THE CENTER FOR INTERNET SECURITY Securing IT Systems

THE CENTER FOR INTERNET SECURITY Securing IT Systems with the Consensus Benchmarks and Scoring Tools Clint Kreitner www. cisecurity. org ckreitner@cisecurity. org 1 SM

Unfortunate, but true… “Through 2005, 90 percent of cyber attacks will continue to exploit known security flaws for which a patch is available or a preventive measure known. ” • Gartner Group, May 6, 2002 2

What is causing the vulnerabilities that are being exploited? n Software defects n n Fixed with vendor patches Lack of technical security controls Security settings made to enable or disable security features of the OS software n Think of them as software switches n 3

Examples of security settings n n n n Password length, complexity Account lockout after X attempts Audit what system events? Idle time before logoff Users allowed to install print drivers? What unneededservices to disable? File system to use? 4

Aren’t these standards adequate to improve user security practice? ISO 17799 n COBIT from ISACA n Sys. Trust, Web. Trust from AICPA n FISCAM from GAO n Principles and Practices for Security of IT Systems from NIST n Standard of Good Practice from ISF n 5

These standards are helpful, but incomplete They describe “what” to do, but not “how” n These standards are effective only when accompanied by details on how to implement their requirements n 6

An Example from ISO 17799 9. 7. 1 Event logging Audit logs recording exceptions and other securityrelevant events should be produced and kept for an agreed period to assist in future investigations and access control monitoring. Audit logs should also include: a) user IDs; b) dates and times for log-on and log-off; c) terminal identity or location if possible; d) records of successful and rejected system access attempts; e) records of successful and rejected data and other resource access attempts. 7

One of several actions needed to implement event logging on Sun Solaris systems: cat <<END_SCRIPT >/etc/init. d/newperf #!/sbin/sh /usr/bin/su sys -c "/usr/lib/sa/sadc /var/adm/sa/sa`date +%d`" END_SCRIPT chown root: sys /etc/init. d/newperf chmod 744 /etc/init. d/newperf rm -f /etc/rc 2. d/S 21 perf ln -s /etc/init. d/newperf /etc/rc 2. d/S 21 perf /usr/bin/su sys -c crontab <<END_ENTRIES 0, 20, 40 * * /usr/lib/sa/sa 1 45 23 * * * /usr/lib/sa/sa 2 -s 0: 00 -e 23: 59 -i 1200 -A END_ENTRIES 8

Why has it been so difficult to proliferate good security practice? Vendors have been shipping unconfigured systems to users with technical security controls turned off n Users don’t know how to properly configure their systems n Users are afraid to disrupt operations n n With patches or security settings 9

Microsoft Issues Patches, but Users Don’t Apply Them Forrester Research Report April 3, 2003 10

Responding to the challenge Cosmos Club meeting Aug 2000 n Need to develop and proliferate detailed technical best practices n § The only true solution is try to raise the bar everywhere--globally n Employ a consensus process to define best practices that is driven by security savvy users from the public and private sectors 11

The Center for Internet Security (CIS) Formed in October 2000 n Modeled after other community initiatives, e. g. , transportation safety n A not-for-profit consortium of users n Convenes and facilitates teams that build consensus benchmarks n 12

Some of the participants in the consensus effort: Government: § n n n n Nat’l Inst Stds & Tech. Infocomm Development Authority of Singapore Naval Surface Warfare Center US Treasury Financial Management Service Washington State Dept. of Health Defense Info Sys Agency (DISA) Federal Reserve System NASA n n n n n US Dept of Justice Library of Congress Royal Canadian Mounted Police Communications Security Establishment (Canada) Canadian CERT NSA GSA Fed. CIRC Dept Homeland Security State of Maryland 13

Participants (cont’d): Commercial: n n n Eastman Kodak SASKTel LG&E Energy Hallmark Intel Deutsche Telecom Caterpillar Baylor College of Medicine NCR Batelle U. S. Central Credit Union VISA n n n Thomson Holdings Pitney Bowes First Union Corporation Intuit Union Bank of California Swiss Reinsurance Co Elemica Online Resources Agilent Technologies Shell Info. Tech. Int’l People. Soft News Corporation 14

More (cont’d): Consulting/Service: n n n n n IBM Business Consulting Grant Thornton Deloitte Touche ISS Symantec Bind. View Net. IQ Secure. Net Solutions RDA Corp n n n n CSC Procinct Security Solutionary Polivec Mobile Automation Configure. Soft GFM Consulting 15

More (cont’d): Universities: § Institute for Security Tech. Studies at Dartmouth n n n n Virginia Tech Monash University (Australia) Illinois Institute of Technology University of Missouri William & Mary Utah State University of California, SF New York University 16

Auditing Participants n Information Systems Audit and Control Association (ISACA) n American Institute of Certified Public Accountants (AICPA) n Institute of Internal Auditors (IIA) 17

What has this public/private partnership produced so far? 18

Currently available: n Level I Configuration Benchmarks Solaris n Linux n HP-UX n Windows NT n Windows 2000 n Cisco Router IOS n 19

A Level I Benchmark: Can be implemented by a sysadmin of any level of security expertise n Can be monitored by a compliance tool n Is not likely to “break” any function n Represents a baseline level of security n 20

Currently available: n Gold Standard Benchmarks W 2 K Professional Level II n W 2 K Server Level II n CISCO Router IOS Level I/II n Solaris Level I n 21

Also currently available: n Configuration Scoring Tools Solaris n Linux n HP-UX n Windows NT n Windows 2000 Server n Windows 2000 Professional n Cisco Router IOS n 22

23

Under development: n Benchmarks and Scoring Tools for: n n n n n Oracle databases Apache Windows IIS Windows XP Windows Server 2003 Catalyst Switches PIX Firewalls Check Point FW-1 SQL Server Juniper Routers 24

How is this work being done? n n n Teams are formed with security experts from member organisations An initial benchmark draft is obtained or developed Consensus is established via email and conference call discussion A scoring tool is developed They are made available free to all users globally via the CIS website (www. cisecurity. org) 25

The good news… Case studies show that 80 -90% of known vulnerabilities are blocked by the security settings in the consensus benchmarks……. 26

Case Study Methodology (1) Scan a system “out of the box” and list identified vulnerabilities n (2) Configure the system with the appropriate benchmark n (3) Rescan the system and note the vulnerabilities remaining n 27

Vulnerability Assessment Case studies Study System % of Vuls Benchmark Eliminated Solutionary W 2 K Server Level I 85 Citadel W 2 K Pro Level I 81 NSA W 2 K Pro Level II 91 Mitre W 2 K Pro Level II 83 (CVE) Citadel W 2 K Server Level II 99 Citadel Red. Hat. Linux Level I 100 28

Encouraging progress: n n n U. S. government promulgation of CIS benchmarks and tools via Fed. CIRC VISA adoption of CIS benchmarks for its Cardholder Information Security Program’s Digital Dozen Progress at the vendor level n n Dell now delivering pre-configured systems Top security experts from Microsoft, Sun, HP, Cisco, and Oracle are active on the benchmark consensus teams 29

Benefits of using benchmarks and tools Substantially reduce the risk of unauthorized intrusion n Following a recognized patching and configuration standard demonstrates due care against legal liability n Provides a basis for ongoing measurement and reporting of security status to management n 30

Recommended policies: n n Use govt purchasing power to buy only benchmark configured systems from vendors Encourage corporate and other institutional buyers to do the same Establish benchmark compliance as an audit requirement Encourage users in all sectors to download and use the consensus benchmarks and tools 31

Thank you! ckreitner@cisecurity. org http: //www. cisecurity. org 32