University of Alaska System and UAF Information Technology

University of Alaska System and UAF Information Technology Security Review 2007

The CH 2 M HILL - Coalfire Systems Team The CH 2 M HILL Team delivers industry-leading Information Technology (IT) security services. l The Team has delivered more than 300 IT security assessments and remediation planning engagements to clients, including recent projects for: 4 University environments, including the University of Colorado and California systems 4 States of Colorado, Florida, Iowa, Oregon, and Oklahoma 4 County and City governments in multiple states 4 U. S. Department of Energy, Centers for Disease Control and Prevention 4 Hundreds of banks and financial institutions 4 Hospitals and health insurance companies l ATTWP_101_1 l Apply methodologies that enable transfer of knowledge and enhance client capability for ongoing IT security programs

Compliance Trends A Brief History of Regulatory Time 2000 Present 1970 -1980 ü COPPA ü USA Patriot Act 2001 ü EC Data Privacy Directive 1990 -2000 ü Privacy Act of 1974 ü CLERP 9 ü Foreign Corrupt Practice Act ü CAN-SPAM Act of 1977 ü FISMA ü Sarbanes Oxley (SOX) ü CIPA 2002 ü Basel II 1980 -1990 ü EU Data Protection ü NERC 1200 (2003) ü HIPAA ü CISP ü FDA 21 CFR Part 11 ü Payment Card Industry ü C 6 -Canada (PCI) ü GLBA ü California Individual ü Computer Security Act of 1987 Privacy SB 1386 ü State Privacy Laws

Project Overview Project activities for the Information Security Review included: l l l Evaluate the University’s business practices and procedures. Make recommendations for improving business processes. Ensure adequate controls are in place to protect Confidentiality, Integrity, and Availability. Identify vulnerabilities, determine their risks, and make recommendations to resolve or mitigate those risks. Project methodology l l l Internal and External Vulnerability Scans. System Baseline analysis. Interviews with Critical Business owners. Compare findings against a set of Common Control Objectives. Areas reviewed included Data Management Policies and Practices, the IT Security Program, Networks, Identity Management Directory, Authentication and Authorization Services, Database, Application Development/Support, Windows and Unix Servers, Desktop Support, Data Center Operations, Help Desk, and Telephony.

COBIT Maturity Model Level 1 Control objective documented in a security policy Level 2 Security controls documented as procedures Current Level of the University Control Design Adequacy Level 3 Procedures have been implemented Level 4 Procedures and security controls are tested and reviewed Level 5 Procedures and security controls are fully integrated into a comprehensive program Control Effectiveness

Vulnerability Scans Project activities for the Information Security Review included: l l l Internal scans were used to evaluate the effectiveness of controls from threats internal to the University (employee or contractor). External scans were conducted to assess the University’s vulnerabilities from an untrusted network, such as the Internet. UAF provided CH 2 M HILL with a list of 137 systems to assess. Hosts were grouped into Windows and Unix systems, and reports were generated separately. Level Urgent Critical High Medium Low Vulnerability/Possible Vulnerability Intruders can easily gain control of the host, which can lead to the compromise of your entire network security. For example, vulnerabilities at this level may include full read and write access to files, remote execution of commands, and the presence of backdoors. Intruders can possibly gain control of the host, or there may be potential leakage of highly sensitive information. For example, vulnerabilities at this level may include full read access to files, potential backdoors, or a listing of all the users on the host. Intruders may be able to gain access to specific information stored on the host, including security settings. This could result in potential misuse of the host by intruders. For example, vulnerabilities at this level may include partial disclosure of file contents, access to certain files on the host, directory browsing, disclosure of filtering rules and security mechanisms, denial of service attacks, and unauthorized use of services, such as mailrelaying. Intruders may be able to collect sensitive information from the host, such as the precise version of software installed. With this information, intruders can easily exploit known vulnerabilities specific to software versions. Intruders can collect information about the host (open ports, services, etc. ) and may be able to use this information to find other vulnerabilities.

Vulnerability Scans (Internal) Unix Group 1 Vulnerability Possible Vulnerability Informational Findings Urgent 0 1 N/A Critical 2 5 N/A Risk Levels High 5 13 0 Medium 16 4 5 Low 2 0 22 Urgent 4 2 N/A Critical 9 4 N/A Risk Levels High 19 7 13 Medium 28 6 71 Low 4 5 103 Windows Vulnerability Possible Vulnerability Informational Findings

Vulnerability Scans (External) Unix Group 1 Vulnerability Possible Vulnerability Informational Findings Urgent 0 9 N/A Critical 1 10 N/A Risk Levels High 9 13 0 Medium 11 4 1 Low 3 0 3 Urgent 0 1 N/A Critical 1 5 N/A Risk Levels High 5 11 0 Medium 11 3 1 Low 2 0 3 Windows Vulnerability Possible Vulnerability Informational Findings

Vulnerability Scans Recommendations l l l l Document any known suspicious ports for future scans. Focus on High, Critical, and Urgent vulnerabilities first. Only support strong encryption protocols (SSLv 3, SSHv 2, 3 DES, AES, etc. ) Never use default SNMP strings (Public, Private) Ensure all applications are part of a vulnerability management program, not just OS’s. If patches cannot be deployed on schedule, document the business justification. Conduct periodical (typically quarterly) network scans, both Internal and External (Nessus, Qualys, Ne. Xpose, Retina, ISS, GFI, etc. ) Establish a secure baseline configuration (CIS Benchmarks, NSA, DISA, Vendors)

Common Controls Definition l l Each area was assessed against a set of 42 common control objectives. Each control objective was mapped to regulatory requirements, best practices, and guidelines: ISO 17799 (International Organization for Standards) COBIT 4. 0 (Control Objectives for IT and Related Technology HIPAA (Health Insurance Portability and Accountability Act) NIST 800 (National Institute of Standards and Technology) GLBA (Gramm-Leach-Bliley Act ) PCI DSS (Payment Card Industry Data Security Standard)

Common Controls Recommendations l 42 Control Objectives Reviewed l Low Risk – 10 areas meeting control objectives 4 Network admins have implemented appropriate security practices 4 Avoid access creep, maintain appropriate service levels, and conduct regular system maintenance. l l Medium Risk – 31 areas partially meeting control objectives 4 Missing one or more elements vs full compliance 4 Correct by conducting a comprehensive risk assessment, establishing additional security policies, and creating a business continuity plan based on a business impact analysis. 4 No “quick fixes” and requires long term commitments High Risk – 1 area did not meet control objectives (Media Disposition and Sanitization) 4 Lacking an information classification program, sensitive data inventories, and destruction standards for all media 4 University may not be able to detect if sensitive data is compromised or lost, or to minimize the potential impact of a data breach.

Action To Date l Done or in process 47 of 32 Identified Risks to be resolved by January, 2008 4 Action plan for remaining 25 in process l l Media disposition and sanitization options under review To be done 4 External security reviews for UAA and UAS 4 Place vulnerability scans and other security reviews on a regular schedule 4 Identify where regulation or policy may be needed

Security Program Resource Impact Heroic Period Security dependent on Individuals. Limited documentation, training and testing. Migration Intensive effort applied to conduct risk assessment, develop policies, deploy controls, and establish accountability. Sustaining Period Security dependent on processes and controls Security Premium • Documentation • Training • Policies and Procedures • Audit and Reporting • Testing Function Growth • Growth in users • Expansion of applications • Extended services Budget $ 2003 2005 2007 2009 Time 2011 2013 2015