Date post: | 26-Dec-2015 |
Category: |
Documents |
Upload: | easter-hopkins |
View: | 213 times |
Download: | 0 times |
HQ U.S. Air Force Academy
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
1
Rich Mock
USAFA CIO
8 Apr 2008
Academic Freedom vs
Network Security
HQ U.S. Air Force Academy
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
2
or…
Can You Have Too Much Security?
I n t e g r i t y - S e r v i c e - E x c e l l e n c e 3
Overview
AF Mission – Air Force BaseUSAF Academy Mission IT EnvironmentsConflictSolutionsUSAF vs Academy Approach IssuesExamplesConclusion
I n t e g r i t y - S e r v i c e - E x c e l l e n c e 4
Air Force Mission
Deliver sovereign options for the defense of the United States of America and its global interests -- to fly and fight in Air, Space, and Cyberspace.
Vision: Global Vigilance, Reach and Power.
I n t e g r i t y - S e r v i c e - E x c e l l e n c e 5
Fairchild AFB, Washington
Air Mobility Command 92nd Air Refueling Wing (35 KC-135s) Operations Group Maintenance Group Medical Group Mission Support Group
Civil Engineer Squadron Communications Squadron
Park University, SIUC, Webster
I n t e g r i t y - S e r v i c e - E x c e l l e n c e 6
USAF Academy Mission
To educate, train and inspire young men and women to become officers of character motivated to lead the United States Air Force in service to the nation.
Academics (4 year university) Athletics (NCAA Div I) Military (active duty USAF)
I n t e g r i t y - S e r v i c e - E x c e l l e n c e 7
USAFA Organizations
President – Superintendent Provost - Vice Superintendent Student Body - Cadet Wing (4400) Commandant of Cadets – military training Dean of Faculty Athletic Department Prep School Research Centers Support Organizations Medical + Hospital Flying Training
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
AF Base IT Environment
Locked down desktop computers Boundary protection
Firewalls, proxy servers, anti-virus Software Patches & Scans Policies & Procedures System Certification & Accreditation Authentication (CAC and strong password) No entertainment (work environment only) Network Control: Base, Intermediate, AF
8
I n t e g r i t y - S e r v i c e - E x c e l l e n c e 9
USAF Academy IT Environment
Students issued desktop PCs (1986) High speed network installed, all academic
buildings & dorms (1993) Cadet notebooks (2001) Wireless network (2002)
Tablet computers (2006) No commercial ISP for cadets
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
Natural “Enemies”
Cops vs Robbers Cobra vs Mongoose Security vs Academics
Stability Innovation
Few changes Experimental
Less access More exchange of information
Proven solutions Research new ideas
10
I n t e g r i t y - S e r v i c e - E x c e l l e n c e 11
The Problem
MIL network has become too restrictive Cadet computers are a security risk Faculty – restrictions prevent doing job Long software approval process No access for cadets away from USAFA DOD blocks ‘bad actor’ countries Poor access for International researchers
and cadets AF prohibits commercial e-mail and IM Cadets use computers for non-duty activities Integrated NOSC removed local control
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
“Green Banner” Strong Passwords Blocking unused ports Patches Wireless security Proxy filter too restrictive Long software approval process No default HTML view in email Standard Desktop Configuration (SDC)
Specific Examples
12
I n t e g r i t y - S e r v i c e - E x c e l l e n c e 13
AF. EDU
Air Education and Training Command Establish and maintain one “af.edu”
domain. … without exposing the af.mil network to security risks.
Members are students and faculty at the United States Air Force Academy, the Air Force Institute of Technology, and the Air University system.
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
AF.EDU Solution
The collaboration infrastructure: MS Office SharePoint Service 2007 Enterprise MS Live Communications Server MS Exchange 2007
20 TB 36 TB storage Primary data location is in San Antonio, Texas
Backup data location is in Missouri Multiple redundant backups
I n t e g r i t y - S e r v i c e - E x c e l l e n c e 15
USAFA Approach
Use DREN as service provider for EDU Request policy relief
SDC exception Software approval process DREN firewall exceptions Collaborative tools
Separate EDU (DREN) & MIL (NIPRnet)
I n t e g r i t y - S e r v i c e - E x c e l l e n c e 16
Before (1992-2006)
Admin Exchange Domain CtrlsFile Servers
Faculty
Athletics
Cadets
Medical
Staff
Finance
USAFAnet
DREN NIPRnet
Internet .mil
I n t e g r i t y - S e r v i c e - E x c e l l e n c e 17
During (2006-2007)
Admin Exchange Domain CtrlsFile Servers
Faculty
AthleticsCadets
Medical
Staff
Finance
DREN NIPRnet
Internet .mil
USAFAnet
I n t e g r i t y - S e r v i c e - E x c e l l e n c e 18
After (July 2007)
Faculty
AthleticsCadets
Medical
Staff
Finance
DREN NIPRnet
Internet .mil
USAFA.EDU USAFA.MIL
ExchangeAdminExchangeFile Servers File ServersDomain Ctrls Domain Ctrls
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
The Good, Bad & Ugly
EDU is physically separate! (24 Jul 07) AF is more secure
Teamwork-- One Team, One Fight! Migration took 30+ minutes per user X 6000 Still many problems: Global Address List… Kiosks as interim solution AF Transformation reducing manning External DoD changes
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
Password Progression
Username only Simple passwords – user created Weak password rules – e.g. 8 characters Expiration times – e.g. 60 – 180 days Computer generated Strong passwords with symbol combinations Time and place restrictions Biometric or Smartcard
20
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
Smart Card Implementation
AF Common Access Cards (CAC) - PKIExpense of cards ($ and manpower)Certificate Authority Implementation Problems:
Bad cards Bad card readers Middleware Locked accounts Lost cards
21
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
Software Approval
Defense Information Assurance Certification & Accreditation Program (DIACAP)
Designated Accreditation Authority Certification Authority Information Assurance Manager Information System Owner 4-6 months
22
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
Collaborative Tools
AF Prohibition Instant Messaging VoIP (Skype)
Desktop Video-conferencing Blogs and Chats DoD Solution
IBM Same Time Adobe Connect
23
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
Internet Blocking
MIL & EDU both block Porn, Gambling, Hate Crimes, Criminal Skills
MIL blocks, but EDU allows Chat, Games, Lifestyle, Mature, Medical, MP3 IM, Facebook, YouTube
Problem areas Anonymizer, P2P, File Sharing, Games, Skype MySpace, YouTube – malware problems
24
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
Network Access Control
Comply & Connect at least a year away Host Based Security System SMS System Center Config Manager National Institute of Standards and
Technology Tools Learn from civilian institutions
Required antivirus Updated patches
25
I n t e g r i t y - S e r v i c e - E x c e l l e n c e
Conclusion
Can you have too much security? YES!
How do you know when you to stop? When the “pain exceeds the gain” Users work around it to get job done
Sell the change – communicate w/ users! Incremental changes are easier to sellConvey the threat and risk
If you can’t sell it, then drop it.26
I n t e g r i t y - S e r v i c e - E x c e l l e n c e 27
Questions