Third and final installment on How to Survive a Network Attack

It's been a crazy week here at OCLC. Lots of good stuff in the works. I have been joking that the whole company will exhale a collective sigh of relief when all the planned spring and summer upgrades/enhancements/releases finally go through.

I spent an extended holiday weekend last weekend in my hometown of Alva, Oklahoma visiting as many family members as possible. Where else do you find a baby calf, a rabbit, a dog, 2 kittens and an indeterminate amount of chickens in the same backyard? I love it!

I was recently reminded that I hadn't give you the final installment in the IAG occasional series on "How to Survive a Network Attack" for small and medium-sized libraries. If you have IT people who specialize in security, rock on. If not, maybe these tips will help. This is the third chunk.
Find the previous two chunks are here:

Reduce the likelihood of an attack.
Have visibility into the problem.

Determine what you’re up against.
In the middle of a problem, it can be easy to jump to conclusions that will lead you astray.

* Is there really an attack going on, or is there another cause, such as a misconfiguration, equipment failure or power outage?
* Is your network the target of an attack, or is it the source?
* Is your network the target of an attack directed specifically at your organization, or are you caught up in a larger issue?
* Is the apparent intent of the attack to cause a service interruption, or are interruptions the side effect of a different type of attack?

Be able to block.
* Choke points in your network: Identify in advance the most efficient places in your network to perform filtering. A good place to look is Access Control Lists on the router that connects your network to the Internet.
* Quality of Service (QoS) controls: Even better than being able to block is to be able to control the amount of resources devoted to different types of traffic. With QoS controls configured in your network, you may be able to throttle the bad traffic while ensuring that there are enough resources devoted to critical services.
* Maintain a relationship with your Internet Service Provider: By the time traffic reaches your network it may be too late, and it may be more than it can handle.

Above all, don’t panic.

###

My take is that there are people who make their living providing security for online services. And lucky for libraries, there are data streams that are much more prone to attacks, too. I know we all love our MARC XML (sent through RESTful queries, no doubt) but banks and health care providers deal with data that is every bit as sensitive (I would argue much more so) than library data.

So if we take some pro-active steps, we will probably survive a network attack just fine and even live to tell the tale.

Alice heads West

We have a series of meetings scheduled next week in Dublin, so I will likely be talk, talk, talking instead of write, write, writing. (Well, truthfully it should be list, list, listening...but there we are.)

The second tip in the series of "How to survive a network attack" comes to you today from the OCLC security team:

Have visibility into the problem.

A key to identifying and recovering from a denial of service condition is being able to quickly and accurately determine its causes. Here are some utilities that you will want to configure in advance, in order to properly prepare for an attack:

* Web server logging: Web server logs are often the best source of information for determining the source of the attack, since they usually contain the client IP address.

* Network connection data: If your network devices don’t already log basic information about all network traffic, you may want to deploy a network auditing tool such as Argus . Argus logs contain the time, source IP address, destination IP address, and traffic characteristics such as protocol and port for the traffic that Argus is inspecting.

* Intrusion detection: Early detection of the problem is critical. Intrusion detection systems like Snort can be configured to send you alerts in the event of behavior that has the characteristics of an attack.

* Log analysis tools: Regardless of the type of logs, you’ll need to search and analyze them quickly. You may want to have a system with a utility like Splunk ready to go before a problem hits.

Wow, with names like Argus, Snort and Splunk, you'll be more secure in no time.

Warm up for Code4Lib

A few of us are gearing up for Code4Lib 2009 in Providence, RI next week. Very fun. I am going to be at the OCLC Grid Services Boot Camp, to learn, take photos and I hope take a few videos as well. Promises to be a good time, given the list of attendees. Wish I could stay for the whole conference, but someone has to mind the store (as they say).

As a techhead warm-up and the start of a continuing series of somewhat random but helpful tidbits, I was chatting with one of the security officers at OCLC and he compiled a list of tips for surviving a network attack. I'll give these to you in bite-sized pieces.

Here's the first one:

Reduce the likelihood of an attack.

Like campers who tie their food up in trees to keep bears away, you’ll want to make sure you don’t have any enticing tidbits for Internet attackers.

Here are a few key findings to look out for:

* Unpatched systems: Attackers wanting an easy target will look for systems that are behind in updates.
* Open web proxies: Misconfigured proxies can attract a lot of traffic because they may allow remote users to get around firewall restrictions or to get unauthorized free access to resources.
* Cross-site scripting vulnerabilities: Cross-site scripting (XSS) is a type of web application vulnerability where an attacker can use your web pages to attack other users.

Stay a step ahead of the attackers and identify these and other weaknesses in your systems with a vulnerability scanner like Nessus. Nessus is a very powerful and potentially dangerous tool, so make sure that you have the proper authorization, that you have familiarized yourself with how it works, and that you choose your targets carefully.