Curtis Blais - Project Summaries

Document Sample
Curtis Blais - Project Summaries Powered By Docstoc
					Project Summaries for Curtis L. Blais

 Title of Project: Secure Identity Aware Network (SIAN) – Thought Leadership
 Organization Name: Government of British Columbia – Office of the CIO
 Start / Finish Dates: January 2006 – June 2006            Total Individual LOE (days):
                                                                       6 months
 Description of Project:

 Lead a multi-vendor team in the creation of a new concept around identity that would provide
 the government the ability to share information in a way that is difficult and complex in today’s
 environment. This activity formed the basis for multiple trials and even the start of a Pan-
 Canadian Identity concept that could change the way citizens interact with governments.

 This project also has private sector implications, in that it could allow for the creation of a whole
 new way to identify (logically and physically) individuals.

 I have spoken about this subject at the ICE conference in Edmonton, 2007 and the West Coast
 Security Forum in Vancouver, 2007. As a result of these talks, it was there was identification of
 other potential forums for this subject including the OSI standards body and the office of the
 Privacy Commissioner of Canada.

 Mr. Dave Nikolejsin, CIO of the Government of British Columbia stated the following:
 “The Government of BC is focusing its collective energy in the technology space around a
 comprehensive IM/IT plan. Curtis Blais was one of the early visionaries at TELUS who clearly "got it".
 Curtis understood what we are doing and why it's important and performed an extremely valuable
 function championing those ideas back inside TELUS.”

 Areas of Experience:

 A. War dialers, password crackers – N/A
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats.
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – N/A
 D. Networking Protocols (HTTP, FTP, Telnet) – High level discussions around forming new
 protocols for physical/logical identification.
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – High level
 discussions around forming new protocols for physical/logical identification.
 F. TCP/IP, UDP, DNS, SMTP, SNMP – N/A
 G. Wireless Security – N/A
 H. Intrusion Detection Systems, firewalls and content checkers – N/A
 I. Threats to, and technical vulnerabilities of networks – N/A

 Results Achieved:



Curtis L. Blais                      - Project Summaries -                                      1
 The project results in the following benefits to the customer:

          1.      Demonstration of a new concept of identity
          2.      Leadership of a multi-vendor team
          3.      Thought leadership around ideas for this concept
          4.      Feasibility report produced that became the basis for a potential Pan-Canadian
                  approach




 Title of Project: Firewall /VPN installation and operation
 Organization Name: Esquire Construction Inc.
 Start / Finish Dates: July 2004 – Present                         Total Individual LOE (days):
                                                                              42 months
 Description of Project:

 Project is for the design, installation and operation of the company’s firewall including the VPN
 component. Firewall rules were specifically designed for the traffic identified by the company.
 Filtering on all protocols is performed on an ingress and egress basis only allowing the
 appropriate traffic to flow through the device. Individuals utilize the PPTP protocol for VPN
 connectivity and can access the system from any location. Verification of protocol use is
 performed using TCP-dump format to ensure that all components of the packets are captured.
 Various scanning is performed on a semi-regular basis to ensure that the firewall is performing
 as expected. Tools used include SuperScan, Nessus, & NMAP.

 Log analysis of the firewall logs are performed on a regular basis and monthly reports are run to
 ensure the identification of any unwanted activity.

 The current firewall product also performs content filtering and this device is maintained and
 updated regularly. Reports of violations are produced and reviewed with senior management of
 the organization.

 A separate segment that includes 802.11b wireless is provisioned inside the environment and a
 separate list of rules form the corporate security policy is maintained. The use of Netstumbler
 has been used to identify areas of potential weakness on the wireless environment on a semi-
 regular basis.

 All activities are based on current threat/vulnerability activity through the SANS and Search
 Security public domain advisory services.

 Passwords are checked on a semi-regular basis utilizing John the Ripper to verify if passwords
 are easily determinable through brute force means.

 Areas of Experience:



Curtis L. Blais                        - Project Summaries -                                 2
 A. War dialers, password crackers – John the ripper used to verify strong passwords are made
 use of.
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats.
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Tools used include SuperScan, Nessus, and NMAP.
 D. Networking Protocols (HTTP, FTP, Telnet) – Networking protocols include: FTP, HTTP,
 Telnet, DNS, SMTP/POP3, NTP, ;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – utilizing PPTP,
 HTTPS;
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilize TCP/IP (TCP and UDP) DNS, SMTP/POP3,
 RDP, Syslog ;
 G. Wireless Security – utilizing 802.11b with WEP, MAC filtering, NON-DHCP, and manual
 rotation of WEP Pass phrase ;
 H. Intrusion Detection Systems, firewalls and content checkers – content checking performed
 by Firewall along with URL site detection; and
 I. Threats to, and technical vulnerabilities of networks – Respond to advisories issued by
 manufacturers of products utilized in this environment as well as those items that are identified
 through vulnerability scanning.

 Results Achieved:

 The project results in the following benefits to the customer:

     1. Secure operation of internal environment from external hack attempts and the latest
        vulnerabilities
     2. Secure operation of the Wireless environment within the environment
     3. Regular review of internal vulnerabilities and identification of weak passwords
     4. Secure operation of encrypted remote access (VPN) and verification of continued
        security
     5. Identification (through scanning) of any impending vulnerabilities and potential issues




 Title of Project: Internal Network and Security Specialist (full time role)
 Organization Name: TELUS Communications Inc.
 Start / Finish Dates: January 1998 – January 2000             Total Individual LOE (days):
                                                                     24 x 18.33 = 439.92 days
 Description of Project:

 Worked full time on-site within the organization as a network and security specialist.

 As one of the network professionals my duties include: planning, design, implementation and
 maintenance of all internal corporate network hardware including bridges, routers switches,
 firewalls, mail gateways and router ACL’s; custom design of solutions as required; tier 2


Curtis L. Blais                    - Project Summaries -                                  3
 technical support using Network Associates Sniffer/NetXray for the more than 18000 nodes and
 over 225 routers in the Bridged/Routed Token Ring, Ethernet and ATM PNNI networks using
 TCP/IP & OSPF, IPX and DECnet. All aspects of the network security was clearly a part of this
 role as security was applied to all peripheral devices including Dynamic Routing filters, Access
 Control Lists, Firewall Policies and general protection of the routing infrastructure. Remote
 Access was provided by VPN connectivity and a backup modem pool in the case the VPN was
 not accessible.

 Projects: Principle Network Specialist on the vendor selection, design, configuration and
 implementation of the EdTel/TELUS Communications (Edmonton) High speed ATM PNNI
 LANE Infrastructure (IBM 8260/8265); one of four people in North America invited by IBM to
 Raleigh N.C. to assist with the beta test of the IBM 8210 MSS Client/MPOA hardware/software
 product; performed beta testing for Cisco on 1604 Rev 5 ISDN chipset; recommended,
 purchased, configured and support of TELUS high availability SAP Network including FDDI
 (Cisco c1400), 100BaseT (Cisco Catalyst 5000), and ATM (Cisco 4700); one of three Network
 Analysts which designed the TELUS Wide Area Network; facilitated the connection of an
 International ISDN link to Israel; Assisted the testing of ADSL for commercial rollout; Principle
 Network Analyst in the CDPD/e-network project with an IBM Secure ArTour gateway for 650
 repair technicians (IBM published a World Wide Technology Brief on this project); designed,
 built and maintained Cisco access control list to allow for secure connections to outside
 networks.

