% Towards Less Insecure Administrative Networks
% for OUCC 26, U of Waterloo, 1996
% John Sellens
% University of Waterloo
% Waterloo, Ontario N2L 3G1 Canada
% jmsellens@uwaterloo.ca
% work +1-519-888-4567 x5446
% FAX  +1-519-746-1595
% home +1-519-579-2046


\documentclass[semhelv]{seminar}
%\documentclass[semhelv,article]{seminar}
\usepackage{epsf}
\usepackage{fancybox}
\usepackage{semcolor}
\usepackage{palette}
\usepackage{html}
%\onlyslides{6-999}

\special{header=fclogosh.ps}

\title{Towards Less Insecure Administrative Networks}
\newcommand{\myname}{John Sellens}
\newcommand{\confname}{OUCC 26}
\newcommand{\confyear}{1996}
\author{\myname \\
Data Processing \\
Information Systems and Technology \\
University of Waterloo \\
jmsellens@uwaterloo.ca}
\def\mydate{May 28, 1996}
\def\today{\confname \\ \mydate}

\slidesmag{5}

%%\twoup

%\centerslidesfalse



% "tight" itemize - all the "sep" spacing set to 0pt
    \makeatletter
    \def\titemize{\ifnum \@itemdepth >3 \@toodeep\else \advance\@itemdepth
    \@ne
    \edef\@itemitem{labelitem\romannumeral\the\@itemdepth}%
    \list{\csname\@itemitem\endcsname}{\def\makelabel##1{\hss\llap{##1}}%
    \itemsep 0pt\topsep 0pt\parsep 0pt}\fi}
    \let\endtitemize =\endlist
    \makeatother

%\begin{latexonly}
\newpagestyle{mystyle}%
  {\mediumblue\thetitle\hfil}%
  {%
  \hbox{\epsfxsize=0.75\semcm\epsffile{uwclogosh.ps}}%
  %\mediumblue\myname\hfil \confname, \confyear \hfil \thepage}
  \mediumblue\myname\hfil \confname, \mydate \hfil \thepage}
\pagestyle{mystyle}
%\end{latexonly}
\begin{rawhtml}
<IMG SRC="http://www.uwaterloo.ca/images/UWlogo.GIF"
     align=right alt="UW shield">
\end{rawhtml}

%%\slideframe{Oval}
%%\slideframe{oval}
% default slideframe is scplain, which uses this
\def\SemcolorFrameOps{\psset{%
  fillstyle=none,%
  linecolor=mediumblue,%
  linewidth=\slideframewidth,%
  framesep=\slideframesep,%
  cornersize=absolute,%
  linearc=.5cm,%
  shadowsize=2pt,%
  shadowcolor=darkgray}}%

\newcommand{\heading}[1]{%
  \begin{center}
    \large\bf
    \shadowbox{#1}%
  \end{center}
  \vspace{1ex minus 1ex}}
\renewcommand{\heading}[1]{\begin{center}\large\bf #1\end{center}}

\def\printlandscape{\special{landscape}}

% my name
\def\Filetsf{{\bf Filetsf}}
\def\Filetsf{{Filetsf}}
\def\filetsf{{\bf filetsf}}
\def\filetsf{{filetsf}}
\def\lpd{{\bf lpr/lpd}}
\def\lpd{{lpr/lpd}}
% used for program and command names in the text
\newcommand{\prog}[1]{\mbox{\it #1}}
% used for program options in the text
\newcommand{\opt}[1]{\mbox{\it #1}}
% used for man page names
\newcommand{\manpage}[2]{\mbox{{\it #1\/}(#2)}}
% used for pathnames
\newcommand{\path}[1]{\mbox{\tt #1}}
% used for userids
\newcommand{\user}[1]{\mbox{\tt #1}}
% used for hostname and email addresses
\newcommand{\host}[1]{\mbox{\tt #1}}

% the colours I want to use -- see palette.tex
\getcolor{mediumblue}
\getcolor{thistle}
\getcolor{dodgerblue}


\begin{document}

{\pagestyle{empty}
\centerslidestrue
\begin{slide}
\maketitle
\begin{latexonly}
\centerline{\hbox{\epsfxsize=2\semcm\epsffile{uwclogosh.ps}}}
\end{latexonly}
\begin{rawhtml}
<IMG SRC="http://www.uwaterloo.ca/images/UWlogo.GIF"
     align=right alt="UW shield">
\end{rawhtml}
\addtocounter{slide}{-1}
\end{slide}
}

