# Presentation: 034340

## Security Essentials for Desktop System Administrors

## Outline

- Why Computer Security
- Fermilab Strategy:
- Integrated Computer Security
- Defense in Depth
- Your role and special responsibilities as a user and system administrator
- Other Computing Policy Issues
- Data backup
- Incidental use
- Privacy
- Offensive material
- Licensing

## Why Computer Security

- The Internet is a dangerous place
- We are constantly being scanned for weak or vulnerable systems; new unpatched systems will be exploited within minutes.
- Fermilab is an attractive target
- High network bandwidth is useful for attackers who take over lab computers
- Publicity value of compromising a .gov site
- Attackers may not realize we have no information useful to them

## Why Computer Security - 2

- We need to protect
- Our data
- Our ability to use our computers (denial of service attacks)
- Our reputation with DOE, Congress and the general public
- Major sources of danger
- Running malicious code on your machine due to system or application vulnerabilities or improper user actions
- Carrying infected machines (laptops) in from off site

## FNAL Strategy

- Integrated Security Management
- Defense in Depth
- Perimeter Controls and auto blocking
- Mail gateway virus scanning
- Strong Authentication (Kerberos)
- Critical System plans
- Critical vulnerabilities
- Prompt response to computer security incidents (FCIRT)
- Intelligent and informed user community

## Integrated Security Management

- Computer Security is not an add-on or something external, it is part and parcel of everything you do with computers (analogy with ES&H)
- Not “one-size-fits-all”, but appropriate for the needs and vulnerabilities of each system
- In most cases, it is simply common sense + a little information and care
- Each Division/Section or large experiment has a GCSC (General Computer Security Coordinator) who acts as liaison with the Computer Security Team in disseminating information and dealing with incident; see _[http://computing.fnal.gov/security/](http://computing.fnal.gov/security/)__ for an up to date list_

## Strong Authentication

- Avoid disclosure of passwords on the network
- No network services (logon or read/write ftp) visible on the general internet can be offered with out requiring Kerberos authentication (unless a formal exemption is applied for and granted)
- Kerberos provides a single sign in, minimizing use of multiple passwords for different systems
- Lab systems are constantly scanned for violations of this policy

## Critical Systems

- Defined as “critical to the mission of the Laboratory”, i.e. disruption may have major impact on Laboratory operations;
- Most things do *not* fall in this category;
- Special (more stringent) rules & procedures apply;
- Including periodic reviews;
- You’ll know if you’re in this category;

## Critical Vulnerabilities and Vulnerability Scanning

- Certain security vulnerabilities are declared critical when they are (or are about to) being actively exploited and represent a clear and present danger
- Upon notification of a critical vulnerability, systems must be patched by a given date or they will be blocked from network access

## Computer Security Incidents

- Mandatory incident reporting;
- Report all suspicious activity:
*If urgent* to FCC Helpdesk, x2345, 24x7
*Or* to system manager (if immediately available)
- Non-urgent to computer_security@fnal.gov
- Incidents investigated by Fermi Computer Incident Response Team (FCIRT);
*Not* to be discussed!

## FCIRT (Fermi Computer Security Incident Response Team) 

- Security experts drawn from throughout the lab
- Investigate (“triage”) initial reports;
- Coordinate investigation overall;
- Work with local system managers;
- Call in technical experts;
- May take control of affected systems;
- Maintain confidentiality;

## Other Rules for General Systems

- “Blatant disregard” of computer security;
- First time warning, repeat offense disciplinary action;
- Unauthorized or malicious actions;
- Damage of data, unauthorized use of accounts, denial of service, etc., are forbidden;
- Ethical behavior;
- Same standards as for non-computer activities;
- Restricted central services;
- May only be provided by Computing Division;
- Security & cracker tools;
- Possession (& use) must be authorized;

## Mandatory System Manager Registration

- System managers must be registered with FCSC
- See: http://www.miscomp.fnal.gov/sysadmindb

## Your role as a user and system administrator

- Sysadmins are on the “front line” of computer security:
- “Fermilab’s continuing policy has been to put its first line of defense at the individual responsible for the data and the local system manager.”
- Three roles for a sys admin:
- System manager (configure system, remove unneeded services, apply patches promptly);
- examples for users;
- vigilant observers of system (and sometimes user) behavior
- Sysadmins are expected to communicate computer security guidelines and policies to the users of systems they administer;
- Most important: know how to tell what services are running on your desktop, turn off those not needed, know where you are getting your patches from (FERMI domain, Patchlink, yum, Microsoft, ...)

## Role of sysadmins

- Manage your systems sensibly, remaining aware of computer security while conducting everyday business
- Advise and help users
- Keep your eyes open
- Report potential incidents to FCIRT
- Act on relevant bulletins

## Your role as a computer user

- Guard against malicious code in email
- Don’t open attachments unless you are sure they are safe
- Don’t trust who email is from
- Updated and enabled virus signatures
- Guard against malicious code from web browsing
- Obey Strong Authentication Policy (Kerberos)
- Don’t run network services (login or read write ftp) unless they demand Kerberos authentication
- Treat your kerberos password as a sacred object (never expose it over the network)
- Promptly report potential computer security incidents
- X2345 or _[computer_security@fnal.gov](mailto:computer_security@fnal.gov)_
- Follow FCIRT instructions during incidents (especially about keeping infected machines off the network and preserving the status of an infected machine for expert investigation)

## Other Computing Policy Issues

- Data backup
- Incidental use
- Privacy
- Offensive material
- Licensing

## Data Backup Policy - Users

- Users (data owners) responsible for determining:
- What data requires protection;
- How destroyed data would be recovered, if needed;
- Coordinating backup plan w/ sysadmins;
- or doing their own backups;
- If the backup is done for you it might be worth occasionally checking that you can really retrieve the data

## Incidental Computer Usage

- Fermilab permits some non business use of lab computers
- Guidelines are at _[http://computing.fnal.gov/security/ProperUse.htm](http://computing.fnal.gov/security/ProperUse.htm)_

## Activities to Avoid

- Large grey area, but certain activities are “over the line”;
- Illegal;
- Prohibited by Lab or DOE policy;
- Embarrassment to the Laboratory;
- Interfere w/ performance of job;
- Consume excessive resources;

## Privacy of Email and Files

- Fermilab normally respects the privacy of electronic files and email;
- Employees and users are required to do likewise;
- Certain exemptions for system managers and computer security response;
- All others *must* have Director(ate) approval;

## Privacy of Email and Files

- May not use information in another person’s files seen incidental to any activity (legitimate or not) for any purpose w/o either explicit permission of the owner or a “reasonable belief the file was meant to be accessed by others.”
- Whether or not group/world accessible;
- “Group” files implicitly may be used by the group for the mission of the group;

## Offensive Material on computers

- Many “computer security” complaints are not;
- Material in a computer is like material in a desk;
- With respect to both privacy and appropriateness;
- This is a line management, not computer security, concern (except in egregious cases).

## Software Licensing

- Fermilab is strongly committed to respecting intellectual property rights
- Any use of unlicensed commercial software is a direct violation of lab policy

## Questions?

- _[gaines@fnal.gov](mailto:gaines@fnal.gov)_
- _[nightwatch@fnal.gov](mailto:nightwatch@fnal.gov)__ for questions about security policy_
- _[Computer_security@fnal.gov](mailto:Computer_security@fnal.gov)__ for reporting security incident_
- _[http://computing.fnal.gov/security](http://computing.fnal.gov/security)_