校園網路資訊安全威脅與應用技術探討陳家慶 Jacob Chen 02

校園網路資訊安全威脅與應用技術探討 • • 陳家慶 (Jacob Chen) (02) 27961666#204 BS 7799# 802 Jchen@fortinet. com

AGENDA § § § 校園網路安全機制 Zero-Day Attack 時代來臨多層次網路安全防護介紹個人防毒防駭管理 Instant Messaging (IM) and Peer 2 Peer (P 2 P) Q&A CONFIDENTIAL

校園網路安全機制

校園網路安全防範體系 l 電腦安全的模型包含四個主要部分： • Policy(安全策略 ) Protection • Protection(防護 ) • Detection(檢測 ) • Response (回應 ) Policy Response l 防護、檢測和回應組成了一個所謂的 “完整的、動態 ”的安全迴圈，在安全策略的整體指導下保證資訊系統的安全。 Detection

動態的網路安全管理 • 網路安全防範體系應該是動態變化的。 • 安全防護是一個動態的過程，新的安全漏洞不斷出現，駭客的攻擊手法不斷翻新，而校園資料中心自身的情況也在不斷地發展變化，在完成安全防範體系的架設後，必須不斷對此體系進行及時的維護和更新，才能保證網路安全防範體系的良性發展，確保它的有效性和先進性。

網路安全管理示意圖 • 網路安全防範體系構建是以安全策略為核心，以安全技術作為支撐，以安全管理作為落實手段，並通過安全培訓加強所有人的安全意識，完善安全體系賴以生存的大環境。 • 安全體系的示意圖安全培訓安全管理安全評估防火牆入侵偵測漏洞補強安全服務 (支援廠商)

安全技術層 • 最底層是安全技術層：常見的安全技術和具主要包括防火牆、安全漏洞掃描、安全評估分析、入侵檢測、網路陷阱、入侵採證、備份恢復和病毒防範、漏洞補強等。 • 這些具和技術是網路安全體系中最直覺的部分，缺少任何一種都會有巨大的危險，因為網路安全防範是一個整體概念。但是校園網往往經費有限，不能全部部署，這時就需要我們在安全策略的指導下，統一規劃、分步實施。在網路安全體系中它們不能簡單地堆砌，而是要合理部署，相互聯動，形成一個靈活的防護機制。

安全管理 • 安全管理：安全管理貫穿整個安全防範體系，是安全防範體系的核心。代表了安全防範體系中 ”人 ”的因素。 • 安全不是簡單的技術問題，不落實到管理，再好的技術、設備也是徒勞的。一個有效的安全防範體系應該是以安全策略為核心，以安全技術為支撐，以安全管理為落實。安全管理不僅包括行政意義上的安全管理，更主要的是對安全技術和安全策略的管理。通過安全制度的落實，獲得有效的網路安全保障。

安全培訓 • 安全培訓：最終用戶的安全意識是資訊系統是否安全的決定因素，因此對校園網路用戶的安全培訓是整個安全體系中重要、不可或缺的一部分。

安全服務 • 安全服務：這是學校網路管理的一個重要的方面，透過網路安全服務商，定期對教育網、各區網路中心及其直屬學校的網路管理人員、安全管理制度、網路設備進行安全巡查、技術諮詢和技術檢測，對發現的問題及時解決。 • 安全服務內容包括以下幾個方面： – – – 系統級安全服務應用級安全服務客戶級應用安全服務

安全政策的制訂 • 安全策略的制定校園網通過教育城域網、電信 VPN、有線電視網等多種形式與國際網相聯。在安全結構上可以分為三級；市級教育網網路中心、區級教育網路、學校校園網，安全結構覆蓋了中小學。使用的作業系統包括 Windows server 2000、 Linux、 Windows XP等；使用的應用軟體主要包括 SQL Server、 IIS等。 • 安全體系與安全目標各級網路在出口加裝防火牆、防病毒，保證所有的機器都受到保護，能夠抵禦一般水準的駭客和病毒攻擊；實現完善的安全審計和採證機制，保證受到入侵和不良資訊損害後有記錄可供查詢。鑒於大多數安全事件來自于管理員的安全管理政策制訂不周。因此，在明確事故責任上可建立安全預警系統，抵禦較高水準的駭客攻擊。同時，明確擬訂資料中心內伺服器的安全優先順序等。

