Network Policy

1. Network Policy (slides by Jeremy, Brian, and Daniel)

2. What Network Policy IS • Includes a set of preconditions required for network access and to maintain that access (access policy) • Some Examples: • Must be running the organization’s specified antivirus product with latest virus definitions • Must have personal firewall enabled • Egress/ingress, particular ports, protocols, etc. • Must pass a scan for known vulnerabilities (like CMU)

3. What Else Network Policy IS • Specifies access controls for systems and resources • Examples: • Bank teller can only connect to the bank network during regular business hours • Staff not employed by the payroll department must not access payroll records.

4. Anything Else? • What is allowed on the network • Hotmail, Ebay, Ameritrade, Pornography? • What is monitored • How long do you keep the logs • What do you do with them after that time period • Who handles these logs • Who is responsible for auditing them

5. Network Policy is NOT • A firewall, IDS, IPS, etc • A certification • Something you download and print • Something you purchase It is a custom tailored process!

6. The IKEA Analogy for Network Policy • No policy is like having no instructions for securing the network • Seems simple but actually a million complicated pieces with complex interactions • “Universal Tool” – Not the best solution • It works great until it falls apart and needs to be redone the right way • Find out what those extra parts do after the fact • Frustrating? • Quality Issues?

7. But Policy is Just Paper • True, policy needs to be enforced • People are either ignorant of or don’t care what is on the paper. • Survey: Who has knows CMU’s Network Policy? • How to enforce Network Policy? • Technology: firewalls, ACLs, Nessus, card readers, network monitors, encryption, active directory etc. • Can’t effectively deploy these tools without policy • Can’t build sturdy furniture (security) without directions(policy) • Policy = Directions

8. Designing Network Policy • Very specific to the organization’s needs • No “one size fits all” • Try to follow best practices • Least Privilege • Defense in Depth • ACTIVE MONITORING • Build this into the policy! • Threats constantly evolve, security must do the same.

9. The Case: Issues to Consider • Least Privilege • Sponsors – “What do you mean I can’t do xyz, I paid for this thing to happen!” • Money Talks, but making exceptions can break down security of entire system • People want money spent on something visible • Make case for security supporting visibility? Does it? • People want invisible security • If it is a hassle, they will circumvent it • Media – use venue as backdoor

10. More Issues: Insiders • Organizations implicitly trust them • Intimate knowledge of system and its weak points • May be sympathetic to protesters • Physical access to critical areas • Easy to plug in a rogue WAP on the wired network • Many new temporary employees • Where is their loyalty?

11. Showdown: Wireless Policy VS

12. Wireless Policy Considerations • Basic requirements for event • Can enough cable be run at the venue to support all wired connections? • Do the participants need wireless? Why? • Who is in charge? • Delegate who is in charge and who takes responsibility for problems • Establishes accountability and point of contact

13. What is the Risk? • Perform a Risk Assessment • Potential Threats: • DoS, Session hijacking, sniffing, MITM, ad-hoc connections • Wardrive/Warwalk to determine physical exposure • What is the wireless going to be used for? • casual websurfing (low risk) • Media/sponsor access (medium risk) • Confidential scheduling and voting (high risk) • How frequently to assess risk? • Do the threats outweigh the benefits? • See NIST 800-30 for more formal information

14. Consider Wireless Topology • Network Topology • Wireless as untrusted network • Wired as trusted network • Separate them with a gateway • Install filter to control/monitor traffic at that junction • Active monitoring goes in the wireless policy!

15. Other Considerations • How to Authenticate • Cost, ease of implementation, ease of use • PKI may be too much, Open may be too little • Maintaining Confidentiality • Encryption – WEP, WPA, IPSec • Selection based on sensitivity of data • Key management • How to distribute • Can we change it faster than it can be cracked? • Availability • Most noticeable • Productivity losses • Media backlash

16. No WiFi For You! • Do we allow it or not? • Is the threat greater than the benefit? • Difficult to quantify • Do we also allow limited wired access if wireless goes down? • What if wireless keys are shared with outsiders? • Many other “what if’s” • See NIST 800-48 for a wealth of information

17. This Can Be Really Tough! • Difficulty will cause users to circumvent security measures • Prepare for your first line of defense to fail (D.I.D.) • Perhaps we need something more rigorous • A formal framework with better metrics for making critical decisions

18. Conclusion • Are Network Policies such as the ones described tonight silver bullets?? • The answer is NO!!!!

19. Conclusion • These are guidelines that need to be enforced, understood, documented and evaluated constantly because the environmental variables (such as new technology) change over time