# Presentation: 310696

## National Energy Research 

**National Energy Research **
**Scientific Computing Center **
**(NERSC)**
**Computer Security – The New Threats**
- Stephen Lau
- NERSC Center Division, LBNL
- June 24, 2004

## Overview

**New Threats**
**Identity Theft**
**Email scams and viruses**
**Grid Security**
**Combating Threats**

## New Threats

**Threats are evolving**
**Response to protection measures**
**Increased use of encryption**
**Deployment of anti-virus**
**Increased use of social engineering**
**Security has become *****everybody’s *****responsibility**
**Important Defenses**
**Host level protection**
**User education**

## Identity Theft

**Someone uses your login credentials without your knowledge**
**Very difficult for system admins to detect**
**They look like you!**
**Feeds off of collaborative nature of high performance computing**
**Users have multiple accounts on massively shared systems**

## SSH Basic Overview

**Uses private/public keys**
**Encrypted authentication**
**Uses passphrase**

**Home**
**System**

**Remote**
**System**

**Remote**
**System**

**Private**
**Key**

**Public**
**Key**

**Public**
**Key**

## How Does It Happen?

**Internal System**

**Unsuspecting User**

**Attacker**

**Sniffed Traffic**

**Compromised**
**Host**

**Internet**

**Imposter**

**Home**
**System**

## Combating Identity Theft

**Reduce amount of stepping stone behavior**
**Not always possible**
**Be mindful of login times and hostnames**
**Don’t share accounts and passwords**
**Don’t place private keys and certificates on public systems or public directories**
**Report suspicious behavior**

## Encrypt All The Way!

**Home**
**System**

**NERSC**

**Remote**
**System**

**SSH**

**Telnet**
**rlogin**
**rsh**

**SSH**

**Use SSH across ALL connections**

## One Time Passwords

**Token based system**
**Many systems available**
**Many sites pushing ahead with deployment**
**NERSC actively investigating impact on users**
**Ideally, one token works across multi-labs**
**No active plans for deployment yet within NERSC**
**Not a cure-all solution!**

## Email Viruses

**NERSC has a virus filter for email **
**About 90% effective**
**Time lag between release of virus and signature development**
**Install anti-virus software on systems you use**
**Many sites have site licenses**
**Make sure it is kept up to date**

## Email Hoaxes aka Phishing

**Email poses as “Security Patch” or “Account Support”**
**Asks for username/password for “verification”**
**Requests that an attachment be run**
**Verify any attachment you are not expecting**
**NEVER give out your username/password.**
**When in doubt, please call NERSC support for verification**

## Grid Security

**Protect your private certificates!**
**Be mindful where you place them**
**Minimize amount of distribution**
**Remove them from systems you no longer use**
**Use strong passwords.**
**Use SSH to access sites with your Grid certificates!**

## Host Level Protection

***Please***** keep your systems up to date**
**Especially home systems and shared systems**
**Combats “identity theft” problem**
**Install anti-virus software**
**Primarily on Windows systems**
**Be aware of unexplained changes on your system**
**Odd performance**
**Strange windows appearing**
**System files changed unexpectedly**
**authorized_hosts file changes**
**Changes to /etc/password or /etc/shadow**

## User Education

***You***** are the first line of defense against incidents.**
**Take advantage of your site’s security training**
**Keep up to date about latest security news**
**Be mindful of security when accessing or using systems**

## Help Us Help You

**Report “suspicious activity”**
**Strange files or directories**
**Unusual login times**
**Unverified phone call from “NERSC” asking for passwords or account information**
**Report external incidents**
**Please report any incidents at sites that you use to access NERSC**
**Report incidents where you suspect credentials are sniffed or stolen**

## Help Us Help You

**Many incidents quickly become multi-site incidents.**
**Communication is key to containment.**
**Please report *****any***** incidents that you think might affect NERSC.**

## Contact Information

**Stephen Lau**
**1 Cyclotron Road, M/S 943**
**Berkeley, CA 94720**
**Phone: +1 (510) 486-7178**
**Email: slau@lbl.gov**
**PGP: 44C8 C9CB C15E 2AE1 7B0A 544E 9A04 AB2B F63F 748B**
**NERSC Computer Security**
**security@nersc.gov**
**1-800-666-3772**
**http://www.nersc.gov/nusers/security/**