CS460 Final Project Service Provider Scenario

1. David Bergman Dong Jin Richard Bae Scott Greene Suraj Nellikar Wee Hong Yeo Virtual Customer: Mark Scifres CS460 Final ProjectService Provider Scenario

2. Introduction Scenario Overview Security Policies Design Overview Firewall Router CALEA

3. Scenario Overview Customer: CMOT, mid-level Internet service provider Goal of New Architecture Ease of use and low maintenance Comply with Rules-CALEA Limiting bad traffic from customers New profitable security services

4. Scenario Overview Requirements of ISP environment High uptime, Good quality Avoid Denial of Service (DOS) attack Customers Segmentation Protecting customers from other infected customers (virus, spam)‏ Preserving confidentiality of information among customers, and between customers and CMOT Protecting privacy

5. Security Policies Purpose is to protect assets customer personal information customer usage data company documents quality of service Guideline Recommended Internet Service Provider Security Services and Procedureshttp://www.isi.edu/in-notes/rfc3013.txt

6. Security Policies • How to prevent traffic taking unauthorized routes into or via your network? • Are the networks that support your production services, your server customers, and your transit customers segmented? • How to protect your Internet facing equipment providing production services from attacks such as Denial of Service attacks,break-ins or spoofing? • Do you have a monitoring system that detects host and/or network attacks? • How do you notify customers of security vulnerabilities in the services you provide?

7. Design Overview DMZ (Servers)‏ Cisco PIX Firewall Gateway Internet Cisco 2600 Routers Client Hosts

8. Component - Firewall By default denies all incoming traffic, only permitted clients-initiated connections Protect the internal network from DOS attacks. Network Address Translation (NAT)‏ limited routable address exposed to the external world private addresses from a pool for the customers Prevent smurf attacks by dropping packets with unknown source ip Authenticate, authorize and account (AAA) users accessing servers in DMZ Disable source routing to prevent inside hosts from circumventing the firewall

9. Component - Router Vlans provide traffic isolation among hosts keep servers and the hosts separate prevent spreading of virus or attacking the internal network prevents packet sniffing from malicious users inside the network QoS provide different levels of service for the customers. Monitor bandwidth usage to detect if the tenants are running outside of their agreements

10. Component - Others Generates syslogs and store in a syslog server for monitoring purposes Provide wiretapping facility to adhere to CALEA Promptly apply security patches and updates on the network devices Ensure hosts have the latest antivirus softwares installed

11. CALEA CALEA Overview Communication-Identifying Information (CII) dialed digits (voice calls)‏ subject login (data)‏ network addresses (data)‏ content of communications audio content of voice call packets to/from subject [source: Educause - Industry technical strategies, approaches and challenges associated with CALEA compliance (ID: NMD0613)]

12. CALEA Required Features Active interception and passive collection of both telephony and IP transmissions Data and voice interception High availability and backup mechanisms ETI Connect, SS8, Verint provide CALEA compliant solutions

13. CALEA • Options we considered • Active 'fingerprinting' of traffic • Recording the IP addresses of every communication • Our final decision included • Record all MAC->IP allocations • Record full traces at sample periods with short windows • Allow access to LE for real-time sampling

14. An Update on CALEA CALEA Implementation Cisco’s LI (Lawful Intercept) Architecture Source: www.ilstu.edu/tsac/docs/CALEA_2006.ppt

15. Conclusion Scenario Overview Security Policies Design Overview Firewall Router CALEA

16. Questions?