 Areas of Experience:

 A. War dialers, password crackers – N/A
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats.;
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Tools used include SuperScan, Nessus, NMAP, RAT and Sniffer.
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP, FTP, TFTP, Telnet, TACACS, DHCP,
 OSPF, RIP, BGP, CDP ;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – utilizing
 IPSEC/PPTP, HTTPS, SSH;
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilize TCP/IP (TCP and UDP) DNS, SMTP/POP3,
 RDP, Syslog ;
 G. Wireless Security – N/A;
 H. Intrusion Detection Systems, firewalls and content checkers – ISS Real Secure IDS, DEC
 Firewall, URL filtering/monitoring – no content checking; and
 I. Threats to, and technical vulnerabilities of networks – Respond to advisories issued by
 manufacturers of products utilized in this environment as well as those items that are identified
 through vulnerability scanning. .

 Results Achieved:

 As a full time employee working on the internal infrastructure the following were the benefits of
 the activities undertaken:



Curtis L. Blais                   - Project Summaries -                                  4
     1. Redundant network configuration utilizing dynamic routing protocols to ensure
        reliability
     2. Verification of router configurations with published best practices and the use of the
        RAT tool to verify router configurations were done in a secure manner.
     3. Maintenance and design of router ACLs to provide security for all partner connections
        and some internal connections between subsidiary parts of the organization.
     4. Maintenance and design of firewall rules. Configuration changes and log analysis along
        with URL filter changes.
     5. Secure login facilities maintenance through TACACS services
     6. Conversion to SSH from TELNET for infrastructure services



 Title of Project: Internal Network and Security Specialist (full time role)
 Organization Name: Edmonton Telephones Inc.
 Start / Finish Dates: March 1997 – December 1997              Total Individual LOE (days):
                                                                     10 x 18.33 = 183.3 days
 Description of Project:

 Worked full time on-site within the organization as a network and security specialist.

 As one of the network professionals my duties include: planning, design, implementation and
 maintenance of all internal corporate network hardware including bridges, routers switches,
 firewalls, mail gateways and router ACL’s; custom design of solutions as required; tier 2
 technical support using Network Associates Sniffer/NetXray for the more than 18000 nodes and
 over 225 routers in the Bridged/Routed Token Ring, Ethernet and ATM PNNI networks using
 TCP/IP & OSPF, IPX and DECnet. All aspects of the network security was clearly a part of this
 role as security was applied to all peripheral devices including Dynamic Routing filters, Access
 Control Lists, Firewall Policies and general protection of the routing infrastructure. Remote
 Access was provided by VPN connectivity and a backup modem pool in the case the VPN was
 not accessible.

 Projects: Principle Network Specialist on the vendor selection, design, configuration and
 implementation of the EdTEl/TELUS Communications (Edmonton) High speed ATM PNNI
 LANE Infrastructure (IBM 8260/8265); one of four people in North America invited by IBM to
 Raleigh N.C. to assist with the beta test of the IBM 8210 MSS Client/MPOA hardware/software
 product; performed beta testing for Cisco on 1604 Rev 5 ISDN chipset; recommended,
 purchased, configured and support of TELUS high availability SAP Network including FDDI
 (Cisco c1400), 100BaseT (Cisco Catalyst 5000), and ATM (Cisco 4700); one of three Network
 Analysts which designed the TELUS Wide Area Network; facilitated the connection of an
 International ISDN link to Israel; Assisted the testing of ADSL for commercial rollout; Principle
 Network Analyst in the CDPD/e-network project with an IBM Secure ArTour gateway for 650
 repair technicians (IBM published a World Wide Technology Brief on this project); designed,
 built and maintained Cisco access control list to allow for secure connections to outside
 networks;


Curtis L. Blais                    - Project Summaries -                                  5
 NOTE: this Summary is the same position post-merger with TELUS.

 Areas of Experience:

 A. War dialers, password crackers – N/A
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats.;
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Tools used include SuperScan, Nessus, NMAP, RAT and Sniffer.
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP, FTP, TFTP, Telnet, TACACS, DHCP,
 OSPF, RIP, BGP, CDP ;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – utilizing
 IPSEC/PPTP, HTTPS, SSH;
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilize TCP/IP (TCP and UDP) DNS, SMTP/POP3,
 RDP, Syslog ;
 G. Wireless Security – N/A;
 H. Intrusion Detection Systems, firewalls and content checkers – ISS Real Secure IDS, DEC
 Firewall, URL filtering/monitoring – no content checking; and
 I. Threats to, and technical vulnerabilities of networks – Respond to advisories issued by
 manufacturers of products utilized in this environment as well as those items that are identified
 through vulnerability scanning. .

 Results Achieved:

 As a full time employee working on the internal infrastructure the following were the benefits of
 the activities undertaken:

     1. Redundant network configuration utilizing dynamic routing protocols to ensure
        reliability
     2. Verification of router configurations with published best practices and the use of the
        RAT tool to verify router configurations were done in a secure manner.
     3. Maintenance and design of router ACLs to provide security for all partner connections
        and some internal connections between subsidiary parts of the organization.
     4. Maintenance and design of firewall rules. Configuration changes and log analysis along
        with URL filter changes.
     5. Secure login facilities maintenance through TACACS services
     6. Conversion to SSH from TELNET for infrastructure services



 Title of Project: VPN Installation
 Organization Name: Alberta Community Development / TELUS
 Start / Finish Dates: July 2000 – December 2000      Total Individual LOE (days):
                                                            13.5 days (billed time)
 Description of Project:


Curtis L. Blais                   - Project Summaries -                                  6
 In order to satisfy the outlined objectives of this project Mr. Blais determined the existing
 network configuration through information discovery. Based on this discovery and requirements
 provided by Alberta Community Development (ACD), an optimal network topology was
 prepared and recommendations provided for deployment of a VPN platform and authentication
 scheme.

     •    Review the current network configuration by obtaining a detailed diagram of the ACD
          environment and discussing any intricacies of the ACD Network configuration that may
          affect the VPN solution

     •    Review driving factors for the implementation of a VPN solution to achieve the best
          possible configuration for the ACD environment given best practice

     •    Review the security policy for ACD to ensure compliance of a VPN solution to the rules
          of that policy and provide recommendations to resolve issues and identify risks (industry
          identified)

     •    Prototype the Cisco VPN solution in the Professional Services lab to better understand
          the unique features of the product to ensure compatibility and functionality

     •    Review and recommend a production configuration model including a topology diagram,
          authentication scheme and a client configuration

     •    Document detailed client installation and configuration instructions to provide
          knowledge transfer for VPN client installation.

     •    Install/configure VPN code at ACD site and obtaining any necessary software upgrades
          for existing equipment as well as identify any security vulnerabilities

     •    Configure the base installation, and install the VPN client code for 3 to 4 test users as a
          trial

     •    Review PIX firewall rules and recommend any upgrades or changes that may be required

 The following were the deliverables for the project

 1. A report describing a review and describing recommendations for a configuration and
    authentication mechanism for a VPN solution
 2. Visio diagram of the ACD VPN solution topology
 3. Recommended beta configuration of a VPN solution for 5 to 6 trial users
 4. Detailed VPN Client installation procedures
 5. Written review of PIX firewall rules including any recommendations

 Areas of Experience:



Curtis L. Blais                      - Project Summaries -                                   7
 A. War dialers, password crackers – N/A
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats.;
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Tools used include SuperScan, Nessus, NMAP, RAT and Sniffer.
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP, FTP, TFTP, Telnet, RADIUS, ,;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – utilizing
 IPSEC/PPTP, HTTPS, SSH;
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilize TCP/IP (TCP and UDP)
 G. Wireless Security – N/A;
 H. Intrusion Detection Systems, firewalls and content checkers – Firewall review,
 I. Threats to, and technical vulnerabilities of networks – Respond to advisories issued by
 manufacturers of products utilized in this environment as well as those items that are identified
 through vulnerability scanning.

