Maintaining Normal Communication Operations by Reducing Denial of Service Effects by Worms and Viruses: A Case Study

摘要

One of the chief concerns in the relatively open architecture of academia centers on issues of information technology (IT) security. Security against vulnerabilities presents a formidable challenge wherever computing technology is used, especially in large networked environments that serve both to secure information and also to provide reliable and safe communication and access that goes beyond the managed network, such as corporations and universities. The Computer Emergency Response Team's (CERT/CC) most recent statistics report 2,683 security vulnerabilities during the first three quarters of 2004; by 2004, security incident reports had become so numerous that CERT has stopped reporting their number. Such reports had increased six-fold, from 21,756 in the year 2000 to 137,529 in 2003, and the widespread use of automated attack tools have now made it nearly impossible to assess the number of separate security incidents in 2004. It is difficult, if not impossible, for any IT administrator to review, evaluate, and address each vulnerability. The CERT group calculated the time it would take one IT administrator to spend five minutes reviewing the description of each of the last year's security alerts and installing required patches, even if only 1 percent olf those alerts applies to her specific IT infrastructure. Assuming it takes one hour to evaluate, test, and apply a required patch (this can drop for large installations using automated patching tools), it would take more than 500 hours to review each alert and install patches for 1 percent of them. This amounts to more than 25 percent of a full-time IT administrator's total hours during the year (Security Newsletter, 2004). Furthermore, the time lag between a security bulletin and a malicious exploit of the vulnerability is often measured in just hours or days. This paper describes how the IT division at Middle Tennessee State University (MTSU) has adapted its data communications network to changes in the security environment. Administering and safeguarding an academic network requires attention to two disparate goals: free and open access for faculty, staff, students, and visitors, to internal and external resources, along with excellent security and reliability.