Security

Strong Host Based Security

We strongly recommend that all LAWN users practice strong Host Based Security on their devices. This includes running a personal firewall, using secure services, keeping current on operating system and application patches, and running an up to date virus scanner. Details on these are available on the OIT Website.

Port Blocking

When the Department of Homeland Security issued an advisory about Microsoft's RPC vulnerability, several units expressed concern over the security of our Local Area Wireless Network (LAWN). Due to the inherent insecurities of wireless networks, they should often be treated as untrusted networks. As such, we will be implementing the same filters on the LAWN that exist at our campus borders. The impact of blocking these ports will be loss of access to some applications, such as Windows File Sharing. The following blocks were put in place at 8AM on 8/13/03:

Login Hijacking

Because of the architecture of the LAWN network, there is a chance that someone may try to fool your computer into contacting a rogue server and presenting you with a fake LAWN login screen. The purpose behind such an attack would be to gain your login and password.

Though LAWN may look on the surface to be susceptible to such an attack, if you pay attention to how your browser presents the LAWN login screen, you can avoid being fooled. You should look for two things:

• First, check to see that the your browser URL matches exactly:
  
  https://auth.lawn.gatech.edu/lindex.php
  
  Pay close attention to the https:// prefix. It must say https:// and not http:// .If your browser displays anything other than the above URL, do not log in. Report the problem to the OIT Technology Support Center (404-894-7173, support@oit.gatech.edu).
• Make sure that your browser creates the https:// connection cleanly, without any warning messages. If, after clicking the Login button, you get a pop-up message alerting you to any warning or error, do not log in. The warning may say something like "The name on the security certificate does not match the name of the site" or "The security certificate was issued by a company you have not chosen to trust..." or something similar. Report the error to the OIT Technology Support Center (404-894-7173, support@oit.gatech.edu).

Use of Insecure Services

Many frequently used Internet protocols (e.g. http, POP, IMAP, telnet, ftp) transmit account and password information in "clear text", unencrypted. The danger of this is that anyone with a machine on the same network as a machine using those protocols can easily acquire any login and passwords sent using those protocols (e.g. If you use Eudora to POP email while using LAWN, someone can easily steal your login and password that you use to access your email server). LAWN is a shared network. Using unencrypted protocols on just about any shared network (including LAWN) places you at risk and is a bad idea. The following table offers safe alternatives for the most common protocols:

What is Inbound Service Security ?

Inbound Service Security (ISS) uses stateful packet inspection to help protect your LAWN connected device from hacking/virus attacks originating from outside of the LAWN network.

When Inbound Service Security is enabled for your LAWN session, hosts outside of the LAWN network are blocked from connecting to services running on your machine. For example, if your LAWN connected device is running a web server, with Inbound Service Security enabled, hosts not on the LAWN network will not be able to connect to your machine's web server.

A service can be provided by any application on your machine which listens for and accepts TCP connections to your machine by another host. Because these services commonly present vulnerabilities which hackers exploit, and are often unintentionally enabled, it is in your best interest, security-wise, to use Inbound Service Security when logging into LAWN. ISS will be enabled for your LAWN login session unless you check the "disable Inbound Service Security" box on the login form.

Note that Inbound Service Security is not a complete security solution; you should make sure your computer is up to date with vendor supplied patches, disable any unnecessary services, and utilize a personal firewall.

If you have reason to offer services from your LAWN host to users outside of the LAWN, you can disable the default blocking behaviour via the checkbox on the LAWN login page, or by passing the proper arguments if you use the command line login method. By disabling this safeguard, you accept full responsibility for the increased risk associated with allowing connections to your machine. Please note that disabling Inbound Service Security security allows for the outside-of-LAWN access to any TCP port in use by any service on your machine.

What is the Vulnerability Scanning Beta?

If enabled we will scan your host for vulnerabilities and send you an email with the results. The scan will be light weight and should not affect performance. When this service goes into production it will be enabled by default; however, it will only scan periodically, not every time you login. By participating in this Beta you are helping us to determine the most effective scans to execute, the appropriate responses to scan results, and the interval at which we should scan. You may be contacted as part of your participation in this Beta feature.

We welcome input into our Security forum. Please feel free to add to the forum below in regard to security related topics. Our hope is that a contribution from the campus will enrich the information of this site for all to benefit.

Please note that the forums are not meant as a replacement for the official OIT help system REMEDY (which can be reached via email ... support@oit.gatech.edu ... or via web at http://remedy.gatech.edu/request.html).