[Copy of the spam mail]

Auditing

Help an organization balance resources expended against the most likely areas of weaknesses.
Audit Type Reason
New System Installation Security Audits Ensure conformance to existing policies and a standard system configuration.
Regular Automated System Audit Checks Reveal a "visitation" by an intruder or illicit activity by insiders.
Random Security Audit Checks
  • Test for conformance to security policies and standards (by finding illicit activity) ,
  • Check for the existence of a specific class of problems (e.g., the presence of a vulnerability reported by a vendor).
Nightly Audits of Critical Files
  • Assess the integrity of critical files (e.g., the password file)
  • Integrity of databases (e.g., payroll or sales and marketing information).
User Account Activity Audits Detect dormant, invalid, misused accounts.
Periodic audits and vulnerability assessments Determine overall state of your security infrastructure.

Tools

Targeted System Binaries And Directories

Internet Attack Methods

Incident Response

Incident Response Centers

CERT(sm) Coordination Center
http://www.cert.org/
email cert@cert.org or call +1 412 268-7090

GRNET-CERT

Computer Emergency Responce Team for the Greek National Research Network

E-Mail: grnet-cert@grnet.gr (mailto:grnet-cert@grnet.gr)

Network Operations Center, University of the Aegean, 30 Voulgaroktonou str, Athens 114 72, Greece

Telephone: +30 - 210 - 649 - 2056
Telefax: +30 - 210 - 649 - 2499
World Wide Web: http://cert.grnet.gr (http://cert.grnet.gr)

Network Management Center
National Technical University of Athens
Iroon Polytechnioy 9
Zografou, GR 157 80
Athens
Greece
phone [+30-210] 772.1860
fax [+30-210] 772.1866
http://www.ntua.gr/grnet-cert/grnet-cert.html (http://www.ntua.gr/grnet-cert/grnet-cert.html)

Management-related Security Problems

Software Installation Practices

Modify default software installation to Develop standard installation guidelines for all operating systems and applications used by the organization.

Authentication Practices

Backup Practices

Port Filtering Practices

Evaluating Vulnerabilities

For each vulnerability we need to now:

Common Unix Vulnerabilities

(From the Twenty Most Critical Internet Security Vulnerabilities
2004
Copyright 2001-2004, The SANS Institute
http://www.sans.org/top20.htm (http://www.sans.org/top20.htm))

Common Windows Vulnerabilities

(From the Twenty Most Critical Internet Security Vulnerabilities
2004
Copyright 2001-2004, The SANS Institute
http://www.sans.org/top20.htm (http://www.sans.org/top20.htm))

Home-user Tips

(Excerpted from http://www.nipc.gov/warnings/computertips.htm (http://www.nipc.gov/warnings/computertips.htm))

System Administrator Best Practices

Low-cost Security Improvements

Doing it on a shoestring basis:

Free Tool Repositories

Security Web Sites

Security Books

Articles

Creative Commons License  Last change: Sunday, October 30, 2005 10:39 pm
 Unless otherwise expressly stated, all original material on this page created by Diomidis Spinellis is licensed under a Creative Commons Attribution-Share Alike 3.0 Greece License.