Carnegie Mellon University

Software Engineering Institute

ESP Technical Overview

Marty Lindner September 2000
Software Engineering Institute Carnegie Mellon University Pittsburgh, PA 15213-3890
Sponsored by the U.S. Department of Defense 2000 by Carnegie Mellon University

Carnegie Mellon University

Software Engineering Institute

Agenda
What is ESP Goals of the ESP ESP Technology Overview

2000 by Carnegie Mellon University

Carnegie Mellon University

Software Engineering Institute

What is the ESP

Extranet for Security Professional

2000 by Carnegie Mellon University

Carnegie Mellon University

Software Engineering Institute

What is the ESP

From a users perspective the ESP is a
web site that is used by a group of people sharing a common interest or need

2000 by Carnegie Mellon University

Carnegie Mellon University

Software Engineering Institute

What is the ESP

From an IT professionals perspective the
ESP is a secure web environment created by using
Commercial Off The Shelf (COTS) products Good Programming Practices Strict network policies enforced by multiple

firewalls and intrusion detection systems Automated intrusion detection software developed for the ESP environment
2000 by Carnegie Mellon University

Carnegie Mellon University

Software Engineering Institute

What is the ESP

A set of collaboration
tools used thru a common web interface
Mail Tool Calendar Tool Document

Collaboration Tool Document Library

2000 by Carnegie Mellon University

Carnegie Mellon University

Software Engineering Institute

Goals of the ESP

Minimal cost to the end users Provide a mechanism for sharing
FOUO/SBU information over the public internet Maintain the highest level of security

2000 by Carnegie Mellon University

Carnegie Mellon University

Software Engineering Institute

ESP Technology Overview

2000 by Carnegie Mellon University

Carnegie Mellon University

Software Engineering Institute

ESP Infrastructure
The Internet

Router

Firewall

Web Servers
To: George Marty From: Steve

Workstation
2000 by Carnegie Mellon University

Database Servers

Firewall

Carnegie Mellon University

Software Engineering Institute

End User Workstation

The Internet

Router

Firewall

Web Servers
To: George Marty From: Steve

Workstation
2000 by Carnegie Mellon University

Database Servers

Firewall

10

Carnegie Mellon University

Software Engineering Institute

End User Workstation

One of the ESP goals is to minimize the
cost to the end user The only end user requirement is a web browser that supports U.S. domestic encryption (128 bits)

2000 by Carnegie Mellon University

11

Carnegie Mellon University

Software Engineering Institute

The Internet
The Internet

Router

Firewall

Web Servers
To: George Marty From: Steve

Workstation
2000 by Carnegie Mellon University

Database Servers

Firewall

12

Carnegie Mellon University

Software Engineering Institute

The Internet
The ESP technology makes one
assumption about the Internet
You can not trust it!

To overcome this lack of trust, the ESP

uses the Secure Socket Layer (SSL) protocol and X.509 certificates to provide authenticity, integrity and confidentiality
www.ietf.org\rfc\rfc2246.txt
2000 by Carnegie Mellon University

13

Carnegie Mellon University

Software Engineering Institute

SSL Security
The Internet

Router

Firewall

SSL provides a secure path through the Internet Web Servers

To: George Marty From: Steve

Workstation
2000 by Carnegie Mellon University

Database Servers

Firewall

14

Carnegie Mellon University

Software Engineering Institute

Firewall Strategy
The Internet

Router

Firewall

Multiple inline firewalls create more complex maze for intruders to navigate
To: George Marty From: Steve

Web Servers

Workstation
2000 by Carnegie Mellon University

Database Servers

Firewall

15

Carnegie Mellon University

Software Engineering Institute

Firewall Strategy
Multiple firewalls randomly inserted
into the network topology
Sidewinder 5.0 www.securecomputing.com Guardian www.netguard.com Cisco Secure PIX Firewall www.cisco.com Linux IPchains www.linuxdocs.org
2000 by Carnegie Mellon University

16

Carnegie Mellon University

Software Engineering Institute

Network Monitoring
The Internet

Router

Firewall

Passive network monitoring tools assist and automate the intrusion detection process
To: George Marty From: Steve

Web Servers

Workstation
2000 by Carnegie Mellon University

Database Servers

Firewall

17

Carnegie Mellon University

Software Engineering Institute

Network Monitoring
Several passive network monitoring
agents are used to detect signs of intrusion
Real Secure 3.2 www.iss.net Snort 1.6.3 www.snort.org

2000 by Carnegie Mellon University

18

Carnegie Mellon University

Software Engineering Institute

Web Server Security

The Internet

Router

Firewall

To:

George Marty From: Steve

The middleware enhances security by incorporating additional authentication techniques

Web Servers

Workstation
2000 by Carnegie Mellon University

Database Servers

Firewall

19

Carnegie Mellon University

Software Engineering Institute

Web Server Security

System is dedicated to web services only No additional services offered Software
Hardened Windows NT 4.0 www.microsoft.com Tripwire system integrity software 2.2.1 www.tripwire.com Netscape Enterprise Server 3.63 home.netscape.com Cold Fusion Server 4.5.1 www.alliare.com

2000 by Carnegie Mellon University

20

Carnegie Mellon University

Software Engineering Institute

Database Security
The Internet

Router

Firewall

The database only responds to authenticated requests from the Web servers
To: George Marty From: Steve

Web Servers

Workstation
2000 by Carnegie Mellon University

Database Servers

Firewall

21

Carnegie Mellon University

Software Engineering Institute

Database Security
Database servers only except
communications from an authenticated IPsec session
www.ietf.org\rfc\rfc2401.txt

2000 by Carnegie Mellon University

22