January 2014 - USHE-assess - lists.utahtech.edu

Internal Scans
by Andrew Goble 24 Jan '14

24 Jan '14

I've reconfigured the nessus box and it now has an interface on our internal network. The scanner's IP is 144.38.66.25 and you can use addresses in the 144.38.66.24/29 range during the assessment. ( I can get more in the 66 VLAN as needed, may not be contiguous.) This is the building subnet in the Holland building. It does not, by default, have privileged access to all campus networks, but I have full confidence in your abilities to get beyond that, or in Chuck's words, make me cry. I have not moved the outside interface of the strike package, its still accessible on 205.126.0.222. Mark, how do you feel about starting the internal scan tomorrow morning? We've probably got enough lead time that we can start a scan now of the whole internal environment and have it done by the time you all are here Monday. If you aren't confident in that, let me know and I'll provide you a list of the most interesting subnets and we can run a couple scans. Thanks, Andrew

3 3

Dixie Documentation
by Andrew Goble 19 Jan '14

19 Jan '14

The Dixie Statement of Work / Rules of Engagement document is up in my home directory on USHEdump. It has our IP space for scans listed there. I'm thinking we should plan for an external scan early next week and internal scanning the weekend of the 25th. The SANS worksheet will be forthcoming in a day or two. Thanks, Andrew

4 5

Dixie Hotels
by Andrew Goble 17 Jan '14

17 Jan '14

Dixie's assessment is scheduled for January 27 - 31. Hotel reservations are at the Courtyard Marriott. Reservation for DAVE NIELSEN Confirmation Number: 89534538 Reservation for MARK WALTON Confirmation Number: 89534537 Reservation for CHUCK KIMBER Confirmation Number: 89534536 Reservation for DUSTIN UDY Confirmation Number: 89534534 Reservation for COREY ROACH Confirmation Number: 89534541 I'll start working on SANS 20 stuff, should get that to you guys after the new year. Thanks, Andrew

1 2

Weber Report - Update
by Andrew Goble 09 Jan '14

09 Jan '14

Alright, I've gotten stuff back from everybody and am putting the report together for a first draft. Andrea has a meeting with a committee on Thursday afternoon, she has requested a draft by then if possible. I will post a first draft late tonight or first thing in the morning for your review. Will let you all know when it's posted. You'll have roughly 24 - 36 hours to review it. We can make big changes if necessary even after I send it to Andrea, but it would be nice if you could all take a look sometime tomorrow to make sure there aren't major glaring problems. Also, Jake sent in a couple of positive findings that I think I'll include in the report. if you have any positive findings you wish to highlight, please send those to me ASAP. I plan on having a single section devoted to that, so I just need to know what the positive finding is and a real brief blurb about it. Thanks, Andrew

1 3

Weber Report
by Andrew Goble 08 Jan '14

08 Jan '14

I've got almost everyone's report material and I'm making an effort to get this report draft finalized in the next couple of days. I will send out the report draft when it is ready and will give you guys about 36 - 48 hours to review it before I forward it on to Weber. I may muck around with wording and structure in the write-ups you have all given me for consistency in voice and what not. If I completely mung up what you intended to convey to Weber let me know and we can re-work things. A couple of things related to the report that I need some feedback from you on: 1. Jake has suggested we put some high-level recommendations drawn from the rest of the report directly in the executive summary. We haven't really done this in the past, just summarized what the format of the rest of the report would be. If we start doing this, it should be really concise in my thinking, but could be something along the lines of recommending Two-factor authentication, seperate administrative accounts, banning of all wireless devices, etc. Let me know what you think should be in that section. 2. In the past, we have included verbatim from the SANS controls the "How attackers take advantage of the lack of these controls" and the SANS recommendations "How to Implement, Automate, and Measure the Effectiveness of this Control" as part of our write-ups on each SANS control. I'm toying with the idea of dropping this practice of directly quoting all the SANS stuff and moving it to the references section. This would require us to beef up our own recommendations and make sure we mention that they should review the references to the SANS material. Thoughts? Lastly, does anybody have a PDF copy of the 2012ish SANS controls laying around? They are up to version 4.1 and I know there are some differences in the versions I want to review. I haven't scoured the internet looking for the older version yet, will do if one of you can't bail me out. Thanks, Andrew

6 5

Weber Report
by Andrew Goble 02 Jan '14

02 Jan '14

Hi Guys, We need to get serious on getting a draft of the Weber report together, they are starting to ask about their report and when they can expect it. I've got some material back only from Dave at this point. Please get your materials together and send them to me. I'll compile and otherwise mangle them together and send out a draft for you to review before we provide it to Weber. I would like to have something to them by the end of next week at the latest. Thanks, Andrew

1 1