La securite dans tous ses etats

+

Simon FRANCOISResponsable Réseau et Sécurité

www.segi.be [email protected]

La sécurité dans tous ses états

11/03/2014

1

+.: We don’t mess with Security :.

© 2013 SEGI ULg – Simon FRANCOIS

2

+.: Agenda :.

n General Security Basics

n Threats

n Hints and Best Practices

n An eye on ULg

n Responsibilities


3

+.: Basics : the Triad :.

n CIAn Confidentialityn Integrityn Availability


4

+.: Basics : Broad Spectrum :. according to CISSP CBK


n Access control

n Software development

n BCP & DRP

n Cryptography

n IS Governance and Risk Management

n Legal, Regulations, Investigations, Compliance…

n Security Operations

n Physical (Environment) Security

n Security Architecture and Design

5

+.: Basics : Deeper in Access Control :. according to CISSP CBK


6

+.: Basics : not that obvious :. according to Sean Bean


7

+.: Agenda :.


n Threats


n An eye on ULg

n Responsibilities


8

+.: Threats : they are Legion (1) :.

© 2014 SEGI ULg – Simon FRANCOIS9

+.: Threats : they are Legion (2) :.

© 2014 SEGI ULg – Simon FRANCOIS10

+.: Threats : sad truths :. It’s a trap!


n80% of the exploits rely on well known weaknesses thathaven’t been addressed (Source : Verizon 2013Q4)

nBiggest flaw is the human factor

nYou won’t stop a determined hacker ; you play a game where he’s one step ahead

11

+.: Agenda :.


n Threats


n An eye on ULg

n Responsibilities


12

+.: BP : the cost of security :.How valuable are your assets ?


99% -

100% -

Percentage of blocked threats

Risk = (Vulnerability * Exposure) -‐ Security

13

+.: BP : every layer its job :.

n Let firewalls and routers deal with IP. Not your code, not your server.

n Let centralized services (AAA, monitoring) deal with their responsibilities. Not your code.

n Let the OS libraries do their job. Don’t override if not vital.


14

+.: BP : Secure everything :.

n Security must become a reflex actionn Don’t add security a posteriorin Think, build and develop with security in mind

n Use TLS as often as possiblen As a client : chose smtpS, imapS…n As a provider : force httpS, Sftp…

n AAA your usersn No anonymous connection (unless public)n Keep track and liability


15

+.: BP : Logs! Logs! Logs! :.

nKeep logs of everythingn Network devices, servers, OS events, personal

computers, applications…n Only way to analyze, understand, a posteriori

nUse accounting for users’ activityn Liability

nLegal matters

nHave your logs analyzed by software

16

+.: Agenda :.

n General security basics

n Threats

n Best practices

n An eye on ULg

n Responsibilities


17

+.: Information System @ ULg :. Systems side

n 2 datacenters with High Availabilityn 2 secured rooms, distant from 3kmn Many 10Gbps direct optical fibersn NetApp Metrocluster

n 260 TB storage, 150TB VTL

n Super calculator (1920 cores ; 7,7TB RAM)

n >1,000 servers

n > 95% virtual

n All above hosted @SEGI ! Many more across Campus…


18

+.: Information System @ ULg :. Network side

n 50,000 network access wall plugs

n 1,800 WiFi access points

n 500 switches ; 15 core routers (10Gbps partial mesh)

n > 30 firewalls

n 2 next generation firewalls (NGFW) since 2009

n 2x 1Gbps through Belnet (> 20TB/7TB per month)

n Kind of Internet Service Provider


19


20

+.: Information System @ ULg :. Institutional security features

nVirtual network split (VLAN ; VRF)

nLocal firewalls

n Internet border firewalls and NG firewallsn IDS / IPS = Threat preventionn URL filtering : dangerous or dubious websites

nAntispam

nAntivirus


21

+.: Information System @ ULg :. Security side

nHundreds of thousands automatic attacks denied each… day.n SQL-Injection, brute force, C&C traffic, stack

overflow, SIP spyware…

nPhishing still works fine, at every attempt

nLocally managed servers are barely updated

nPersonal passwords : shared, easy to find…

nNo auth apps, infected BYOD…


22

+.: Agenda :.

n General security basics

n Threats

n Best practices

n An eye on ULg

n Responsibilities


23

+.: Responsibilities :.

nSecurity fails because of the weakest link

nà Security is everyone’s responsibility!

nWe want YOU to share, inform, educate, help, correct… others.


24

+ Q & A’s [email protected]


25

La securite dans tous ses etats

Internet

Transcript of La securite dans tous ses etats