November 2003 - Test - lists.nanog.org

Re: FW: Cost of Worm Attack Protection
by sgorman1＠gmu.edu 13 Nov '03

13 Nov '03

Ideally you would have a different metric for each AS type depending on their tolerance for risk. The lower the tolerance for risk the higher the investment made in security precautions. Unfortanately classifying 14,000+ AS's is taking a little longer than I thought, but that is the end goal. Hopefully another few weeks. Even once you have some type of classification schema ideally you still need some kind of cost metric you can scale. There is also the problem of data. The only solid data I've seen at the AS level to approximate size is number of connections to other AS's. I've seen some stats with number of servers at the AS level but not for the whole AS population. ----- Original Message ----- From: Sean Donelan <sean(a)donelan.com> Date: Thursday, November 13, 2003 5:35 pm Subject: Re: FW: Cost of Worm Attack Protection > On Thu, 13 Nov 2003 sgorman1(a)gmu.edu wrote: > > I guess the hypothetical would be if you were in charge of > security for > > an AS what would be the cost to put a best-effort worm > mitigation system > > in. > > What kind of AS? > > An AS used by a military organization that has authority over its > usersand can through them in the brig for failing to follow > commands and > policy? > > An AS used by a commercial enterprise that has authority over its > usersand can fire them for failing to follow commands and policy? > > An AS used by a university enterprise that has authority over its > usersand can expell them for failing to follow commands and policy? > > An AS used by a service provider that has authority over its users and > can terminate their network access for failing to follow commands and > policy? > > An AS used by a public agency that is required by law to permit all > citizens access to information until proven beyond reasonable > doubt the > access was misused? > > >

