Dartmouth College LANDesk Security Standards Program Case Presentation

1. Dartmouth College LANDesk Security Standards Program Case Presentation From Compromised to Confidence

2. An Introduction to Dartmouth College • Member of the Ivy League • Located in Hanover, New Hampshire • The nation's ninth-oldest college - founded in 1769 • Private, four-year, coeducational (since 1972) undergraduate college • Graduate schools of business, engineering and medicine and 16 graduate programs in the arts and sciences. • Colors are Dartmouth Green and white - nicknamed “The Big Green” • Famous Alumni: • Daniel Webster (1801) • U.S. Supreme Court Chief Justice Salmon P. Chase (1826) • Poet Robert Frost (1896) • Kanichi Asakawa, the founder of Asian Studies in the United States (1899) • E.E. Just, pioneering biologist (1907) • Theodor "Dr. Seuss" Geisel (1925) • Vice President Nelson Rockefeller (1930) • Former U.S. Surgeon General C. Everett Koop M.D. (1937) • Former U.S. Labor Secretary Robert Reich (1968) • Louise Erdrich, writer (1976)

3. From Compromise to Confidence:the beginnings of the Standards Program • Standards Program initiated 2 years ago • Beginning scope to create a standardized build of computers centrally managed via LANDesk (Administrative Computers and public kiosks) . • Infrastructure began with: • A DBMS Server (MSSQL) • A Core Server • Roll out clients Windows 2000 clients and Mac Clients (OS has changed since origination)

4. Idealized Preconceptions Hit Reality “I thought initially I would roll out the core, database and clients, build some packages and create a single image to deploy to my users using LANDesk. And just keep things orderly etc… Then I found out some things that shook my world.” Tim Chiacchira Enterprise Administrator Dartmouth College The Administrator’s Perspective: • Having migrated from a corporate to a college environment, I was thrust into a world with the following pre-existing conditions: • No border firewall! • No uniformed system build! • No security standards on machines! • No personal firewalls on servers or workstations! • No patch solution!

5. So what’s next? • Set up the LANDesk core and database server, right? But something kept happening to my server… I could not figure it out. • Services would stop… • The system kept rebooting… on and on… “What have I done wrong? … I have done this type of rollout in a larger environment. I swore someone was tampering with my boxes…” Tim Chiacchira

6. RX for the Pre-Existing Condition? An inventory scan on for every exe on both my LANDesk and Database servers revealed DameWare! Who has an administrativeaccount on my systems!!!!

7. RX for the Pre-Existing Condition: LANDesk! • Goal - Remove DameWare • How? Initiated a policy in LANDesk that when the DameWare application detected by LANDesk’s Software Licensing Monitor component: • stop DameWare’s execution & • run the DameWare removal package. • Next, install LANDesk client on all the Windows servers Who has an administrativeaccount on my systems!!!!

8. RX for the Pre-Existing Condition: LANDesk Outcome: • LANDesk discovered a severe compromise! • Movie pirates had been in existence for at least 1 year prior to my arrival at Dartmouth with 11 servers in all affected including the domain controller… Who has an administrativeaccount on my systems!!!! • The LANDesk policy removed and blocked the execution of the DameWare program! • Pirates continued toactively attempt reinstallation to substantiate their claim on our network.

9. RX for the Pre-Existing Condition: LANDesk Outcome (continued): • While we had no firewall on the border and windows ports were accessible (and the exe and files could be placed back on the server) with every new pirate attempt DameWare execution was thwarted and removed thanks to LANDesk. • The next step, we did purchase a border firewall and Sygate personal firewall. • LANDesk was already making our environment safer - but this was just the beginning. Who has an administrativeaccount on my systems!!!!

10. Wanted!More Than An Ounce of Prevention • LANDesk needed on all our most critical desktops. • 1,189 LANDesk clients on Administrative computers and public Kiosk machines • At this time did not have LANDesk Security and Patch Management (A.K.A. LANDesk Security Suite.)

11. I Policy-based Management • After LANDesk was deployed on all the Standards machines, we did the following: • Built an standardized image that included Sygate firewall, LANDesk and ensured it was NTFS. • A duel approach of deploying Sygate, using LANDesk to detect rogue EXE’s such as PWD.exe (Password Dump), Scan for remnants of virus infection with removal tools from Symantec deployed via LANDesk and blocking applications using softmon.exe - the software monitoring agent. • Utilized LANDesk to change security policy via registry change thus disallowing anonymous connections and enumeration of security accounts.

12. Thefoundation: OSD at a Glance • Next phase = upgrade everyone's image • Result accomplished easily using OSD (Operating Systems Deployment). • LANDesk provides two core ways to image or capture an image of a desktop. • PXE (Pre Execution Environment) • Agent-based OSD

13. The Foundation Improved • The uses of LANDesk up to this point: • OSD of a new more secure image • Inventory scanning provides information as to malicious executables on workstations.. • LANDesk to deploy patches and applications. • Remote control and support – In the last 7 months we have logged over 1,006 hours of remote control assistance. • Reporting is very flexible and powerful. And I can produce amazingly useful reports via LANDesk • “I have used other inventory tools and have found them wanting… And newer things coming out in LANDesk 8.6 are going to make reporting so wonderful… “ Tim Chiacchira

14. LANDesk Security Suite Arrives • I never knew how much I was missing in my environment until I implemented Security Suite in my Standards Program machines. • Dartmouth was formerly 100 percent vulnerable (spyware, malware, virus leftovers, security issues such as blank passwords, null shares, blank SA accounts on SQL servers, etc.) • “I just was one person trying to patch on the fly and do what I could. But this tool.. well…, LANDesk Security Suite showed me that one person cannot do it alone without such a tool as this.” • Tim Chiacchira

15. Vulnerable Systems Pre-LANDesk Security Suite Code RED “If I were to show you a chart of my vulnerable systems when I implemented LANDesk Security Suite, I would show you a red pie chart with no blue in it… The red indicating a 100% vulnerable system.” Tim Chiacchira

16. The State of Vulnerability 3 Days Post DeploymentLANDesk Security Suite Within 3 days of implementing LANDesk Security Suite into our infrastructure: • All machines with the exclusion of 12 stubborn machines (no fault of LANDesk) were patched (see remaining red below) • Spyware removed • Reports on security issues sent out and resolved • “I was proud, but also thankful as it could not have been accomplished without LANDesk.” Tim Chiacchira

17. Even still… • While machines are potentially vulnerable, they don’t remain in that vulnerable state but for an instant. That’s all the time it takes to remove cookies and patch them quickly by pushing out a new patch. • If Spyware is involved, it is summarily removed quickly - and if Spyware cannot be removed, support is dispatched. A desktop support representative is dispatched after having an email sent to them with the spec on the vulnerable machine. • “I just love it.”

18. Some Q & A • How many total computers campus-wide at Dartmouth? • 7,300 about 200 of which are servers. • How many of those have LANDesk Management Suite? A. 1236 including 87 Servers Q. How many have LANDesk Security Suite? • Currently 608 will be 6000 by the end of term. Q. Can you attach a dollar figure to anything in terms of savings? A. Thousands of patches deployed at once in one day.. Value = priceless... These tools have easily saved us from hiring 2 more techs.

19. A Summary of the Standards Program Success • This system demonstrated as completely effective. LANDesk, as one of Dartmouth College’s multi-layered security changes, has made our Standards environment stable. • The environment has now been extended to our Students, Staff and Faculty. • We purchased 6000 LANDesk Security Suite nodes to take advantage of this tremendous enterprise management toolset. • Our first 900 machines should be in the database working right now to give our client a stable working environment.