 Results Achieved:

 As a full time employee working on the internal infrastructure the following were the benefits of
 the activities undertaken:

     1. Redundant network configuration utilizing dynamic routing protocols to ensure
        reliability
     2. Verification of router configurations with published best practices and the use of the
        RAT tool to verify router configurations were done in a secure manner.
     3. Maintenance and design of router ACL’s to provide security for all partner connections
        and some internal connections between subsidiary parts of the organization.
     4. Maintenance and design of firewall rules. Configuration changes and log analysis along
        with URL filter changes.
     5. Secure login facilities maintenance through TACACS services
     6. Conversion to SSH from TELNET for infrastructure services



 Title of Project: Architecture & Assessment
 Organization Name: Alberta Gaming and Liquor Commission (AGLC)/ TELUS
 Start / Finish Dates: March 2001 – June 2001         Total Individual LOE (days):
                                                           20.83 days (billed time)
 Description of Project:

 This project was divided into the following separate items:

 Network Assessment
 1. Analyze the present AGLC Data network within the St. Albert office in regard to
    architecture and configuration.
 2. With regard to AGLCs business function, and their links to external business areas



Curtis L. Blais                    - Project Summaries -                                 8
    (administration centers and casinos), investigate the connectivity and identify possible
    enhancements.
 3. Identify any improvements that may be made to the internal network configuration of the
    offices in Calgary and Stettler Alberta.
 4. Comment on the suitability of the existing cable plant (IBM STP Type 1) to be used with a
    new “Backbone” infrastructure. Identify alternatives to replacing the cable plant to the
    desktop.
 5. Comment on Network Management systems suitable for our environment.

 Internet and Security
 1. Analyze the current AGLC\Internet interfaces. Recommend architecture to optimize security
    and usability including placement and protection of mail, proxy, remote access and web
    servers.
 Network Architecture
 1. With St. Albert backbone components due to be replaced, recommend a type of technology
    and recommend an architecture specific to the AGLC's needs.

 Areas of Experience:

 A. War dialers, password crackers – Checking for weak passwords with current tools for
 password information
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats.;
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Tools used include SuperScan, Nessus, NMAP, and Sniffer.
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP, FTP, TFTP, Telnet;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – utilizing
 IPSEC/PPTP, HTTPS, SSH;
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilize TCP/IP (TCP and UDP)
 G. Wireless Security – N/A – however, we were asked to comment on the future of wireless
 security for some potential applications that the AGLC was considering running;
 H. Intrusion Detection Systems, firewalls and content checkers – Firewall review, specifically
 related to mail system and firewall policy.
 I. Threats to, and technical vulnerabilities of networks – Respond to advisories issued by
 manufacturers of products utilized in this environment as well as those items that are identified
 through vulnerability scanning.

 Results Achieved:

 Through the engagement, the following results were achieved as defined in the previous section:

 Network Assessment
            •     A detailed report describing the existing hardware configuration, overall plant


Curtis L. Blais                       - Project Summaries -                                  9
                  LAN, WAN, network topology and configuration at the Calgary, St. Albert, and
                  Stettler sites.
            •     Examine the existing WAN implementation connecting administration centers, and
                  casinos, and make recommendations for improvements or enhancements.
            •     Examine the existing backbone and desktop cabling at the St. Albert site and make
                  recommendations on the suitability of the existing cabling.
 Internet and Security
            •     Prepare a vulnerability assessment that examines AGLC Internet connection, and
                  security policy. Based on this assessment we will comment on the existing
                  perimeter defence of AGLC, and make recommendations based on those findings.
            •     Assess the current network management capability of AGLC, and future needs.
                  Based on this research comment on the existing Network Management platform
                  and make recommendations for improvement.
 Network Architecture
                  Prepared an Architecture Plan for each of Calgary, St. Albert, and Settler based on
                  the goal of providing a standardized infrastructure suitable for inclusion in a RFP.
                  This will include:

                     •   A design specification that describes the end-end architecture, for each class
                         of site.
                     •   Modular Network Topology including general network diagrams.
                     •   Proposed IP address structure to encompass all current sites and a roadmap
                         for future sites
                     •   Naming conventions for network nodes.
                     •   Specifications that identify relevant standards and protocols required
                         supporting the proposed design.
                     •   Inclusion of necessary security components, with relevant design
                         specifications to provide perimeter security.




 Title of Project: Architecture & Assessment
 Organization Name: Alberta Municipal Affairs (AMA)/ TELUS
 Start / Finish Dates: January 2003 to March 2003      Total Individual LOE (days):
                                                             12.5 days (billed time)
 Description of Project:

 Emergency Management Alberta of Alberta Municipal Affairs has a business requirement to
 establish a counter terrorist/crisis management system for use in emergencies. The need for such
 a system has been outlined in the business case for a new Government Emergency Operations


Curtis L. Blais                        - Project Summaries -                                10
 Center (GEOC), and an additional requirement for the inclusion of the current reporting
 capabilities of the Emergency Management Information System (EMIS) has been identified.
 The system needs to be capable of supporting immediate response to terrorist threats and
 disasters by allowing data to be interrogated based on level of threat, business sector and/or
 geography and by providing appropriate contact information and reporting.

 Initially, the system will be used to provide internal staff with lists and files to use to phone
 and/or e-mail emergency contacts. In the longer term, the system will need to be capable of
 integrating with automated dial-down, automated e-mail and spatial systems. The system must
 be accessible from outside AMA to be used during crisis management.

 For security reasons, critical infrastructure data must be encrypted. Other contact information
 does not require encryption. The system will make maximum use of the existing stakeholder
 database, SIMS, and incorporate the reporting functionality of the EMIS, allowing it to be
 replaced. The system must also take advantage of existing software, licensing, and hardware to
 minimize costs. Where new or replacement screens are required, if possible, they should
 conform to existing design concepts to make the transition appear seamless.

 The sensitive nature of the data to be stored within the system will require that the strong
 security developed for “Mile-net” to be reused with enhancements to account for the encryption
 requirements.

 The project has been roughly divided up into the three following phases:

                  •   PHASE I – Proof of concept
                  •   PHASE II – Large scale design and build
                  •   PHASE III – Implementation at final location

 The objective of this sub-project was to provide security consulting for the GIS implementation
 to ensure that the initial proof of concept was developed with appropriate security for future
 development of the J-GEOC system.

 Areas of Experience:

 A. War dialers, password crackers – Checking for weak passwords with current tools for
 available password information.
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats.
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Tools used include SuperScan, Nessus, NMAP, and Sniffer.
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP, FTP, TFTP, Telnet;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – utilizing
 IPSEC/PPTP, HTTPS, SSH, SSL, various encryption technologies.
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilized a wide range of the TCP/IP protocol suite
 including both TCP and UDP.
 G. Wireless Security – N/A


Curtis L. Blais                        - Project Summaries -                             11
 H. Intrusion Detection Systems, firewalls and content checkers – Firewall review, security
 architecture including placement strategy for IDS type devices.
 I. Threats to, and technical vulnerabilities of networks – Respond to advisories issued by
 manufacturers of products utilized in this environment as well as those items that are identified
 through vulnerability scanning.

