Security Tools Used by the Office of Information Security

OSU’s Network contains data that, should it fall into the wrong hands, could cause harm to individuals within our community. The Office of Information Security is tasked with identifying threats to that data, such as hackers and the malicious software they use, and to assist IT units in taking steps to protect it. And, unfortunately, we’re also asked to track down the source of threats of violence against members of our community.

The Office of Information Security uses a variety of tools and multiple sources of data to perform these tasks. We are very much aware that we have the potential to impact the privacy that is an important part of our community. We feel that we’ve designed systems and processes to protect your data so that we can strike the best possible balance between protecting individual privacy and securing our data.

A part of striking that balance is our desire to be very transparent about our operations. This paper outlines the tools we use, the information collected using those tools with examples of how that information is used, and the policies and procedures surrounding the gathering of data.

Network Security Monitoring and Analysis Tool

We utilize a network security analysis and monitoring tool. This tool is located on the outside edge of our network and receives a copy of all inbound and outbound network traffic. This traffic, in the form of data packets, contains information on which computer the data came from, to which computer it is headed, and the data being sent. Our tool strips the data portion from the packet, performs a one-way cryptographic hash function on that data, saves the key generated by this algorithm, logs the destination, source, and time, then disposes the entire packet.

Because it is one-way hash, the Office of Information Security is unable to decrypt the data portion to view the contents – so, for example, we cannot access the text or images or attachments sent in an email. The remaining packet information (destination|source|time|hash value) is stored for analysis.

An example of how this information would be used is in our response to phishing emails. Due to our outreach efforts, people frequently send us a copy of phishing emails they receive. Using the tool, we would check to see if anyone else went to the link contained in the phishing email, and notify the individual or their IT support team to ensure that nothing bad resulted from clicking on that link.

This tool also analyzes network traffic, looking for abnormalities to help identify malicious behavior. Advanced attacks, such as those used by organized crime or nation states, frequently occur at low thresholds that defy conventional, signature based detection. We will also be able to compare hashed values of suspected malicious software against hash libraries to aid in detection. This tool is an essential part of our incident response toolkit, and helps us meet federal requirements for the protection of Controlled Unclassified Information. This tool also helps us to meet the Payment Card Industry’s Data Security Standards.

Network Security Monitoring and Analysis Tools are also used to offer protection in high-speed research networks, which frequently exceed the performance capacity of firewalls. In this role, the tool is placed in-line, where it performs a quick examination of the first few packets within a file and, if non-malicious, then allows all traffic to take place at full speed between the two systems without further interruption.

Analyzing network flows for malicious activity does have the potential for abuse. We feel that by designing the tool to store only one-way cryptographic hashes of data is the best balance of meeting the capabilities we need to detect attacks while preserving the privacy of the members of the OSU community. As with all our other tools, we’ve applied the appropriate technical safeguards, as well as implemented policies and procedures around the use of the data from this tool.

Log Collection and Aggregation

Information Services is in the process of deploying a Log Aggregation and Correlation tool. This tool will allow us to gather log data from a variety of sources and allows us to look for patterns of behavior.

During our testing of this tool, we used it to identify compromised user accounts. This was done by looking at the time and location of login. If an individual logged into an account on the Corvallis Campus at 8:00 am, and that same account was logged into from China 2 hours later, that caused an alert since there is no way for the same person to travel that far in that time period.

It would be difficult to perform the same task manually, as there are thousands of logins a day. We also believe that by automating this process we improve privacy, as we’re not looking at all records, just the ones that match a certain criterion that represents a risk to the institution.

Log data does contain information of a personal nature, such as the IP address of the computer used to visit one of the OSU websites and which web pages were visited. It contains the date and time a system was accessed and which files were downloaded. This information could be used, in certain situations, to track activities to a geographic location. We’re very cognizant that such a tool could be abused, and we have policies, procedures, and technical safeguards in place to prevent misuse of this information.

Vulnerability Scanning

Vulnerability Scanning tools scan devices on the network to see if they are running outdated software that has a known vulnerability. These tools can also identify insecurely configured devices. Hackers frequently use these types of vulnerability to gain access to systems.

The Office of Information Security has two vulnerability scanning systems. One system has been placed just outside our network, and so gives us a view of what an external hacker would see. Because of the large number of systems on our network, we only perform limited scans, looking for new vulnerabilities. The other is placed within our firewalled infrastructure and performs more intensive scans. Result of the scans are forwarded to IT units across campus so they can fix any problems found.

The operation of vulnerability scanning tools represent a minimal risk to privacy.

Firewalls and Network Segmentation

Due to the size and complexity of our network, network firewalls are only deployed where needed. We use network segmentation to divide the network into functional areas and network firewalls are placed in front of segments where confidential data is processed.

The operations of firewalls represent a minimal risk to privacy.

Network Malicious Program (Malware) Detection

Similar to the antivirus programs found on personal computers, Network Malware Detection tools scan network traffic to spot harmful programs. Network Malware Detection tools use two methods to detect harmful programs: signature based and virtualized testing. Signature based detection compares observed network traffic against a database of known malware. During virtualized testing, the tool creates a virtual model of an operating system and runs the suspected malicious file in that model to see if it is harmful.

Network Malware Detection tools capture and store complete packets, including the data component, for every item they alert on. Because the tools are not perfect, this creates a slight risk to privacy for packets which are captured in the event of a false alarm. Fortunately, false alarms are rare. To mitigate this risk, access to Network Malware Detection tools are limited to OIS employees and alerts are reviewed before sharing any data with technical staff for resolution.

Intrusion Detection Systems

Similar to Network Malware Detection tools, Intrusion Detection Systems look for patterns of behavior in network traffic to flag threats. Intrusion Detection Tools are signature based.

The Office of Information Security is in the process of deploying Intrusion Detection Systems within network segments of high risk as an additional layer of security. Like Network Malware Detection, Intrusion Detection Systems capture the packets for traffic that generates an alert. False alarms are very rare, but possible, and so there is a slight risk to privacy if packets that are not a threat are captured. This risk is mitigated by removal of the captured packets for any event that is determined to be a false alarm.