Education Network Security Solution _ Fortinet 20050523 Internet TANET Backbone 1 校務行政 Services FG 3000 adds Antivirus & IDS/IDP protection at Internet as transparent mode behind existing firewall 3 3 2 2 DMZ FG 800, provides Antivirus, IDS/IDP and Firewall protection, and traffic shaping functionality for dorms TS 1 Dorms FG 500 A adds Antivirus, IDS/IDP protection for Application services Labs 5 College building 5 Core Network 4 Data Center FG 400 A add Antivirus, IDS/IDP as transparent mode behind existing Firewall 4 連線學校網路安全 6 FG 60 X 132台防毒. 防入侵攻擊 Firewall, p 2 p, skype FG 3000 provides in-line firewall, Antivirus, IDS/IDP , Firewall functionality to data center

安全技術的應用及安全具的部署 • 在區域網的入口架設防火牆，並實現 VPN的功能，在網路入口處建立第一層的安全屏障， VPN保證了管理員在家裏或出差時能夠安全接入資料中心。利用防火牆的網段隔離功能，設置 DMZ區。使用入侵監測系統對資料中心內的所有資料流程動進行即時檢測。使用認證伺服器對資料存取進行統一的認證。在資料中心建立病毒控管中心，達到網路防病毒功能，為資料中心和校園網路接入終端提供防毒服務。根據功能將伺服器劃分成伺服器群，使用多級防火牆實施進一步的保護：二級防火牆保護資料庫系統和應用伺服器群。使用安全日誌及評估伺服器保護關鍵日誌，方便管理員管理，並作為採證的依據。通過統一的漏洞補強伺服器，完成網內系統軟體的升級和漏洞自動補強。

安全管理制度的形成與發展 • 安全管理貫穿安全防範體系的始終。僅有安全技術防範，而無嚴格的安全管理體系相配套，是難以保障網路系統安全的。必須制訂一系列安全管理制度，對安全技術和安全設施進行管理。實現安全管理必須遵循可操作、全局性、動態性、管理與技術的結合、責權分明、分權制約及安全管理制度化等原則。 • 透過安全管理制度，使各級管理人員在網路安全的重要性方面，有了統一的認識，對網路安全的責任更加明確。建立了以網路、系統管理員為中心的日常安全管理流程，並根據日常的安全管理作情況去優化網路安全體系，從而保證了整個網路安全體系的動態性和有效性。

安全培訓與用戶服務 • 最終用戶的安全意識和技術能力是校園資訊系統是否安全的決定因素。因此對校園網網路管理員和最終用戶的安全培訓是整個安全體系中重要、不可或缺的一部分，特別是在目前病毒氾濫的大環境下，通過定期培訓、及時發放病毒警告通知、敦促大家務必做到漏洞補強等方法，增強安全意識，進而提高整個網路的安全性。

校園網路安全最終目的 • 應該說明的是，校園網路安全需要在教育城域網、區級網、校園網三級系統上，建立統一的安全管理技術方案，制定有效的安全策略，形成統一的安全服務體系，是我們最終的目標。

無時差攻擊時代來臨 --Worm_ZOTOB (Zero Day Attack)

Network Security Market Eco. System Industry Moving Towards Appliances With Greater Functionality Unified Threat Management Appliances CAGR: 80. 1% PROJECTED GROWTH 2003 – 2008 E SCM Appliance CAGR: 54. 1% SCM Services CAGR: 50. 3% Messaging Security Corporate Firewall Desktop Network ID&P Appliance User Provisioning Web Filtering Host ID&P Antivirus Advanced Auth. Hardware Auth. Tokens HIGH Directory Services Enterprise VPN/Firewall Software PKI Security Mgmt Vulnerability Mgmt LOW Host SSO Firewall Hardware Legacy Auth. Web SSO Network ID&P Software Consumer Firewall Desktop INDUSTRY CONCENTRATION Note: Industry concentration values denote sectors where the top 3 vendors combined hold between 15% market share (low concentration) to 85% market share (high concentration). Security management market includes security information event management, patching and remediation, forensics, policy and compliance, security systems and configuration management. Source: IDC and BAS estimates.