 Results Achieved:

 The Phase I Security Review was conducted as a progressive series of steps, a high-level outline
 of which includes:

 Information gathering – gather information about the current implementation to understand:
     • The GIS system components and how they interact together
     • The requirements of how the AMA J-GEOC system will operate in Crisis Management
        scenarios
     • User connection points
     • All inbound/outbound information and/or data flows

 Documentation – gather or develop diagrams that represent current network systems

 Analysis and Assessment – based on the information and documentation gathered, an assessment
 of the security implications that may exist will be undertaken.

 Concept design/architecture – culminating all the information and analysis together, an
 alternative architecture to improve the security of the J-GEOC system will be crafted and
 documented.

 Report – a report, which includes the analysis of the data gathered, that describes the appropriate
 architecture for the proof of concept implementation of the J-GEOC GIS system. This
 architecture provides the proof of concept architecture for the system to be developed in phase
 II.


 Title of Project: Firewall & VPN Installation
 Organization Name: Caron Transport Inc. / TELUS
 Start / Finish Dates: November 2001 to February 2002            Total Individual LOE (days):
                                                                       11.0 days (billed time)
 Description of Project:

 Caron Transport Ltd. had identified the need to establish a secure perimeter of defence between
 Caron Transport private data networks and the Internet. Existing Firewall services provided by a
 proxy server have proved to be inadequate resulting in reduced performance for Internet
 connected sessions, and limited flexibility in the configuration of security policy. In addition the
 lack of a reliable audit trail has been identified as a weakness in the current environment.

 Considering the nature of Caron Transport business, TELUS Professional Services is


Curtis L. Blais                     - Project Summaries -                                 12
 recommending Caron Transport deploy a WatchGuard 1000 Firewall solution on site to meet
 their perimeter security needs. Properly implemented this will provide a safe and secure platform
 for delivery of network services, and provide the features and capability that Caron Transport
 demands now and in the future.

 Further, as part of the project, TELUS provided a VPN configuration through the use of the
 features in the WatchGuard Firewall allowing for a Mobile user VPN (IPSEC) as well as the
 creation of a PPTP tunnel mechanism to allow for the remote support while the customer
 became familiar with the technology.

 Areas of Experience:

 A. War dialers, password crackers – N/A
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats as well as other services (including the
 WatchGuard service).
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Tools used include SuperScan, NMAP, and Sniffer for all components of this project.
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP, FTP, Telnet;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – utilizing
 IPSEC/PPTP.
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilized a wide range of the TCP/IP protocol suite
 including both TCP and UDP.
 G. Wireless Security – N/A
 H. Intrusion Detection Systems, firewalls and content checkers
 – Existing firewall review/analysis
 - security architecture including placement strategy for firewall
 - Policy development
 - WebBlocker – content checker configuration
 - Setup of IDS properties of Firewall
 I. Threats to, and technical vulnerabilities of networks – Respond to advisories issued by
 manufacturers of products utilized in this environment as well as those items that are identified
 through vulnerability scanning.

 Results Achieved:

     1. Prepared revised LAN/WAN design to include new Firewall components. This included
        the following additional design elements:
        • IP address plan required for implementation
        • NAT specification if required
        • Demilitarized Zone (DMZ) requirements, addressing, migration plan etc
        • Assess any hosting requirements, i.e. DNS, SMTP mail gateway, WWW servers etc
        • Develop and document security policy rules
        • Identification of Policy rules and specific design elements to support use of
            WebBlocker (content filtering technology)
        • Prepare and document ENCAL perimeter security policy rules in preparation for


Curtis L. Blais                     - Project Summaries -                                 13
           deployment during implementation phase
     2. Prepared WatchGuard Firebox 1000 Solution for Deployment. This was performed at
        Caron Transport premises and involved the following:
        • Swap out existing Microsoft proxy Firewall as necessary
        • Physical installation of Firewall, including required cabling
        • Co-ordinate the necessary changes for TELUS managed Internet Gateway routing
           configuration to support a customer owned firewall configuration
        • Establish baseline policy rules on WatchGuard Firewall 1000 solution
        • Install and configure a single management station for performing system
           administration, and firewall maintenance activities
        • Establish centralized logging (audit trail) on main file and print server platform. This
           will provide a central repository for access to the audit trail provided by the firewall.
           Retention periods of 30-60 days will be configured to provide historical and trend
           data for reporting
        • Acceptance test policy rules, and customize to client needs
        • Assist Caron Transport with mentoring and assistance during platform build and
           deployment activities, to enable IT personnel to administer the Firewall platform on a
           ongoing basis
        • Prepare a summary report that will be presented to the client documenting the final
           solution, Firewall policy, and pertinent details regarding the final implementation
        • Design and configuration of Mobile Users VPN solution utilizing local authentication
           (Windows pass-through)
        • Configuration of PPTP tunnel to allow for remote support in order to have the
           customer become familiar with the firewall and it’s operation.


 Title of Project: Firewall & VPN Installation
 Organization Name: Cybertopia Internet Café / TELUS
 Start / Finish Dates: July 2003                                Total Individual LOE (days):
                                                                      6.70 days (billed time)
 Description of Project:

 Cybertopia was an internet café that provided ad-hoc use of internet for people in the downtown
 area of Edmonton. Cybertopia had just changed ownership and the previous owner had taken
 the firewall that was used for the café when they left. This left the new owner of the Internet
 café without a firewall. Our ISP service implemented a NAT based firewall at the edge of the
 environment that inadvertently interrupted the ability for multiple people within the environment
 to play the same internet based games.

 At first this was identified as a potential security incident as the new owner could not explain
 why the internet café was no longer able to play multiplayer internet games and a few other
 oddities within the environment.

 While onsite, testing was performed to attempt to identify the cause of the issue. After gathering
 many points of information it was identified that the NAT portion of the Cisco router on the



Curtis L. Blais                    - Project Summaries -                                  14
 edge of the environment was causing issues with multiple hosts within the environment when
 they expected to use the same port pair combinations. This issue was identified to the new
 owners and it was recommended that a specialized gaming firewall that did not perform NAT be
 installed to alleviate the problem.

 Areas of Experience:

 A. War dialers, password crackers – N/A
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats as well as other services (including the
 WatchGuard service as this was the Firewall recommended to the customer due to it’s ability to
 be placed in the environment in bridged mode).
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Tools used include SuperScan, NMAP, and Sniffer for all components of this project.
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP, FTP, Telnet;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – N/A.
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilized a wide range of the TCP/IP protocol suite
 including both TCP and UDP.
 G. Wireless Security – N/A
 H. Intrusion Detection Systems, firewalls and content checkers
 – Existing firewall review/analysis
 - security architecture including placement strategy for recommended firewall
 - Research into the operation of NAT on edge routers (Cisco based)
 I. Threats to, and technical vulnerabilities of networks – Responded to advisories issued by
 manufacturers of products utilized in this environment as well as those items that are identified
 through testing.

 Results Achieved:

          Identification of the issue as being a nuance of the Network Address Translation of an
          edge router through on-site security testing and information gathering along with vendor
          specific research to identify the problem.