1 0

Re: FW: Cost of Worm Attack Protection
by sgorman1＠gmu.edu 13 Nov '03

13 Nov '03

I guess the hypothetical would be if you were in charge of security for an AS what would be the cost to put a best-effort worm mitigation system in. The second question being how would you scale that cost with the size of the AS. Maybe it is a case that there is not a best practice to fix a cost to, too much variability in the market and theories of how best to defend, if defend at all. Just figured it would be prudent to ask before we made something up - usually not such a good idea. ----- Original Message ----- From: kgraham(a)rogers.com Date: Thursday, November 13, 2003 4:40 pm Subject: Re: FW: Cost of Worm Attack Protection > > It would be great not to spend any money and let the worms run > their course. But when you have to deal with downed production at > the cost of give or take possibly 500K per attack it unfortunately > cannot be done without one loosing their job. The last worm that > spread throughout enterprises mentioned having to reinstall the > entire server. If that server is a critical production server > what would you do? > > Would spending 100K prevent the attack, very likely not. Would > spending 100K help track the offending machine(s) and enable > someone to remove them from the network until they are serviced, > possibly? > Would this help keep production rolling, possibly? > > The installation management and response time needed to implement > an IDS solution does have to be investigated to see if the ROI > comes in line with the cost. The ROI would need to include any > saved downtime. If someone has this information please pass it > along. > > A nicer solution would be an operating system that does not need a > critical patch every other week, due to it's exploitable nature. > > Yes I am dreaming :) > > Kim > > > > > From: "Braun, Mike" <MBraun(a)firstam.com> > > Date: 2003/11/13 Thu PM 03:02:59 EST > > To: "'nanog(a)merit.edu'" <nanog(a)merit.edu> > > Subject: FW: Cost of Worm Attack Protection > > > > > > The old saying of "you get what you pay for" seems to be well > directed when > > it comes to this topic. If you're willing to allocate $100K > more than you > > currently spend to mitigating the effects from Worms and > Viruses, I'm sure > > you will have some increased success. If you allocate 1 mill > more, your > > success will increase substantially. The true cost really boils > down to > > what you are trying to protect, such as how many servers, users, > network> segments, and other critical devices you are willing to > encompass in your > > protection plan. Also, you may be able to mitigate the cost by > using the > > functionality built into devices you may already own. A good > protection> schema needs to address the use and benefits from the > following: Firewalls, > > VPN tunnels and policies, HIDs, NIDs, Antivirus software, and a > good network > > security policy that grows with your network. You may already > have most of > > this in place and need only a little extra funding allocated to > give you the > > protection level you feel comfortable with. > > > > If you're looking for pricing on each component, they will vary > widely> depending on the brand and model you go with. You should > shop around for > > components that suit your budget. An example of this price > variance can be > > found by looking at a Net Forensics project priced at $500k > compared to a > > similar solution going will Network Intelligence at $40K. The > Network> Intelligence solution may not have all the functionality > offered by Net > > Forensics, but it may be enough for your needs. > > > > Best of luck in fighting this ever growing problem, > > > > Mike Braun > > > > -----Original Message----- > > From: sgorman1(a)gmu.edu [mailto:sgorman1@gmu.edu] > > Sent: Thursday, November 13, 2003 7:59 AM > > To: Joel Jaeggli > > Cc: nanog(a)merit.edu > > Subject: Re: Cost of Worm Attack Protection > > > > > > > > Good point - then what is the cost of attempting to mitigate or > handle> attacks vs. doing nothing? > > > > ----- Original Message ----- > > From: Joel Jaeggli <joelja(a)darkwing.uoregon.edu> > > Date: Thursday, November 13, 2003 10:14 am > > Subject: Re: Cost of Worm Attack Protection > > > > > I haven't seen any network or customer site that has protected > > > itself from > > > worms... only mitigated them. > > > > > > joelja > > > > > > On Thu, 13 Nov 2003 sgorman1(a)gmu.edu wrote: > > > > > > > > > > > > > > > I was hoping to get some estimates from folks on the costs > of > > > defending> networks from various worm attacks. It is a pretty > > > wide open question, > > > > but if anyone has some rough estimates of what it costs per > edge,> > > manpower vs. equipment costs, or any combination > thereof it > > > would be of > > > > great assistance. We are doing some simulations of attack > and > > > defense> strategies and looking for some good metrics to plug > into > > > a cost benefit > > > > model. We'd be happy to share the results if anyone is > > > interested as > > > > well. > > > > > > > > Thanks in advance, > > > > > > > > sean > > > > > > > > > > -- > > > --------------------------------------------------------------- > ---- > > > ------- > > > Joel Jaeggli Unix Consulting > > > joelja(a)darkwing.uoregon.edu > > > GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 > 35AB > > > B67F 56B2 > > > > > > > > > > > > > > > "MMS <firstam.com>" made the following > > annotations on 11/13/2003 12:03:21 PM > > ----------------------------------------------------------------- > ------------- > > "THIS E-MAIL MESSAGE AND ANY FILES TRANSMITTED HEREWITH, ARE > INTENDED SOLELY FOR THE USE OF THE INDIVIDUAL(S) ADDRESSED AND MAY > CONTAIN CONFIDENTIAL, PROPRIETARY OR PRIVILEGED INFORMATION. IF > YOU ARE NOT THE ADDRESSEE INDICATED IN THIS MESSAGE (OR > RESPONSIBLE FOR DELIVERY OF THIS MESSAGE TO SUCH PERSON) YOU MAY > NOT REVIEW, USE, DISCLOSE OR DISTRIBUTE THIS MESSAGE OR ANY FILES > TRANSMITTED HEREWITH. IF YOU RECEIVE THIS MESSAGE IN ERROR, > PLEASE CONTACT THE SENDER BY REPLY E-MAIL AND DELETE THIS MESSAGE > AND ALL COPIES OF IT FROM YOUR SYSTEM." > > > ==============================================================================> > > > >

2 1

Re: Cost of Worm Attack Protection
by Jamie Reid 13 Nov '03

13 Nov '03

While I can't give you a fixed cost, I can confidently say that the value or cost/benefit over time resembled a bathtub curve. It starts high, drops sharply close to zero, then climbs slowly over time as the infection rate dissipates while a fixed mitigation strategy is applied, with diminishing results. For blaster/nachi, we are starting to encounter side effects of the filters put in place, which is slowly incurring support costs as exceptions are made. -- Jamie.Reid, CISSP, jamie.reid(a)mbs.gov.on.ca Senior Security Specialist, Information Protection Centre Corporate Security, MBS 416 327 2324 >>> <sgorman1(a)gmu.edu> 11/13/03 09:35am >>> I was hoping to get some estimates from folks on the costs of defending networks from various worm attacks. It is a pretty wide open question, but if anyone has some rough estimates of what it costs per edge, manpower vs. equipment costs, or any combination thereof it would be of great assistance. We are doing some simulations of attack and defense strategies and looking for some good metrics to plug into a cost benefit model. We'd be happy to share the results if anyone is interested as well. Thanks in advance, sean

