As the internship comes to an end, most of the major problems I found are now documented, but there is still a lot of work that could be done. The next step for the school should be turning individual security improvements into a system that can be maintained over time. A security assessment is useful once, but without clear policies and someone to take care of everything that's happening, my work could become: nothing...
One of the biggest priorities should be monitoring. The school should know when a server goes offline, when a certificate expires, when storage becomes full or when a network device stops responding. As I came back in Estonia, I left an SSH port open for me to manage the server and see the testing of production while classes and children are coming to school. Sometimes the server gets overwhelmed, other times everything runs fine. Really, most of the time runs smoothly since it's something that is used as an alternative and not everyone has access all the time. Yet, I won't be always here.
During the internship, I often had to check systems manually, which works during testing but does not scale. A monitoring platform such as Zabbix, Prometheus could provide a centralized view of the infrastructure and notify the responsible person before users start reporting problems. So, that's what I setup with:
# pseudo-config
monitoring:
interval: 60s
timeout: 5s
targets:
- name: "School internal website"
type: http
url: "https://intranet.school.local"
expected_status: 200
- name: "Mail server"
type: tcp
host: "10.10.20.5"
port: 443
- name: "LDAP / Authentik"
type: tcp
host: "10.10.20.6"
port: 636
- name: "Main router"
type: icmp
host: "10.10.0.1"
- name: "Backup server"
type: tcp
host: "10.10.30.10"
port: 22
alerts:
server_down:
condition: "3 failed checks"
severity: critical
high_cpu:
condition: "cpu > 90% for 5m"
severity: warning
high_memory:
condition: "memory > 85% for 10m"
severity: warning
low_disk_space:
condition: "disk_free < 15%"
severity: critical
certificate_expiry:
condition: "tls_days_remaining < 14"
severity: warning
notifications:
- type: email
destination: "it-alerts@school.local"
- type: log
path: "/var/log/monitoring/alerts.log"
Network segmentation should also continue to improve. Pupil devices, administrative devices, servers should not all have the same level of access. Right now, there is some separation between administrative devices, but there's a long way until we can give Internet access to the entire school. Right now, only library computers can access the internal website and use the very-very demo booking system (Hey, inspired from TalTech!) and 12 graders were optionally asked feedback from it (since they were the only one allowed legally)
I also forwarded a plan to the Principal about moving everything to a cloud server as a backup, but I guess this remains for the future.
At the same time: a central identity provider would make it easier to create, disable and control accounts while also reducing the number of passwords users need to manage. However, any future implementation would have to consider legislation and who will be responsible for the system after deployment.
Finally, the school would benefit from clearer documentation and incident procedures. Network diagrams, backup procedures, system owners and emergency contacts should not exist only in someone's memory. The same principle applies to physical security and the guard procedures I worked on earlier. If an incident happens, the people involved should already know who to contact and what information needs to be recorded.
I do not think the school suddenly became secure because of this internship and that would be bold to claim. However, several risks were highlighted and technical issues were discussed with the people responsible for the infrastructure.
(Image from the document pitch to implement cloud computing)
The main lesson I am taking away is that cybersecurity is not only about finding vulnerabilities. It is about understanding how an organization works, deciding which risks actually matter and creating solutions that people can realistically maintain. The computers are only a part of it. :)
Comments (0)
no comments yet.