          Recommendations to alleviate the issue and still preserve the environment in a secure
          manner was to place a firewall device that allows for Bridge mode (or routed mode with
          a new set of addresses on the outside) that do not require NAT. In this way the IP
          address/ Port pair combinations would not cause issues for those who are looking to use
          services that require the same TCP/UDP port pairings.



 Title of Project: Security Assessment
 Organization Name: Enbridge Inc. / TELUS
 Start / Finish Dates: May 2004 to December 2004                 Total Individual LOE (days):
                                                                      62.50 days (billed time)
 Description of Project:


Curtis L. Blais                     - Project Summaries -                                 15
 The Network Perimeter Security Assessment was conducted on site and in serial for each
 location (Alberta, Toronto and Houston) and as a progressive series of steps, a high-level outline
 of which includes:
     1. Information gathering – Collect information through various means, including tools
         deemed appropriate and provided by TELUS Solutions Consulting personnel, about the
         current implementation to understand:
             a. Enbridge network components
             b. Enbridge security components
             c. Network/security Architecture
             d. External connections
             e. Internal DNS structure/operations
             f. Future additions to the Enbridge environment
     2. Documentation – Gather and organize diagrams that represent current perimeter
         network/security systems.
     3. Analysis and assessment – based on the information gathered and/or created, an
         assessment of any security implications that may exist.
     4. Risk identification – through the analysis of the information gathered, compile and
         classify any identified risks.
     5. Recommendations – Consolidating all the information and analysis together,
         recommendations based on industry best practices will be crafted. This may include
         recommendations specific to the Enbridge network and/or security architecture.
     6. Report – Develop a final report including findings, identified risks and
         recommendations.
     7. Integrated Network Diagram – based on the information gathered for the three
         geographically identified organizations create a high level diagram showing the
         interaction.
     8. Presentation – The final results of the Network Perimeter Security Assessment will be
         culminated into an executive presentation and delivered at each location.

 Areas of Experience:

 A. War dialers, password crackers – Password strength verification performed to ensure that
 passwords meet policy requirements as part of the organization’s security policy.
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats as well as other services.
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Tools used include SuperScan, NMAP/Nessus, and Foundstone were utilized for this project.
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP, FTP, Telnet, Dynamic routing
 protocols;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – IPSEC, SSH,
 HTTPS.
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilized a wide range of the TCP/IP protocol suite


Curtis L. Blais                    - Project Summaries -                                16
 including both TCP and UDP.
 G. Wireless Security – Scanned for rogue wireless devices on the wire utilizing banner grab
 capabilities and NASL scripts that look for common wireless devices.
 H. Intrusion Detection Systems, firewalls and content checkers
 – Existing firewall review/analysis at all locations (3 – international)
 - security architecture including placement strategy for IDS at 1 of the environments
 - Verified the operation of existing IDS at US location.
 I. Threats to, and technical vulnerabilities of networks – Responded to advisories issued by
 manufacturers of products utilized in this environment as well as those items that are identified
 through testing.

 Results Achieved:

 The results that were achieved for this engagement:

          1.      A Network Perimeter Security Assessment report including the following items:
                     a. Executive Summary
                     b. Current Logical Topology (concentrating on the perimeter) for all three
                        geographically disbursed locations.
                     c. Firewall Policy Review for all three locations.
                     d. Remote Access Review for all three locations.
                     e. Perimeter/DMZ Host Scan
                     f. Connections to External/Partner Networks review (including other Enbridge
                        Companies)
                     g. Supplementary items (any critical items identified through the information
                        discovery)
                     h. Recommendations and Conclusions (over 40 recommendations) all
                        categorized by High medium and low risk.
          2.      Presentation of final report information and results, on site at each of the locations.


 Title of Project: Network Based Anomaly Detection Installation
 Organization Name: Encana Inc. / TELUS
 Start / Finish Dates: August 2005                         Total Individual LOE (days):
                                                                        2 days
 Description of Project:

 This project was to install a Network Based Anomaly Detection system into the network
 environment. This system is the next generation of anomaly detection in network environments
 and operates in an out of band manner. It has the ability to identify zero day activity within the
 environment as well as activity that is not recognized as normal within the environment.

 Project included appropriate sensor placement after understanding the network topology as well
 as the setup and configuration of flow based information sources at various points within the
 environment. Also included the initial configuration of the equipment and setup for the specific
 environment for which it will analyse data.


Curtis L. Blais                         - Project Summaries -                                   17
 Areas of Experience:

 A. War dialers, password crackers – N/A
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats as well as the Arbor Networks Threat
 service.
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – N/A
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – SSH, HTTPS.
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilized a wide range of the TCP/IP protocol suite
 including both TCP and UDP.
 G. Wireless Security – N/A
 H. Intrusion Detection Systems, firewalls and content checkers
 – Filtering and fire-walling for NBADS set up ion equipment to protect who has access and what
 device are allowed to send flow based information.
 I. Threats to, and technical vulnerabilities of networks – Responded to advisories issued by
 manufacturers of products utilized in this environment as well as those items that are identified.

 Results Achieved:

 The results that were achieved for this engagement include the following:

     1. On-site installation of NBADS equipment to monitor and collect statistical information
        within the environment
     2. Configuration of the Collector to accept flow based information from various points
        within the environment
     3. Configuration of the Controller to accept information from the collector
     4. Configuration of security parameters to allow only authorized personnel to gain access to
        the NBADS console/web interface.
     5. Start configuration of settings for alarms thresholds and notification parameters within
        the environment.
     6. Configuration of Active Threat Feed service – allowing real-time threat information to be
        updated and then actively sought within the environment.
     7. Identification of switches and firewall devices that could be used for Proactive Filtering
        push by the NBADS tool.


 Title of Project: National DMZ Review
 Organization Name: HRDC (Government of Canada) / TELUS
 Start / Finish Dates: August 2001 to July 2002      Total Individual LOE (days):
                                                          29.97 days (billed time)
 Description of Project:

 The review of the secure perimeter for HRDC was intended to assess the following issues:


Curtis L. Blais                    - Project Summaries -                                18
     1.   Understand the operational and business processes
     2.   Performance, scalability and stability of the components
     3.   Effects of introducing new components on established processes
     4.   Make recommendations as appropriate for improving perimeter security. The report will
          consider current and future functionality of the components as described by vendors and
          their relevance to HRDC requirements.

 The review included components up to and including the internal hub that connects the HRDC
 backbone network to the DMZ with the exception of headquarters. At HQ, the review included
 the router on the edge of the backbone network due to special connectivity requirements at this
 location. Particular attention was paid to traffic shaping and caching technologies. The intent
 was to recommend a generic design that could be applied to all sites with Extranet connections
 to HRDC.

 Areas of Experience:

 A. War dialers, password crackers – N/A
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats.
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – N/A
 D. Networking Protocols (HTTP, FTP, Telnet) – Wide variety of networking protocols were
 investigated and assessed with this specific project.
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – SSH, HTTPS,
 IPSEC (specifically around the Kyberpass technology).
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilized a wide range of the TCP/IP protocol suite
 including both TCP and UDP.
 G. Wireless Security – N/A
 H. Intrusion Detection Systems, firewalls and content checkers – N/A
 I. Threats to, and technical vulnerabilities of networks – Responded to advisories issued by
 manufacturers of products utilized in this environment as well as those items that are identified.
 Specific items around the Kyberpass technology were evaluated.

