Network Security '95

As promised, the final program for Network Security'95 is attached. As you'll see, the top gurus in every key area of UNIX network security have all been invited and have agreed to provide practical and interesting talks and papers. The entire program lasts a week (November 13 - 18) with in- depth courses on Monday through Wednesday and on Saturday. The multi-track Technical Conference is on Wednesday and Thursday. A list of the courses is attached at the end, along with a registration form. Please register before September 18th to get the Einstein sweatshirt. For questions or a printed brochure: 719-599-4303. ========================================================== TECHNICAL CONFERENCE PROGRAM UNIX Network Security 95 (November 16-17, Washington D.C.) Thursday, November 16, 1995 9:00 - 10:30 Chairpersons' Opening Remarks and Keynote Address Keynote: "Early Insecurity" Peter Salus Peter Salus, author of "A Quarter Century of UNIX" and "Casting the Net: the ARPANET, the Internet and Beyond", will give you a sense of perspective and history by taking you back to the early days of network security when many warnings and incidents first went unheeded. It all starts in 1973 with RFC 602 in which Bob Metcalfe first pointed out that "Individual sites ... have not yet taken sufficient precautions toward securing their systems against unauthorized remote use..." Peter will tell you the stories of some of the early incidents, including "The Incident" at the University of Waterloo, the Morris and Thompson CACM paper, and Ritchie's patent #4135240. He will also share his observations of the degree to which the situation has improved and summarize the UNIX network security lessons we should learn from the past. 10:30 - 11:00 Break and Visit Exhibits Track 1: Remainder of Thursday 11:00 - 12:30 pm Session 1-1: "Legal Issues of Computer Security" Scott Charney, US Department of Justice Scott Charney has a unique insight into how laws interact with the daily activities of network and security administrators. His presentation at Network Security'95 will focus on the shifting panorama of laws and legal interpretation, wherever possible providing roadmaps for sensible and legal behavior. Some attendees will be surprised to learn how much the laws are in flux and how difficult it is to maintain a computer network and not run afoul of one law or another. Even with tens of millions of computers being used every day, there is still no standard definition of what constitutes computer crime. In addition, legal rights of system administrators and information security professionals to perform their duties are still somewhat murky. In fact, some laws may make common activities of system administrators illegal. This session will help you gain a better understanding of: - Definitions of computer crime. - Recent progress and changes in relevant laws. - Legal rights of system administrators and ISPs. - Legal rights of users, including intruders. 2:00 - 3:30 Session 1-2: Intruder Profiles and Incident Response Experiences "Current Trends in Intruder Methods" Moira West or Tom Longstaff, CERT The number of computer security incidents on the Internet is growing at an alarming rate -- with hundreds of incidents being reported every day. Some of the culprits are established intruders using advanced techniques to accomplish their dirty deeds. Others are mere wanna-be's who are using "plug-n-play" intruder kits which are readily available on many underground sites. This session explores some of the methods currently used by intruders on the Internet. "An Incident Response Case Study" Brent Mead, Jet Propulsion Laboratory Incident investigation is an integral task of any computer security organization. The method of selecting a team and the procedure for investigating and recovering from a break-in is critical to quickly restoring the affected system back to normal. The presentation will cover the methodology used at the Jet Propulsion Laboratory (JPL) to determine if an incident has occurred, how to form an incident investigation team, procedures to conduct the investigation, evidence collection, and recovery techniques. Actual break-ins will be discussed to demonstrate the incident investigation process. 4:00 - 5:30 Session 1-3: Incident Response Case Studies Randy Marchany, Virginia Technical Institute "Security in the Blacksburg Electronic Village" The Blacksburg Electronic Village (BEV) is a cooperative effort among VA Tech, Bell Atlantic and the Town of Blacksburg, VA to connect every residence, business, and school in the entire town to the Internet using high speed (T1, twisted pair Ethernet, ISDN) links. Over 12,000 people are already on-line. Such a unique environment presents an interesting opportunity to study security on the net. This case study discusses some of the things we're learning out in the "real" world. "Email Harassment: the Aura of Anonymity" Most email users are just now learning how easy it is to forge email. At Virginia Tech, officials first thought their primary source of danger on the networks was the standard hacker-style attacks. However, time has shown that the majority of infractions are related to email. This case study describes several types of email attacks (obscene mail, harassing mail, mail bombs, etc.) made under the aura of anonymity. All of these have been seen at VA Tech recently. The case study also describes Virginia Tech's mechanism for finding the real sender of an 'anonymous' electronic mail message. Thursday Track 2 11:00 - 12:30 Sessions 2-1: Intrusion Detection - Past, Present and Future "Informal Methods of Intrusion Detection" Matt Bishop, University of California at Davis How do you tell if someone has broken in? This talk will examine how break-ins are often detected, where to look and what to look for, what attackers often do to ensure they can return, and how to apply some general principles to guide the search for break-ins. The talk will be organized around case studies. "An Introduction to Intrusion Detection Modeling" Karl Levitt, University of California at Davis Automated intrusion detection relies on modeling user behavior. The models may involve a statistical (or other) analysis of users' patterns of behavior, or detection of known attacks, or a combination of the two. This talk describes how those profiles are derived, and how the models are used (both in theory and in practice). 2:00 - 3:30 pm Session 2-2: Current Intrusion Detection Systems and Future Trends: A Panel Moderated by Dorothy Denning, Georgetown University Panel Members: Becky Bace, Department of Defense Karl Levitt, University of California at Davis Teresa Lunt, ARPA/ITO Where are intrusion detection systems going? How will they adapt to the NII, to networks, and to distributed systems? What can we learn, and what have we already lear