1 0

integrity ptp-10 modems
by Miguel Mata-Cardona 13 Nov '03

13 Nov '03

These are broadband, cablemodem point-to-point type. I have a couple of them that need to be fixed but the company seems to be disapeared. I would really appreciate if you know a lab or where can I send these for repair. Please contact me off-list, I don't want to increase noise. Thanks in advance. -- Miguel Mata-Cardona Intercom El Salvador mmata(a)intercom.com.sv voz: ++(503) 278-5068 fax: ++(503) 265-7024

1 0

RE: FW: Cost of Worm Attack Protection
by Braun, Mike 13 Nov '03

13 Nov '03

You misunderstood me if you though I was saying the key to this problem is to throw money at it. You can spend a load of cash and accomplish nothing. In fact, you can do far worse damage this way by giving you a false sense of security than if you did nothing at all. There is a right way to view security and a wrong way. If you let a couple fast talking sales people sell you their "kitchen sink" solution without the full understanding on your part as to what you've just purchased, or the understanding on how to install and maintain the product, then you don't belong in your company's security group and should look for a new line of work. I think we can all think of security installations or practices we've seen in the past that we can find fault in, or ones that are so bad they need to fire the security staff and reevaluate the entire infrastructure. The point I was making in my original email was that you need to understand your network. This includes the users and how they interact. You can spend $0 in the way of new hardware and instead work to change the bad habits of users on the network and be in a much more secure position months from now. By understanding your network and the security risks associated in each element, as well as the options available to closing (or mitigating) those security risks, you will find yourself in a better position to spend allocated funds more wisely. You'll never be able to make a network hacker proof, but you can work to mitigate risk to varying degree. Here is where the money comes in. How wisely you spend is up to you. Mike Braun -----Original Message----- From: Rob Thomas [mailto:robt@cymru.com] Sent: Thursday, November 13, 2003 12:56 PM To: NANOG Subject: Re: FW: Cost of Worm Attack Protection Hi, NANOGers. ] The old saying of "you get what you pay for" seems to be well directed when ] it comes to this topic. If you're willing to allocate $100K more than you ] currently spend to mitigating the effects from Worms and Viruses, I'm sure ] you will have some increased success. If you allocate 1 mill more, your ] success will increase substantially. The true cost really boils down to This sort of thinking, unsupported by any data, runs rampant in the security industry. I have yet to see anyone document the ROI on security tools and services. Do they help at all? Does an increase in security spending result in a decrease in pain? In some cases, as already documented here, an increase in security measures can actually increases costs. Let's not fall into the trap that more $$$ equates to greater security or awareness. I've seen many sites that installed numerous pods of the latest IDS at their borders, only to be owned from within or owned by a method not yet in the ever-behind signature database of the IDS devices. One can waste money on security just as easily as one can waste money on anything else. Thanks, Rob. -- Rob Thomas http://www.cymru.com ASSERT(coffee != empty); "MMS <firstam.com>" made the following annotations on 11/13/2003 01:54:54 PM ------------------------------------------------------------------------------ "THIS E-MAIL MESSAGE AND ANY FILES TRANSMITTED HEREWITH, ARE INTENDED SOLELY FOR THE USE OF THE INDIVIDUAL(S) ADDRESSED AND MAY CONTAIN CONFIDENTIAL, PROPRIETARY OR PRIVILEGED INFORMATION. IF YOU ARE NOT THE ADDRESSEE INDICATED IN THIS MESSAGE (OR RESPONSIBLE FOR DELIVERY OF THIS MESSAGE TO SUCH PERSON) YOU MAY NOT REVIEW, USE, DISCLOSE OR DISTRIBUTE THIS MESSAGE OR ANY FILES TRANSMITTED HEREWITH. IF YOU RECEIVE THIS MESSAGE IN ERROR, PLEASE CONTACT THE SENDER BY REPLY E-MAIL AND DELETE THIS MESSAGE AND ALL COPIES OF IT FROM YOUR SYSTEM." ==============================================================================