 Results Achieved:

 The results that were achieved for this engagement include the following:

          1.      Review of all components of the National DMZ architecture of HRDC.
          2.      Investigate the protocols and applications delivered through the DMZ
          3.      Investigate encryption mechanism around the Kyberpass technology.
          4.      Architect a current view diagram of the environment
          5.      Interview various individuals to collect information around the security environment
                  of the HRDC DMZ including individuals at PWGSC.
          6.      Analysis of all the information collected
          7.      Formulation of recommendations to improve the security position of the DMZ



Curtis L. Blais                        - Project Summaries -                                19
              architecture
          8. Architect diagrams of the proposed architecture
          9. Propose a new VPN architecture to replace the dual encryption technology that was
              currently in use and was causing issues of throughput in the environment.
          10. Authored a report that provided all the information identified above.


 Title of Project: Security Investigation
 Organization Name: Interbaun Communications / TELUS
 Start / Finish Dates: September 2003                Total Individual LOE (days):
                                                           4.48 days (billed time)
 Description of Project:

 A particularly elusive problem was plaguing an ISP and their ADSL customers within their
 environment. The project involved having a Network/Security resource collect information
 about the problem and help to identify the issue. At the time it was not known if the issue was
 network or security related.

 Areas of Experience:

 A. War dialers, password crackers – N/A
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats.
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Small amount of scanning – however packet capture was also utilized in this situation
 D. Networking Protocols (HTTP, FTP, Telnet) – Wide variety of networking protocols were
 investigated and assessed with this specific project.
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – HTTPS
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilized a wide range of the TCP/IP protocol suite
 including both TCP and UDP.
 G. Wireless Security – Investigated in the case that the local wireless access point may have
 been a part of the issue.
 H. Intrusion Detection Systems, firewalls and content checkers – N/A
 I. Threats to, and technical vulnerabilities of networks – Responded to advisories issued by
 manufacturers of products utilized in this environment as well as those items that are identified.
 This proved to be the most important point in this specific engagement.

 Results Achieved:

 The results that were achieved for this engagement include the following:

          1.      Definition of the actual issue
          2.      Identification of the symptoms
          3.      Gathering of a wide range of information to perform analysis and narrow the scope
                  of the investigation
          4.      Analysis of information


Curtis L. Blais                        - Project Summaries -                              20
          5.      Review of log files
          6.      Identification of actual issue
          7.      Recommendation for resolution (once applied – incident solved)


 Title of Project: Network Based Anomaly Detection Installation
 Organization Name: Northern Alberta Institute of Technology / TELUS
 Start / Finish Dates: November 2005                        Total Individual LOE (days):
                                                                         2 days
 Description of Project:

 This project was to install a Network Based Anomaly Detection system into the network
 environment. This system is the next generation of anomaly detection in network environments
 and operates in an out of band manner. It has the ability to identify zero day activity within the
 environment as well as activity that is not recognized as normal within the environment.

 Project included appropriate sensor placement after understanding the network topology as well
 as the setup and configuration of flow based information sources at various points within the
 environment. Also included the initial configuration of the equipment and setup for the specific
 environment for which it will analyse data.

 Areas of Experience:

 A. War dialers, password crackers – N/A
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats as well as the Arbor Networks Threat
 service.
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – N/A
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – SSH, HTTPS.
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilized a wide range of the TCP/IP protocol suite
 including both TCP and UDP.
 G. Wireless Security – N/A
 H. Intrusion Detection Systems, firewalls and content checkers
 – Filtering and fire-walling for NBADS set up ion equipment to protect who has access and what
 device are allowed to send flow based information.
 I. Threats to, and technical vulnerabilities of networks – Responded to advisories issued by
 manufacturers of products utilized in this environment as well as those items that are identified.

 Results Achieved:

 The results that were achieved for this engagement include the following:

          1.      On-site installation of NBADS equipment to monitor and collect statistical
                  information within the environment


Curtis L. Blais                        - Project Summaries -                               21
          2.      Configuration of the Collector to accept flow based information from various points
                  within the environment
          3.      Configuration of the Controller to accept information from the collector
          4.      Configuration of security parameters to allow only authorized personnel to gain
                  access to the NBADS console/web interface.
          5.      Start configuration of settings for alarms thresholds and notification parameters
                  within the environment.
          6.      Configuration of Active Threat Feed service – allowing real-time threat information
                  to be updated and then actively sought within the environment.
          7.      Identification of switches and firewall devices that could be used for Proactive
                  Filtering push by the NBADS tool.


 Title of Project: Denial of Service Mitigation Project
 Organization Name: Neteller Inc. / TELUS
 Start / Finish Dates: September 2004 to December 2004             Total Individual LOE (days):
                                                                         8.14 days (billed time)
 Description of Project:

 The primary objective of this engagement was to assist with a number of Internet and enterprise
 security initiatives for the organization. The following specific objectives were identified:

     1. DDOS project planning and design sessions. Due to the possibility of DDOS activity,
        which potentially could disrupt the business, the organization was looking to trial a
        potential solution to allow them to sustain a possible DDOS attack. As identified in a
        meeting they were interested in pursuing a trial of the specific technologies to assist with
        this potential issue. The trial will provide information to determine if the specified
        technologies provide a level of protection for the online services and identify a
        sustainable attack threshold.
     2. Review architecture/design from a security point of view and create a security design
        document as part of the build for this environment. A physical review of this
        architecture will be performed by an independent organization after the architecture is
        functional.
     3. Long-term security strategy/vision. With inputs from the network implementation
        strategy that is currently underway, assist with the development of a longer-term strategy
        encompassing security for the environment..

 Areas of Experience:

 A. War dialers, password crackers – N/A
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats as well as the vendor specific threat
 services.
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Utilized within the environment – targeted toward specific machines. Traffic generation
 devices were also used to generate high levels of traffic to simulate DDOS circumstances.


Curtis L. Blais                        - Project Summaries -                               22
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP, FTP, TFTP, BGP;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – SSH, HTTPS.
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilized a wide range of the TCP/IP protocol suite
 including both TCP and UDP in order to effectively simulate a DDOS attack.
 G. Wireless Security – N/A
 H. Intrusion Detection Systems, firewalls and content checkers
 – A DDOS detection mechanism (more than one) was used to test the response to various forms
 of attack.
 I. Threats to, and technical vulnerabilities of networks – Responded to advisories issued by
 manufacturers of products utilized in this environment as well as those items that were
 identified.
 Results Achieved:

 The results that were achieved for this engagement include the following:

          1.      Identification of specific security (DDOS) requirements
          2.      Translation of requirements to specific technical specifications
          3.      Identification of Vendors and products that fit the identified specifications
          4.      Acquisition of equipment for test purposes
          5.      Design of a test bed and formulation of test plan
          6.      Build of test bed
          7.      Installation and configuration of evaluation equipment
          8.      Simulation of various attacks, recording of results
          9.      Interaction with vendors to solve test specific testing items
          10.     Gathering and review of all testing information
          11.     Rating of evaluation equipment
          12.     In-person, live demonstration of tests and results
          13.     Recommendation of DDOS direction, product selection, and configuration
          14.     Finalized service


 Title of Project: IT Security Assessment (ISO-17799)
 Organization Name: Edmonton Oilers Hockey Club / TELUS
 Start / Finish Dates: August 2003 to December 2003   Total Individual LOE (days):
                                                           10.42 days (billed time)
 Description of Project:

 The approach to this project was to provide a high level Security Assessment, by identifying
 areas of risk, vulnerabilities and mitigating actions within the business context and
 corresponding strategic requirements. The sections below explain the steps used to perform the
 Security Assessment for the non-technical elements including security strategy, IT operations,
 logical controls, physical security, business continuity, the risk management program and
 practices, IT policies and procedures, systems development and maintenance, information
 classification, data integrity and security skills.