\begin{slide}
\heading{``Official'' Abstract}
With the imminent deployment of a major UNIX-based database server, and
the replacement of our legacy financial systems, we are implementing a
number of security and reliability measures.  These include a
high-availability database server, a major offsite backup system and
offsite mirroring of data, a firewall system, SecurID one-time-password
tokens for sensitive areas, tightly controlled access to our primary
servers,
and a review of our use of campus software support.  This
presentation will outline what we're doing and have done, why, and the
good and bad things that we have discovered.
\end{slide}


\begin{slide}
\heading{Where Did We Start?}
\begin{itemize}
\item Most ``critical'' administrative applications on VM/CMS
\item Separate administrative subnets, but no firewall or traffic controls
\item Little or no control over password selection and use
\item Admin UNIX servers treated the same as other campus UNIX servers
\item Inconsistent backup schedules for taking tapes offsite -- some
data never left the machine room
\item Reliance on ``good luck'' rather than rigorous controls
\end{itemize}
\end{slide}

\begin{slide}
\heading{Motivation for Change}
\begin{itemize}
\item Primary motivation for addressing security was the looming
implementation of new financial systems using Oracle on UNIX servers
\item A recognition that some of our practices were pretty hard to
justify in the current environment of the 'net
\item A desire to bring the primary responsibility for the admin
servers into the Data Processing department, rather than the central
campus support group
    \begin{titemize}
    \item Subject to current looming reorganization
    \end{titemize}
\end{itemize}
\end{slide}

\begin{slide}
\heading{Presentation Overview}
\begin{itemize}
\item The bulk of this presentation is a ``grab bag'' of topics
\item Most of the topics are ``peripheral'' to the real goal
of information access, recording and manipulation
\item Metaphor:
The different topics are all herding our bits and bytes into
line from different directions?
\end{itemize}
\end{slide}

\begin{slide}
\heading{Offsite Disks and Backups}
\begin{itemize}
\item New database server is a
Sun PDB 1000 system -- a high-availabilty, two node cluster
\item One very attractive feature is the fibre optic connections to the disk
arrays
    \begin{titemize}
    \item This will allow us to place a mirrored copy of all disk data
    offsite immediately, with no performance penalty
    \end{titemize}
\item A new backup server was purchased to be inside the admin firewall and
also to get offsite backups, rather than continue to use the central
server
    \begin{titemize}
    \item Tapes will be ``cloned'' by the backup server for reliability
    \end{titemize}
\end{itemize}
\end{slide}

\begin{slide}
\heading{Access Control and Physical Security}
\begin{itemize}
\item Most machines are in the ``red room'' -- the main campus machine
room
    \begin{titemize}
    \item Environment and access is controlled
    \end{titemize}
\item Offsite disks and backup server will be located in a new mini
machine room in a separate building
    \begin{titemize}
    \item Alarm system, limited key access
    \item UPS with environmental monitoring for temperature and humidity
    \item An ``extension'' of the red room
    \end{titemize}
\end{itemize}
\end{slide}

\begin{slide}
\heading{One Time Passwords}
\begin{itemize}
\item We're going to be using SecurID tokens on ``important'' servers
\item Avoids problem of passwords written down in obvious places
\item Avoids problem of shared or snooped passwords
\item End of day collection of tokens could be used to limit access over the
network
\item Why SecurID?
    \begin{titemize}
    \item Works with our existing systems/equipment
    \item Least intrusive option
    \end{titemize}
\end{itemize}
\end{slide}

\begin{slide}
\heading{User Control on Production Systems}
\begin{itemize}
\item Or, more accurately, ``control of users''
\item Restricted menu as login shell -- no shell, mail, news \ldots
\item Very fussy password command to avoid bad passwords
\item .rhosts files controlled with ``gatekeeper'' software
\item No shared passwords, thanks to SecurID
\item Plans for a simple password control system for change enforcement
for non-SecurID systems/users
\end{itemize}
\end{slide}

\begin{slide}
\heading{Limiting Access to Network Services}
\begin{itemize}
\item Limiting the services available on servers (hopefully) reduces the
opportunities for attack and/or uncontrolled access
\item One web server on the administrative networks
    \begin{titemize}
    \item Reduces likelihood of inadvertant publishing of secret data
    \end{titemize}
\item Certain services are disabled on admin servers
    \begin{titemize}
    \item e.g. finger, ftp
    \end{titemize}
\item Avoid the use of NFS, NIS, RPC, etc.
\item Limit/control .rhosts file use as appropriate
\end{itemize}
\end{slide}

\begin{slide}
\heading{Network Layout, Reconfiguration, and Planning}
\begin{itemize}
\item We are moving towards a firewall, and a switched
admin networks ``backbone''
\item Creating a firewall after the fact is harder
\item Isolate admin networks from the other networks
\item Lots of special case traffic, since we need to allow
access to internal machines from external users (e.g. in the faculties)
\end{itemize}
\end{slide}