1 0

Re: Cost of Worm Attack Protection
by sgorman1＠gmu.edu 13 Nov '03

13 Nov '03

Good point - then what is the cost of attempting to mitigate or handle attacks vs. doing nothing? ----- Original Message ----- From: Joel Jaeggli <joelja(a)darkwing.uoregon.edu> Date: Thursday, November 13, 2003 10:14 am Subject: Re: Cost of Worm Attack Protection > I haven't seen any network or customer site that has protected > itself from > worms... only mitigated them. > > joelja > > On Thu, 13 Nov 2003 sgorman1(a)gmu.edu wrote: > > > > > > > I was hoping to get some estimates from folks on the costs of > defending> networks from various worm attacks. It is a pretty > wide open question, > > but if anyone has some rough estimates of what it costs per edge, > > manpower vs. equipment costs, or any combination thereof it > would be of > > great assistance. We are doing some simulations of attack and > defense> strategies and looking for some good metrics to plug into > a cost benefit > > model. We'd be happy to share the results if anyone is > interested as > > well. > > > > Thanks in advance, > > > > sean > > > > -- > ------------------------------------------------------------------- > ------- > Joel Jaeggli Unix Consulting > joelja(a)darkwing.uoregon.edu > GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB > B67F 56B2 > > >

4 3

NASA DNS contact
by Chris Layton 13 Nov '03

13 Nov '03

I am having an issue with accessing the nasa.gov zone. It looks like either a routing or firewalling issue that is unique to my network. Does anyone have a good contact for either their NOC or the dns server group? thanks, -chris

1 0

FW: Cost of Worm Attack Protection
by Braun, Mike 13 Nov '03

13 Nov '03

The old saying of "you get what you pay for" seems to be well directed when it comes to this topic. If you're willing to allocate $100K more than you currently spend to mitigating the effects from Worms and Viruses, I'm sure you will have some increased success. If you allocate 1 mill more, your success will increase substantially. The true cost really boils down to what you are trying to protect, such as how many servers, users, network segments, and other critical devices you are willing to encompass in your protection plan. Also, you may be able to mitigate the cost by using the functionality built into devices you may already own. A good protection schema needs to address the use and benefits from the following: Firewalls, VPN tunnels and policies, HIDs, NIDs, Antivirus software, and a good network security policy that grows with your network. You may already have most of this in place and need only a little extra funding allocated to give you the protection level you feel comfortable with. If you're looking for pricing on each component, they will vary widely depending on the brand and model you go with. You should shop around for components that suit your budget. An example of this price variance can be found by looking at a Net Forensics project priced at $500k compared to a similar solution going will Network Intelligence at $40K. The Network Intelligence solution may not have all the functionality offered by Net Forensics, but it may be enough for your needs. Best of luck in fighting this ever growing problem, Mike Braun -----Original Message----- From: sgorman1(a)gmu.edu [mailto:sgorman1@gmu.edu] Sent: Thursday, November 13, 2003 7:59 AM To: Joel Jaeggli Cc: nanog(a)merit.edu Subject: Re: Cost of Worm Attack Protection Good point - then what is the cost of attempting to mitigate or handle attacks vs. doing nothing? ----- Original Message ----- From: Joel Jaeggli <joelja(a)darkwing.uoregon.edu> Date: Thursday, November 13, 2003 10:14 am Subject: Re: Cost of Worm Attack Protection > I haven't seen any network or customer site that has protected > itself from > worms... only mitigated them. > > joelja > > On Thu, 13 Nov 2003 sgorman1(a)gmu.edu wrote: > > > > > > > I was hoping to get some estimates from folks on the costs of > defending> networks from various worm attacks. It is a pretty > wide open question, > > but if anyone has some rough estimates of what it costs per edge, > > manpower vs. equipment costs, or any combination thereof it > would be of > > great assistance. We are doing some simulations of attack and > defense> strategies and looking for some good metrics to plug into > a cost benefit > > model. We'd be happy to share the results if anyone is > interested as > > well. > > > > Thanks in advance, > > > > sean > > > > -- > ------------------------------------------------------------------- > ------- > Joel Jaeggli Unix Consulting > joelja(a)darkwing.uoregon.edu > GPG Key Fingerprint: 5C6E 0104 BAF0 40B0 5BD3 C38B F000 35AB > B67F 56B2 > > > "MMS <firstam.com>" made the following annotations on 11/13/2003 12:03:21 PM ------------------------------------------------------------------------------ "THIS E-MAIL MESSAGE AND ANY FILES TRANSMITTED HEREWITH, ARE INTENDED SOLELY FOR THE USE OF THE INDIVIDUAL(S) ADDRESSED AND MAY CONTAIN CONFIDENTIAL, PROPRIETARY OR PRIVILEGED INFORMATION. IF YOU ARE NOT THE ADDRESSEE INDICATED IN THIS MESSAGE (OR RESPONSIBLE FOR DELIVERY OF THIS MESSAGE TO SUCH PERSON) YOU MAY NOT REVIEW, USE, DISCLOSE OR DISTRIBUTE THIS MESSAGE OR ANY FILES TRANSMITTED HEREWITH. IF YOU RECEIVE THIS MESSAGE IN ERROR, PLEASE CONTACT THE SENDER BY REPLY E-MAIL AND DELETE THIS MESSAGE AND ALL COPIES OF IT FROM YOUR SYSTEM." ==============================================================================