 Information Gathering


Curtis L. Blais                         - Project Summaries -                                     23
 TELUS began by assisting in defining information assets and the impact that loss, damage or
 compromise of those assets could have on business. It also included a review of all existing IT
 services and information repositories. The major risks/threats facing the organization were
 identified and prioritized to assist in planning the most effective means to protect the assets and
 improve overall security. This information was collected using questionnaires and/or
 interviews. The questionnaires were distributed as part of an initial engagement package and
 delivered in person, on-site at the corporate headquarters. Also, as part of this step, we collected
 and reviewed corporate information such as existing IT security policies, procedures,
 configuration documentation, and all other documentation related to IT security.

 Personnel selected to complete the initial engagement questionnaires were determined upon
 commencement of the project.

 We worked with the IT staff to conduct a qualitative risk assessment in order to determine the
 current state of the organization’s IT security. We used a top-down approach – allowing our
 consultants to look at the entire environment, at a high level, and identify the most serious
 exposures. Additional vulnerabilities were then identified as we gained a better understanding
 of the IT environment. This approach also helped to establish priorities and direction for the
 remainder of the analysis.
 The objectives of this type of analysis is to determine the business functions where there is the
 highest potential for loss as well as determining the highest potential risk factors, thereby
 narrowing the scope of the risk assessment to a manageable size. Broadly speaking, though, the
 goal of risk management is to assist management in deciding what countermeasures to
 implement that will help to reduce risk yet conserve resources. A key factor in determining risk
 is evaluating the probability that an undesirable event could affect a critical asset. Only after its
 probability has been properly understood can steps be taken to address how to reduce, eliminate
 or mitigate that risk.

 Physical Site Review

 Because nearly 80% of threats to the average organization’s information assets come from
 within the organization itself, it is essential that physical controls are adequate and effective.
 Our physical assessment examined IT physical access controls (i.e. card and badge systems,
 door locks, CCTV systems, power systems, server location and access to it, etc). It also
 addressed issues such as equipment and component theft protection, cable protection (from
 tampering or tapping) and the security provisions governing how the data and equipment is
 taken off-site (using a laptop) or how data is sent for disposal (i.e. secure erasure).

 Analysis

 In this step, we created a snapshot of the current state of IT security and identified the ideal state.
 Drawing on industry best practices and our experience, we performed a gap analysis of the
 current and future states and recommend the best process (including priority setting) for
 transitioning to that future state. The analysis included best practices and recommendations for
 improvement as required – all tailored to be specific to this environment. The goal of the



Curtis L. Blais                     - Project Summaries -                                   24
 Analysis Phase was to address the identified vulnerabilities by formulating a cost-effective
 solution. As mentioned above, each of the acknowledged vulnerabilities were prioritized based
 on potential loss and the likelihood of the loss occurring.

 Areas of Experience:

 A. War dialers, password crackers – Checked for password strength using Johntheripper.
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats as well as the vendor specific threat
 services.
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Utilized NMAP/Superscan within the environment – targeted toward specific machines.
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP, FTP, TFTP;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – SSH, HTTPS.
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilized a wide range of the TCP/IP protocol suite
 including both TCP and UDP in order to effectively identify potential issues.
 G. Wireless Security – N/A
 H. Intrusion Detection Systems, firewalls and content checkers
 – Firewall policy reviewed in great detail.
 I. Threats to, and technical vulnerabilities of networks – Responded to advisories issued by
 manufacturers of products utilized in this environment as well as those items that were
 identified.
 Results Achieved:

 Identified risks and recommended controls to mitigate them were organized into an Action Plan
 divided into areas, costs and risks. This plan also recommended tools, improved processes,
 development of new policies or the modification of old ones. This plan was constructed based
 on what we identified as the key areas requiring priority attention. The risks were summarized
 in the following four categories:

     1. Items for Immediate Resolution – During the Security Assessment itself, we would
        immediately notify the customer of any immediate action needed to eliminate specific
        exposures.
     2. Short-term/Limited Resources - Security deficiencies that can be rectified with limited
        expenditure or organizational change were placed into this category.
     3. Short-term/Substantial Resources - Security deficiencies that required significant
        expenditures, organizational changes or support from outside service providers will have
        been placed into this category.
     4. Long-term - Security deficiencies that would require long-term changes to organizational
        structure, or support requirements from outside the organization, required the use of
        other technologies or revisions in business practices that would provide ongoing benefits
        were placed into this category.

 The report was presented in person to the executive management team and well received.




Curtis L. Blais                    - Project Summaries -                                25
 Title of Project: IT Security Assessment (ISO – 17799)
 Organization Name: Government of BC – POIM office / TELUS
 Start / Finish Dates: August 2003 to December 2003     Total Individual LOE (days):
                                                             12.50 days (billed time)
 Description of Project:

 The approach to this project was to provide a high level Security Assessment, by identifying
 areas of risk, vulnerabilities and mitigating actions within the business context and
 corresponding strategic requirements. The sections below explain the steps used to perform the
 Security Assessment for the non-technical elements including security strategy, IT operations,
 logical controls, physical security, business continuity, the risk management program and
 practices, IT policies and procedures, systems development and maintenance, information
 classification, data integrity and security skills.

 Information Gathering

 TELUS began by assisting in defining information assets and the impact that loss, damage or
 compromise of those assets could have on business. It also included a review of all existing IT
 services and information repositories. The major risks/threats facing the organization were
 identified and prioritized to assist in planning the most effective means to protect the assets and
 improve overall security. This information was collected using questionnaires and/or
 interviews. The questionnaires were distributed as part of an initial engagement package and
 delivered in person, on-site at the corporate headquarters. Also, as part of this step, we collected
 and reviewed corporate information such as existing IT security policies, procedures,
 configuration documentation, and all other documentation related to IT security.

 Personnel selected to complete the initial engagement questionnaires were determined upon
 commencement of the project.

 We worked with the IT staff to conduct a qualitative risk assessment in order to determine the
 current state of the organization’s IT security. We used a top-down approach – allowing our
 consultants to look at the entire environment, at a high level, and identify the most serious
 exposures. Additional vulnerabilities were then identified as we gained a better understanding
 of the IT environment. This approach also helped to establish priorities and direction for the
 remainder of the analysis.
 The objectives of this type of analysis is to determine the business functions where there is the
 highest potential for loss as well as determining the highest potential risk factors, thereby
 narrowing the scope of the risk assessment to a manageable size. Broadly speaking, though, the
 goal of risk management is to assist management in deciding what countermeasures to
 implement that will help to reduce risk yet conserve resources. A key factor in determining risk
 is evaluating the probability that an undesirable event could affect a critical asset. Only after its
 probability has been properly understood can steps be taken to address how to reduce, eliminate
 or mitigate that risk.

 Physical Site Review




Curtis L. Blais                     - Project Summaries -                                  26
 Because nearly 80% of threats to the average organization’s information assets come from
 within the organization itself, it is essential that physical controls are adequate and effective.
 Our physical assessment examined IT physical access controls (i.e. card and badge systems,
 door locks, CCTV systems, power systems, server location and access to it, etc). It also
 addressed issues such as equipment and component theft protection, cable protection (from
 tampering or tapping) and the security provisions governing how the data and equipment is
 taken off-site (using a laptop) or how data is sent for disposal (i.e. secure erasure).

