Transcript Network Access Control

Network Access Control through
Quarantine, Remediation, and
Verification
Educause Security Professionals Conference
Jonny Sweeny
Incident Response Manager
Office of the VP for IT
Indiana University
5 May 2008
Copyright 2008, The Trustees of Indiana University. This work is the intellectual property of the author. Permission is granted for this material to be shared for noncommercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of
the author. To disseminate otherwise or to republish requires written permission from the author.
Overview
• IU’s Get Connected
– Computers new to the network
• Blocking `bad` systems
– Communication
– Restoring access
Get Connected Stats
• 7,641 computers connected in 14 days
• Currently only required in Residence
Halls on Windows wired connections
• 81% are laptops
Other reasons to restrict network access
• Compromised systems
– detected by sensors
• Port scanning, high mailers, etc.
– Detected by logs
• DNS botted, spyware, etc.
• Webmail compromised credentials
• Copyright Infringement
Blocking Options
•
•
•
•
•
•
MAC Address
VPN
Dialup
802.1x
Static IP null-route
Switch-port
Communication
• User needs to know why machine is
blocked
– Sending an email to the user is not
sufficient, however CC-ing their
support provider helps
– Redirecting to a self-service site is
ideal.
– Dynamically-assigned VLANs.
Jonny,
User receives
notification email
Network reports indicate that the computer listed below has been
compromised. It appears a bot has taken over the system. A "bot,"
or "robot," is a program that is installed by an intruder, so that
the machine takes actions automatically, as programmed by the
intruder and at times specified by the intruder who put the bot there.
Date (Timezone=UTC)
------------------2008-03-12 02:57:12
2008-04-01 14:01:31
***
***
Type
---vpn
dhcp
IP Address
--------------156.56.175.226
156.56.18.118
Remote IP Address
--------------76.252.188.1
00:06:5b:17:17:xx iu-itpo-iceland
Network access for this user or computer is being blocked to ***
protect the University network from this threat.
***
If your machine is not running a Windows operating system, please
consult with the Support Center on how to rebuild for your operating
system.
To recover from this compromise it is necessary to completely rebuild
the computer. When a computer is compromised in this manner, anything
on the system can be modified and/or monitored by someone else.
When you are finished and wish to have network access restored,
please reply back to this message, leaving the subject line intact,
and outline specifically what actions you took. You must take all
actions listed in order for us to restore access.
Help with these steps can be obtained from the KB article titled "In
Windows, how do I rebuild my computer after a system-level
compromise" available at [http://kb.iu.edu/data/anbp.html].
1. Remove the computer from the network by removing the network cable
from the computer, or by turning off the wireless or dialup
connection. Do not reconnect the computer until all steps have
been completed, or you run the risk of being compromised again.
2. Backup your personal files. If you do not take this step, you will
lose all of your data when you perform step #3.
3. Perform a New Install of Windows XP or Vista. Make sure you use a
new password for the Administrator account when setting up
Windows. When you reboot the machine, you should allow automatic
updates when prompted, which is the recommended action.
4. Install anti-virus software. Symantec AntiVirus is available on
the IUware CD, and is configured to update virus patterns daily.
Self-service unblock
Self-service is great…but
• Need to prevent abuse of trust
– Track instances of repeat-offenders
and treat them differently
– Require tutorial & quiz
– Delete registration so Get Connected
is required again
DMCA Quiz
Random comments about automation
• Good relationships with network staff
translates to access to tools.
– Null-route
– MacMon
– Arpfind
– Router Configs
– Syslogs
– Dialup, VPN blocks
– etc.
Random comments about automation
• Access to tools allows automation:
– Block scanners, phishers, bruteforcers, etc.
• Blocking remainder of leases
Automate Response – IR Web Service
Identify user
User is blocked and notified
Final Thoughts
• 802.1x rolling out now
– 2,700 WAPs by fall
• Dean of Students NAC
– Third copyright violation results in
permanent ban from attaching
personal device to University network
Questions
Jonny Sweeny
[email protected]