3 2

RFI: Intrusion Detection Systems
by kgraham＠rogers.com 13 Nov '03

13 Nov '03

My apologies to anyone that receives duplicates of this email stemming from it being cross posted. I have been asked to investigate an Intrusion Detection/Prevention System. Could anyone that has knowledge of the following products give me the good, bad or the ugly concerning them. Reply to myself online or off line If anyone would like a summary of the results please do not hesitate to ask. NIDS: Cisco Intrusion Detection Sensors Version 4.x 4235, 4250 NAI Intrusion Prevention Sensors IntruShield 2600, 4000 (IntruVert) HIPS: Cisco Security Agent Entercept Management Systems: Cisco VMS - VPN/Security Management System NAI: ISM Security Management System. Any thoughts would be appreciated. Kim

3 2

Re: Point of sale RAS hardware?
by Lanny Godsey 13 Nov '03

13 Nov '03

> Does anyone know of a good RAS product that supports the fast train > times needed for point of sale terminals (specifically the ability to > turn off data compression, error detection, and speed negotiation)? > Most every one I've seen is aimed at serving as-fast-as-possible > dialup > network access to normal modems, but I need something that will do > 1200bps (or even better yet, v.22FC) with no frills. > > Can anyone suggest a product or manufacturer? We use the Cisco AS5400 in which you can enable/disable any option as you see fit using resource pooling. We use it to support KFLEX modems which fail to connect properly w/ the v.92 tones. The way it deterimes which settings to use is based on called station id. We also find modems that try to to retain to highest speed tend to reach the limit and drop the connection. Most of our customers are in rural areas w/ poor quality phone lines. We found it was easier to create resource groups to lock people to 21000 baud via setting their connection number than giving the customer init strings to limit the connection that way. Sure there are probably better solutions, but this has solved nearly all connection problems we've seen. I realize you may end up not using cisco, but I'll include a small example just in case it's useful to anyone. IOS (tm) 5400 Software (C5400-IS-M), Version 12.3(1a), RELEASE SOFTWARE (fc1) resource-pool enable ! resource-pool group resource MICA-modems range port 1/0 1/107 range port 2/0 2/107 range port 3/0 3/107 range port 4/0 4/107 range port 5/0 5/107 range port 6/0 6/107 ! resource-pool profile customer any limit base-size all limit overflow-size all resource isdn-ports digital resource MICA-modems speech service any dnis group default ! resource-pool profile customer v90 limit base-size all limit overflow-size all resource MICA-modems speech service v90 dnis group v90 ! resource-pool profile customer k56flex limit base-size all limit overflow-size all resource MICA-modems speech service k56flex dnis group k56flex ! resource-pool profile customer v34-28800 limit base-size all limit overflow-size all resource MICA-modems speech service v34-28800 dnis group v34-28800 ! resource-pool profile service v90 modem min-speed any max-speed 56000 modulation v90 ! resource-pool profile service k56flex modem min-speed any max-speed any modulation k56flex ! resource-pool profile service v34-28800 modem min-speed any max-speed 28800 modulation v34 ! resource-pool profile service any dialer dnis group v90 number 2533219668 number 3605459668 [trimed] ! dialer dnis group k56flex number 3605429667 number 3605459667 [trimed] !

1 0