Zoto. B 病毒成因及分析 • Zoto. B病毒利用了 8月 9日微軟發布的即插即用 (PNP)中的漏洞（MS 05 -039）微軟發布安全公告 , 在後短短的 4天之内即出現. 一週內就幾乎出現了近十種有不同感染途徑的變種 • 2004/8/13 Zoto. B. A -- 攻擊 MS PNP漏洞 • 2004/8/15 Zoto. B. C -- Email • 2004/8/16 Zoto. B. D – Netbios/SMB, Email, MSN …

Zoto. B 病毒成因及分析 • 修改系统的 host文件，添加如下内容： Botzor 2005 Made By. . Greetz to good friend Coder. Based On Hell. Bot 3 MSG to avs: the first av who detect this worm will be the first killed in the next 24 hours!!! 127. 0. 0. 1 www. symantec. com 127. 0. 0. 1 securityresponse. symantec. com 127. 0. 0. 1 www. sophos. com 127. 0. 0. 1 sophos. com

近年來重大攻擊事件

保護你的電腦關鍵三步驟 ---

UTM Gateway : A New Generation of Security Platforms Hacker X X X Forti. Gate Internet X www. find_a_new_job. com www. free_music. com www. pornography. com Real-Time Content Security at the Network Edge Email Spam Banned content Viruses worms Intrusions

Complete Content Inspection - Why firewall is not enough DATA PACKETS STATEFUL INSPECTION FIREWALL http: //www. freesurf. com/downloads/Gettysburg Four score and BAD CONTENT our forefathers brou ght forth upon this continent a new nation, Inspects packet headers only – i. e. looks at the envelope, but not at what’s contained inside n liberty, and dedicated to the proposition that all üOK üOK Not Scanned Packet “headers” (TO, FROM, TYPE OF DATA, etc. ) CONFIDENTIAL Packet “payload” (data)

Deep Packet Inspection DEEP PACKET INSPECTION Performs a packet-by-packet inspection of contents But can easily miss complex attacks that span multiple packets Undetected http: //www. freesurf. com/downloads/Gettysburg üOK Four score and BAD CONTENT our forefathers brou ! ght forth upon this continent a new nation, üOK n liberty, and dedicated to the proposition that all • Fragmentation can hide malicious content • True security relies on multiple security layers üOK

Complete Content Inspection COMPLETE CONTENT PROTECTION 1. Reassemble packets into content http: //www. freesurf. com/downloads/Gettysburg Four score and BAD CONTENT our forefathers brou ght forth upon this continent a new nation, n liberty, and dedicated to the proposition that all DISALLOWED CONTENT Four score and seven years ago our BAD CONTENT forefathers brought forth upon this BAD CONTENT NASTY THINGS NASTIER THINGS !! CONTENT BAD a new liberty, and dedicated to the proposition that all… !! ATTACK SIGNATURES 2. Compare against disallowed content and attack lists

內容安全保護的疑慮 • 需要完整的內容重組 – 在主機 /個人電腦端重組 – 需要即時的更新 /防護軟體 , 可否即時獲得保護 • 防毒 /個人防火牆的特徵值 (signatures) – 使用該台電腦的資源 • 消耗網路資源 – 即使即時阻絕感染 , 但是仍耗費了網路資源

Complete Content Protection Requires Enormous Processing Power A Multi-Layered Security Solution is Required Email Spam 1000 10 PROCESSING POWER REQUIRED 100 Complete Content Protection Inappropriate Web Content Worms Trojans Viruses Sophisticated ntrusions Deep Packet Inspection Denial of Service Attacks Simple Intrusions Stateful inspection 1 1990 1995 2000 2005

