uw network security2003

Terry Gray

University of Washington

Computing & Communications

17 October 2003

UW campus network (backbone)

borderrouter

borderrouter

backbone switches

~ 30 level one routers

subnets (733 total; 150 c&c); over 60,000 live devices

UW campus network (typical subnet)

Level One Router

Aggregation Switch

Edge Switch Edge Switch Edge Switch

campus subnets are a mixture of• shared 10Mbps• switched 10Mbps• switched 10/100Mbps

network facilities

typical core routers

campus network traffic

Pacific Northwest Gigapop

The PNW’s access point to next generation Internets, including Internet2, high performance USA Federal Networks, and high speed commodity Internet

A high speed peering point for regional and international networks

R&D testbed inviting national and international experimentation with advanced Internet-based applications

Pacific Northwest Gigapop

uwborder

uwborder

3 diverse network providersInternet2national & internat’nl nets

•Internet2 2.5Gbps (10Gbps upgrade underway)•Three different 1Gbps connections to the Internet•Multiple gigabits of connections to other networks

30+ networkcustomers

K-12 (307)

Community/Technical College (73)

Public Baccalaureate (50)

Library (65 in process)Independent Colleges (9 approved)

K20 Network Sites

seven security axioms Network security is maximized when we assume there is no such

thing. Large security perimeters mean large vulnerability zones. Firewalls are such a good idea, every computer should have one.

Seriously. Remote access is fraught with peril, just like local access. One person's security perimeter is another's broken network. Isolation strategies are limited by how many PCs you want on your

desk. Network security is about psychology as much as technology

. Bonus: never forget that computer ownership is not for the feint-hearted.

credo

focus first on the edge(perimeter protection paradox)

add defense in depth as needed keep it manageable provide for local policy choice... avoid one-size-fits-all

gray’s defense-in-depth conjecture

MTTE (exploit) = k * N**2 MTTI (innovation) = k * N**2 MTTR (repair) = k * N**2

where N = number of layers

C&C security activities logical firewalls project 172 network infrastructure protection reverse IDS (local infection detection) auto-block; self-reenable traffic monitoring tools who/where traceability tools nebula proactive probing honeypots security operations training; consulting