 Analysis

 In this step, we created a snapshot of the current state of IT security and identified the ideal state.
 Drawing on industry best practices and our experience, we performed a gap analysis of the
 current and future states and recommend the best process (including priority setting) for
 transitioning to that future state. The analysis included best practices and recommendations for
 improvement as required – all tailored to be specific to this environment. The goal of the
 Analysis Phase was to address the identified vulnerabilities by formulating a cost-effective
 solution. As mentioned above, each of the acknowledged vulnerabilities were prioritized based
 on potential loss and the likelihood of the loss occurring.

 Areas of Experience:

 A. War dialers, password crackers – Checked for password strength using Johntheripper.
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats as well as the vendor specific threat
 services.
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Utilized NMAP/Superscan within the environment – targeted toward specific machines.
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP, FTP, TFTP;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – SSH, HTTPS.
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilized a wide range of the TCP/IP protocol suite
 including both TCP and UDP in order to effectively identify potential issues.
 G. Wireless Security – N/A
 H. Intrusion Detection Systems, firewalls and content checkers
 – Firewall policy reviewed in great detail.
 I. Threats to, and technical vulnerabilities of networks – Responded to advisories issued by
 manufacturers of products utilized in this environment as well as those items that were
 identified.
 Results Achieved:

 Identified risks and recommended controls to mitigate them were organized into an Action Plan
 divided into areas, costs and risks. This plan also recommended tools, improved processes,
 development of new policies or the modification of old ones. This plan was constructed based
 on what we identified as the key areas requiring priority attention. The risks were summarized
 in the following four categories:

     1. Items for Immediate Resolution – During the Security Assessment itself, we would



Curtis L. Blais                     - Project Summaries -                                   27
        immediately notify the customer of any immediate action needed to eliminate specific
        exposures.
     2. Short-term/Limited Resources - Security deficiencies that can be rectified with limited
        expenditure or organizational change were placed into this category.
     3. Short-term/Substantial Resources - Security deficiencies that required significant
        expenditures, organizational changes or support from outside service providers will have
        been placed into this category.
     4. Long-term - Security deficiencies that would require long-term changes to organizational
        structure, or support requirements from outside the organization, required the use of
        other technologies or revisions in business practices that would provide ongoing benefits
        were placed into this category.

 The report was presented in person to the executive management team and well received.


 Title of Project: Perimeter Security Assessment
 Organization Name: Vancouver International Airport / TELUS
 Start / Finish Dates: May 2003 to August 2003           Total Individual LOE (days):
                                                              12.50 days (billed time)
 Description of Project:

 The Perimeter Security Assessment was conducted as a progressive series of steps, a high-level
 outline of which includes:

     1. Information gathering – Collect information through various means, including tools
        deemed appropriate and provided by TELUS Professional Services personnel, about the
        current implementation to understand:

              a.   Network components
              b.   Security components
              c.   Network/security Architecture
              d.   Partner/tenant interaction
              e.   Future additions to the environment

     2. Documentation – Gather and organize diagrams that represent current network/security
        systems.

     3. Analysis and assessment – based on the information gathered and/or created, an
        assessment of any security implications that may exist will be undertaken.

     4. Recommendations – Consolidating all the information and analysis together, with
        recommendations which were based on industry best practices.

     5. Report – Develop a final report and presentation including findings and
        recommendations.



Curtis L. Blais                      - Project Summaries -                            28
 Areas of Experience:

 A. War dialers, password crackers – Checked for password strength using Johntheripper.
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats as well as the vendor specific threat
 services.
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Utilized NMAP/Superscan along with Nessus within the environment – targeted toward
 specific machines in the DMZ and internally.
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP, FTP, TFTP;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – SSH, HTTPS,
 IPSEC.
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilized a wide range of the TCP/IP protocol suite
 including both TCP and UDP in order to effectively identify potential issues.
 G. Wireless Security – Major component as part of infrastructure utilized this for operations.
 H. Intrusion Detection Systems, firewalls and content checkers
 – Firewall policy reviewed in great detail along with IDS placement and configuration.
 I. Threats to, and technical vulnerabilities of networks – Responded to advisories issued by
 manufacturers of products utilized in this environment as well as those items that were
 identified.
 Results Achieved:

          The results for this project included a detailed report that included all the findings as a
          result of the data gathering and analysis. Over 30 recommendations were made to
          improve the security environment and an in-person final presentation was performed to
          convey the findings.



 Title of Project: Network & Security Assessment
 Organization Name: Keyano College / TELUS
 Start / Finish Dates: July 2001 to October 2001                  Total Individual LOE (days):
                                                                       12.50 days (billed time)
 Description of Project:

 Keyano College is committed to providing excellent education, training and services that will
 prepare people for the challenges of work and enhance individual growth. Keyano College holds
 the fundamental belief that its purpose is to enable students to meet the challenges of the future
 through accessible programming that maximizes the potential of students, and promotes
 individual and community development, which will improve the quality of life in our region and
 throughout Alberta

 With this incredible growth, Keyano College was looking to understand how the data network
 infrastructure has grown by requesting that TELUS Professional Services perform a Network &
 Security Review on the current environment. This Review provided detailed information on the
 current logical, physical and security configuration to provide Keyano College with information


Curtis L. Blais                      - Project Summaries -                                  29
 to move forward with their evolving data network and security demands.

 In order to satisfy the outlined objectives above, TELUS performed the on site tasks listed
 below:
     • Review any existing documentation provided about the site
     • Visit the Clearwater Campus site to:
             o Review the current physical setup of the network and document the same
             o Review cabling and document the same
             o Review the existing LAN hardware configuration and document the same (logical
                 Network)
             o Identify any security items that become known through the investigative process


 Areas of Experience:

 A. War dialers, password crackers – Checked for password policy requirements.
 B. Use of Public Domain IT vulnerability advisory services – SANS and Search Security
 services to be aware of current vulnerabilities and threats as well as the vendor specific threat
 services.
 C. Network scanners and vulnerability analysis tools such as SATAN, ISS, Portscan & NMap
 – Utilized NMAP & Superscan.
 D. Networking Protocols (HTTP, FTP, Telnet) – HTTP, FTP, TFTP;
 E. Internet security protocols such as SSL, S-HTTP, S-MIME, IPSec, SSH – N/A.
 F. TCP/IP, UDP, DNS, SMTP, SNMP – Utilized a wide range of the TCP/IP protocol suite
 including both TCP and UDP in order to effectively identify potential issues.
 G. Wireless Security – Internet was a Wireless connection with a local provider. This was
 reviewed from a network and security perspective.
 H. Intrusion Detection Systems, firewalls and content checkers
 – Firewall policy reviewed. Content filtering discussed as a recommendation.
 I. Threats to, and technical vulnerabilities of networks – Responded to advisories issued by
 manufacturers of products utilized in this environment as well as those items that were
 identified. Significant research in these areas were required on some equipment that was very
 old and no longer in production.
 Results Achieved:

          The results for this project included a detailed report that included all the findings as a
          result of the data gathering and analysis. Many recommendations were made to improve
          the security and network position of the institution.




Curtis L. Blais                     - Project Summaries -                                 30

				
DOCUMENT INFO
Shared By:
Categories:
Tags:
Stats:
views:3
posted:7/12/2011
language:English
pages:30