Multi-Layered Security Requirement - A collection of best in class security applications • Firewall • Antispam – Defend against intrusions • Antivirus – Protect email from virus infection • IPS – Protect against malicious attacks – Reduce unwanted email • Web filters – Eliminated unproductive webbrowsing • VPN – Delivering secure remote access VPN URL Filters Antivirus Firewall Servers IPS Antispam Users

Multi-Layered Security – Advantages and Disadvantages • Advantage • Competitor Disadvantages – Provides comprehensive security approach – Minimizes down-time from individual threats – Requires multiple products – Increases network complexity and operational cost – Does not defend against “blended threats” VPN URL Filters Antivirus Firewall Servers IPS Antispam Users

Multi-Layered Security - The Fortinet approach • Advantage • Competitor’s Disadvantage – Provides comprehensive security approach – Minimizes down-time from individual threats – Requires multiple products – Increases network complexity and operational cost – Does not defend against “blended threats” VPN URL Filters Antivirus Firewall Servers IPS / IDS Antispam Users

Forti. Gate Antivirus Firewalls - A new generation of security solutions • Advantage – Provides comprehensive security approach – Minimizes down-time from individual threats • Forti. Gate Unified Threat Management Solutions – – – Firewall (ICSA Certified) Antivirus (ICSA Certified) IPS (ICSA & NSS Certified) URL filtering Antispam VPN (ICSA Certified) Servers “Fortinet, with the only ASIC based Antivirus accelerated UTM appliances, led the UTM market with a 29. 5% share of the worldwide market. ” -- IDC, 2004 Users

Fortinet Developed Products for Complete Real Time Network Protection Best-in-Class Applications Included in Every Forti. Gate Forti. OS Operating System

多層次網路安全防護介紹

多層次防護 (IDS/IPS) Ø • • • IDS/IPS Antivirus Features Web (URL) Filtering VPN

WHY IDS ? What does IDS work ? Performs specific packets inspection and behavior analysis 1. Signature http: //www. freesurf. com/downloads/Gettysburg IDS üOK Four score and BAD CONTENT our forefathers brou ! 2. Behavior üOK ght forth upon this continent a new nation, n liberty, and dedicated to the proposition that all

Intrusion detection highlights • ICSA certified & NSS proven • High speed performance – ASIC-based IDP – Real-time detection • Signature database of 1, 700 known hacker attacks • Timely and automated updates of attack signatures – Through the Forti. Protect Distribution Network • Customizable e-mail alerts – Alerts can be filtered to avoid generation numerous, redundant alerts from a single attack • Very easy to configure and easy to maintain • Dramatically lower cost than stand-alone NIDP

多層次防護 (Anti. Virus) • Ø • • IDS/IPS Antivirus Features Web (URL) Filtering VPN

Protocol-based Antivirus Benefits • According to protocol – to adapt different kinds of file format or Characteristic of different application. i. e. like compression file type , ZIP, RAR…. outlook, outlook express or Unix Mailbox • IM/P 2 P Scanning – Including MSN, Yahoo Msg, AOL ….

Antivirus highlights • Only ICSA-certified hardware-based AV gateway • Scanning method – Signature based – Macro scanning • Scanning efficiency – Contextual scanning – compare data with the appropriate method and the appropriate portion of the database according to the nature of the data • High performance – – Only solution ASIC-accelerated for real-time scanning Scans real-time (Web) traffic without noticeable delay No other gateway AV product can match performance 5 x to 10 x more performance than conventional software solutions

Antivirus highlights • Supported protocols: – Email traffic: SMTP, POP 3, IMAP – Web traffic: HTTP (content, downloads, and web mail) – FTP traffic – Support non standard ports (SMTP, POP 3, IMAP, HTTP) – IM/P 2 P • Transparent to end users – No special configuration on the client side (requires no proxy setup) – Quarantine service of infected files • Customized replacement messages (mail, FTP, Web)

