.gif){kind=logo}
Clean Access Agent FAQ Key Terms
A: Clean access is a solution provided by Cisco, Inc. that performs network validation. The software performs the following functions:
Q: What Networks Require Validation? A: We are deploying the validation solution to the student residential network in the summer semester 2005. Q: Why Are We Introducing this Solution Now? A: Each semester, student machines are introduced to the campus that potentially contain harmful viruses and malware. On move-in weekend in particular, worms and viruses attempt to spread to unpatched/vulnerable machines. Network Services determined that the best way to prevent this from happening is to insure that virus software and Operating System critical update/patches are current and maintained. A: Similar to the "Computer Registration" form, this solution will redirect any Internet browser request to a web page that instructs the user to download and install the validation client known as the "Cisco Clean Access Agent". Once launched, the client downloads the validation rules and processes them. If the workstation fails the test, it is allowed Internet access only to the remediation sites for a period of about 30 minutes. Once corrected, full network access is provided. Q: Where do the Cisco Clean Access Servers Fit in the Network? A: There is a management server, known as "Clean Access Manager" which provides the administration of the Cisco Clean Access-protected network. The enforcement servers are known as "Clean Access Servers." We are configuring a pair of Clean Access Servers for every 2500 network ports. The Clean Access Servers receive the validation instructions from the Clean Access Manager and download these to each client installed on workstations which connect to the network. We have configured the Clean Access Servers as routers in the university network. Access to the network is controlled via access control lists on the router. Thus, unauthenticated access is limited to very few network addresses; once authenticated and validated, Cisco Clean Access modifies the access controls to allow full access to the network. Q: What is the Clean Access Agent? A: Clean Access Agent is the client application that can check certain security settings on any Microsoft Windows PC to make sure that the system is up-to-date with required security patches and report this status to the Clean Access Server. No information about the user or the content of user files is sent to the server. Each user must use Clean Access Agent for his/her Microsoft Windows PC in order to authenticate and use the university network. Q: What Validation Checks are Being Performed? A: For Summer and Fall semesters, we are configuring Cisco Clean Access to validate the following:
Q: How Long Do the Validation Checks Take? A: In our pilots to date, the checks take between 15 and 30 seconds. Q: What is the Process for Changing the Minimum Security Requirements? A:>As new critical Microsoft updates become available, the security requirements will be updated to reflect the new patches. Typically, we will not immediately set the validation check for the new patches, but allow some time (typically a week) for people to update their systems in due course. If a vulnerability is reported or the threat of a virus storm or worm attack emerges, we will update the validation check immediately in reaction to the threat. We will send a message to your student email account. Please note that we may cancel all network connections for a particular subnet in response to an attack. Again, we will send email and will only resort to these actions in very urgent conditions. A: We plan to configure the validation timer for every 7 days. Initial plans are for early Sunday mornings. Q: How Does Validation Work for Macintosh Users? A: Currently Macintosh users must authenticate by logging in via a web page. The only validation check for Macintosh systems is the Nessus scan. At this point there is no client which is downloaded to Macintosh systems. The network connection timer is set for Macintosh systems; however, there is no icon that can be right-clicked to logout and subsequently login again. Q: How Does Validation Work for Linux Users? A:Linux users must authenticate by logging in via a web page. The only validation check for Linux systems is the Nessus scan. There is no client which is downloaded to Linux systems. The network connection timer is set for Linux systems; however, there is no icon that can be right-clicked to logout and subsequently login again. A: Nessus plug-ins are very much like virus signatures in a common virus scanner application. Each plug-in is written to test for a specific vulnerability. These can be written to actually exploit the vulnerability or just test for known vulnerable software versions. Plug-ins can be written in most any language but usually are written in the Nessus Attack Scripting Language (NASL). NASL is Nessus' own language, specifically designed for vulnerability test writing. Each plug-in is written to test for a specific known vulnerability and/or industry best practices. NASL plug-ins typically test by sending very specific code to the target and comparing the results against stored vulnerable values. Nessus can scan some of the well known worm backdoors. For example, W32.Dabber propagates by exploiting a vulnerability in the FTP server component of W32.Sasser.Worm and its variants. It installs a backdoor on infected hosts and tries to listen on port 9898. If the attempt fails, W32Dabber.A tries to listen on ports 9899 through 9999 in sequence until it finds an open port. Nessus will look for the open port if the machine is infected. Q: What About Xboxes, PlayStations, etc.? A: Please call the Help Desk to activate your game console. Make sure to provide Dorm/Room/Name and MAC address of the console. Click here for help finding your MAC address. