WINS WINS Monthly MeetingMonthly Meeting

5/7/20045/7/2004

AgendaAgenda

IntroductionsIntroductions Sasser WormSasser Worm SANSSANS SAN PresentationSAN Presentation Fortinet Garnet Valley UpdateFortinet Garnet Valley Update Summer ActivitiesSummer Activities Question & AnswersQuestion & Answers

IntroductionsIntroductions

NameName TitleTitle LocationLocation

Sasser WormSasser Worm

This self-executing worm spreads by exploiting a This self-executing worm spreads by exploiting a Microsoft Windows vulnerability [MS04-011 vulnerability Microsoft Windows vulnerability [MS04-011 vulnerability (CAN-2003-0533)](CAN-2003-0533)]

The worm spreads with the file name: The worm spreads with the file name: avserve.exeavserve.exe .  .  Unlike many recent worms, this virus does not spread via Unlike many recent worms, this virus does not spread via email.  No user intervention is required to become email.  No user intervention is required to become infected or propagate the virus further.  The worm works infected or propagate the virus further.  The worm works by instructing vulnerable systems to download and by instructing vulnerable systems to download and execute the viral code.execute the viral code.

For manual protection, it may be advisable to block TCP For manual protection, it may be advisable to block TCP ports 139, 445, 5554, and 9996 at network gateways. ports 139, 445, 5554, and 9996 at network gateways. Patches highlighted in Microsoft Security Bulletin MS04-Patches highlighted in Microsoft Security Bulletin MS04-011 address the issue exploited by Sasser. 011 address the issue exploited by Sasser.

SANSSANS

Disaster RecoveryDisaster Recovery Server Back-upServer Back-up 30 servers and 500 GIG per district?30 servers and 500 GIG per district? What can we afford?What can we afford? DAS – NAS – Fiber CH SAN – IP SANDAS – NAS – Fiber CH SAN – IP SAN How to best use the district fiber How to best use the district fiber

backbone?backbone?

SAN PresentationSAN Presentation

DCIU working with Dell Brent BaileyDCIU working with Dell Brent Bailey Brent will meet with me to discussBrent will meet with me to discuss

Tim Slattery of CNI introduced :Tim Slattery of CNI introduced : Lefthand Networks IP SAN SolutionLefthand Networks IP SAN Solution http://www.lefthandnetworks.com/index.phttp://www.lefthandnetworks.com/index.p

hphp

ePlus - Nick D'Archangelo PresentsePlus - Nick D'Archangelo Presents

Fortinet Garnet Valley Fortinet Garnet Valley UpdateUpdate

Cutover unsuccessful due to port tagging Cutover unsuccessful due to port tagging configconfig

Lab testing at Widener with FortinetLab testing at Widener with Fortinet Properly configured Fortigate to resolve Properly configured Fortigate to resolve

tagging tagging Resolved Transparent Mode IP managementResolved Transparent Mode IP management Resolved Spanning Tree issuesResolved Spanning Tree issues Ready to return the week of the May 11Ready to return the week of the May 11thth

Stay tuned!!Stay tuned!!

Summer ActivitiesSummer Activities

Nortel 8600 UpgradeNortel 8600 Upgrade 64 M on CPU replaced with 256 M 64 M on CPU replaced with 256 M

SIMMSIMM Software upgrade to 3.5.1 (now Software upgrade to 3.5.1 (now

3.2.1)3.2.1) Shasta 3Shasta 3rdrd Generation Testing Generation Testing DCIU Sidewinder FW install ( today )DCIU Sidewinder FW install ( today )

Questions & AnswersQuestions & Answers

Next Meeting Friday June 4th!Next Meeting Friday June 4th!