多層次防護 (Content Filter) • • Ø • IDS/IPS Antivirus Features Web(URL) Filtering VPN

The Fortinet Solution: Forti. Gate Antivirus Firewalls + Forti. Guard Service • No additional hardware required • No need to download large database to Forti. Gate units • URL ratings are always up to date • Local Forti. Gate caching of ratings greatly improves performance • Forti. Gate solution also scans HTML content for keywords/phrases • Lower cost • Multi-language recognition • Reduction in false positives – Policy-based IPS applies scanning only where needed Forti. Guard Web Filtering Solution Internet es ch ” m at y co m gor n. m cn co te w. n. S ca ww cn w. EW w N “w the ? = URL requests from users are checked against internal cache in Forti. Gate unit – if not yet rated, Forti. Gate unit sends rating request to Forti. Guard hosting site Forti. Gate unit allows or denies page based on requestor’s Content Profile Forti. Guard URL Database Forti. Guard Hosting Sites (data mining) (Worldwide)

Web Filtering Policy Actions Category Groups Individual Categories

Forti. Net 多層次防護 (VPN) • • • Ø IDS/IPS Antivirus Features Web (URL) Filtering VPN

Firewall/VPN Benefits • Reliable Network Protection – The best first layer of defense against the worst network condition • Fast response to threats – Integrated management of AV, FW, NIDS and NIPS • Investment protection – Sits transparently behind another vendor’s firewall • VPN Support – – IPSEC VPN : Site to Site VPN , Site to Client VPN SSL VPN (3. 0) PPTP/ L 2 TP User Authentication : Local, RADIUS, LDAP(AD included)

為何需要 SSL VPN? • 降低網管人員負擔 – 無需安裝客戶端軟體 • 降低網管人員遠端軟體故障排除作 – SSL 可輕易的穿過大多數防火牆 • 降低產品間的整和性困難 • 安全性的加強 – 策略性的控管 – 進而針對應用程式，甚至控管各別的 URL。

SSL VPN 優點 • 有完整內容過濾的存取 – 深層檢測 SSL VPN用戶流量 – 檢測 SSL VPN用戶流量無惡意的內容 – 具下列多種保護 : • 防毒 , 入侵防禦 , 防火牆 , 內容檢測 , 垃圾郵件過濾多重防禦引擎偵測及阻絕惡意內容使用者建立 SSL VPN連線 Corporate LAN VPN 流量解密 SSL VPN Users 和檢測 Forti. Gate System

個人防毒防駭管理

保護你的電腦關鍵三步驟 ---

Forti. Client V. 20 產品特寫 Ø 業界最先進的桌面 (Client端 )安全防護解決方案. 整合 : VPN, 防毒 , 防駭 , 個人防火牆 , Web內容過濾防護之完整安全防護產品. (Anti-Spam 功能 coming soon) Ø 移植大型安全閘道器之掃瞄偵測引擎技術 - 掃瞄效率超高 - 偵測能力超強 - 防護功能完整 Ø 直覺式介面 , 設定及操作容易而不減損功能之完整性

Forti. Client Overview << 四大功能 >> 1 2 Anti. Virus 防毒 , 防駭 3 Firewall 個人防火牆 4 Web. Filter 網頁內容過濾 General 主畫面 VPN 虛擬私人通道 Update 病毒碼更新設定 Log 安全防護記錄

Anti. Virus Features

Anti. Virus Features • Passes VB 100 Certification – Product ready Anti. Virus feature • Completed AV + Grayware detection • Code emulator – Provides polymorphic virus detection – Used to extract virus body from “morphed” code – Also used as generic extraction engine • Repair engine – Provides virus cleaning capabilities

Anti. Virus Features • Optimized AV engine – Scan files – Scan Grayware - Spyware (間諜軟體 ) - Adware (廣告軟體 ) - Dialer (偷撥軟體 ) - Key Logger (鍵盤記錄 )

Firewall Features

Firewall Features • Intrusion detection – Block common network attacks without signatures – Improves performance • Fully Qualified Domain Name (FQDN) support for: – Blocked addresses – Address groups – Service groups