\gdef\sizeme{%
% we like figures that are scaled
\def\epsfsize##1##2{0.50##1}%
% we like figures to match the text width
\def\epsfsize##1##2{\textwidth}}


\begin{slide}
\centerslidesfalse
\heading{Original Network Layout}
\begin{itemize}
\item Separate subnets on the campus network

\begin{latexonly}
\sizeme
\centerline{\hbox{\epsffile{figures/original.ps}}}
\end{latexonly}
\begin{rawhtml}
<img src="/~jmsellen/Papers/towards/figures/original.gif" alt="original layout">
\end{rawhtml}
\end{itemize}
\end{slide}

\begin{slide}
\heading{Transitional Network Layout}
\begin{itemize}
\item Routers provide some access control

\begin{latexonly}
\sizeme
\centerline{\hbox{\epsffile{figures/transition.ps}}}
\end{latexonly}
\begin{rawhtml}
<img src="/~jmsellen/Papers/towards/figures/transition.gif" alt="transition layout">
\end{rawhtml}
\end{itemize}
\end{slide}

\begin{slide}
\heading{Final Network Layout}
\begin{itemize}
\item All admin systems behind a reasonable firewall

\begin{latexonly}
\sizeme
\centerline{\hbox{\epsffile{figures/final.ps}}}
\end{latexonly}
\begin{rawhtml}
<img src="/~jmsellen/Papers/towards/figures/final.gif" alt="final layout">
\end{rawhtml}
\end{itemize}
\end{slide}

\begin{slide}
\heading{Trusting Central Support}
\begin{itemize}
\item Centralized UNIX software support raises the question: How can we
justify trusting everyone doing central support?
\item How can we control/limit the ``web of trust''?
\item We may be able to reduce the risks by switching to a ``pull'' rather
than ``push'' model of software distribution
\item Can never be 100\% controlled or risk-free
\end{itemize}
\end{slide}

%%\begin{slide}
%%\heading{Hi there}
%%\begin{itemize}
%%\item This is a rough picture of where we want to end up
%%
%%%\centerline{\hbox{\epsfysize=100pt\epsffile{/tmp/rjxhier.ps}}}
%%%\centerline{\hbox{\epsfysize=6\semin\epsffile{/tmp/rjxhier.ps}}}
%%\centerline{\hbox{\epsfxsize=6\semin\epsffile{admFW.ps}}}
%%\end{itemize}
%%\end{slide}

\begin{slide}
\heading{What Problems Are We Ignoring/Accepting?}
\begin{itemize}
\item Admin network snooping, outside network snooping
\item Steam tunnel/conduit/wiring closet attacks
\item Insecure systems on desktops
\item Desktop systems not backed up
\item Packet modification, session hijacking, denial of service attacks
via the network
\item Internal attacks from DP superusers, DBA's, and programmers
\end{itemize}
\end{slide}

\begin{slide}
\heading{Where Are We Failing?}
\begin{itemize}
\item Time -- everything takes too long to do
\item We're way behind schedule on some things
\item We should have done some things differently right from the start
    \begin{titemize}
    \item e.g. Start with a restricted 'net connection, not wide open
    \item e.g. Don't mix machine uses -- general purpose access vs.
    ``production'' applications
    \end{titemize}
\item Communication -- we have not always been very good at
communicating why (and how) network security is important
\end{itemize}
\end{slide}

\begin{slide}
\heading{Where Are We Succeeding?}
\begin{itemize}
\item Systems are running -- no (detected) intrusions or significant
failures (yet)
    \begin{titemize}
    \item Famous last words
    \end{titemize}
\item The parts that we have implemented have gone in fairly smoothly,
with little or no user disruption
    \begin{titemize}
    \item But some of the more ``disruptive'' things are yet to come
    \end{titemize}
\item We seem to be going in the right direction
\end{itemize}
\end{slide}

\begin{slide}
\heading{Summary and Availability}
\begin{itemize}
\item Seem to be doing some of the ``right things''
\item Took (and is taking) much more time than we had hoped
\item Much of the local software is freely available
    \begin{titemize}
    \item gatekeeper, setpw, usermenu, etc.
    \item Some Waterloo-isms in the code
    \end{titemize}
\item Copies of this presentation are available at \\
http://www.adm.uwaterloo.ca/\~{}jmsellen/Papers/towards \\
or contact jmsellens@uwaterloo.ca
\item {\footnotesize No Microsoft or Netscape software was used to create
this presentation}
\end{itemize}
\end{slide}

%\begin{slide}
%\heading{XXXX}
%\begin{itemize}
%\item XXXX
%\end{itemize}
%\end{slide}

\end{document}