View Connections Like as netstate -a

Firewall Features • Intrusion detection – Block common network attacks without signatures – User configuration options for detected intrusions • Trust • Block • Don’t trust

Configurable Firewall Rules • User can define personal firewall rules • Source and Destination – Existing zones – IP addresses / groups • Protocols • Times

Web Filtering / Popup Blocker

Web Filtering ( 閘道型設備等級之 URL內容過濾功能 ) • Web Filter 內容分級過濾 Password Control >>同時滿足企業與家用之需求 <<

Web Filter Block Sample

Log Features

LOG Feature • Provide - AV - Firewall - VPN -Web. Filter - Schedule - Update all information • Export as Log file

Instant Messaging (IM) and Peer 2 Peer (P 2 P)

IM and P 2 P Support • Statistics – Record cumulative statistics for all IM & P 2 P traffic – Extended statistics & reporting will be done by the Forti. Log. • Logging – Log IM & P 2 P communications • Control – Explicitly allow or deny IM and P 2 P communications (including partial blocking of various parts of the application, such as file blocking). – Ability to view & block current IM users or block new user connections for a particular IM application

IM/P 2 P Traffic Control • IM/P 2 P – Blocking & Rate Limiting – IM/P 2 P policies provide blocking and rate limiting controls

IM/P 2 P Replacement Messages • Provides message response to IM/P 2 P access

IM/P 2 P Logging • Logging of IM/P 2 P usage • IM fields include: – – – – Date Time IM (MSN, Yahoo!, AIM, ICQ, etc) Sender (username) Receiver (username) Message (truncated) Attachment (indicates file sent)

IM/P 2 P User Control • User details are available – Administrator can view active users per protocol – Controls can be created from active users • White list / black list concept

Why UTM? • Proven Experience & Leading in the Security Gateway Market - 80, 000 units deployed - No. 1, 29. 5% market share in UTM, IDC 2004 report - 台中縣網 167台 , 清華大學 , 淡江大學 , 靜宜大學 , 成功大學 , 台北縣網 , 宜蘭大學 , 佛光大學 , 40餘所大專院校 • Best Performance in IDP / Antivirus Security Gateway - 10 x performance in Antivirus - 50% reduce cost • Certified - 5 x ICSA certified – Antivirus, NIDS, Firewall, IPSec. VPN, SSLVPN - NSS, EAL 4+, FISP certified • 2004年資策會票選第 1 名 Security Gateway & MIS Manager Best Choice • 2005年 NBL 交大網路測試中心第 1 名 - 防毒網安設備測試評比

台灣多層次防火牆領導品牌根據 IDC 2004 最新報導， FORTINET在 UTM 市場以 29. 5% 取得第一名市場佔有率 1 ‘第一名 ’

Many Awards and Industry Certifications

FORTINET 資訊網路安全解決方案 Forti. Protect 提供 7 x 24 即時安全防護與應變中心 Forti. Mail提供垃圾郵件管理 Fort. Log提供完整的安全紀錄與詳盡的統計分析報表 Forti. Manager提供集中控管與設定服務 Forti. Gate ASIC Base 全系列網安閘道器 FG 50 A/60/100 A/200 A /300 A/400 A/500 A/800 /3000/3600/ 4000/5000 滿足顧客網安需求與高速效能 Forti. Client提供 desktop Person firewall & 防毒防駭與 VPN 服務

Global Infrastructure Ensures Rapid Response to New Threats More than 10 Fortinet Threat Response Teams and Forti. Guard Distribution Servers - Automatic AV & IDP Updates Can Reach All Forti. Gate Units Worldwide in Under 5 Minutes - Real Time Protection for Antispam & Web Content Filtering Services Forti. Guard Center Web Portal & Email Bulletins

The New Generation of Security Solutions

Fortinet Differentiators - Products, Technology, Service & Support And Lowest Total Cost of Ownership

Thank You!

校園網路資訊安全威脅與應用技術探 討 陳家慶 Jacob Chen 02

校園網路資訊安全威脅與應用技術探討陳家慶 Jacob Chen 02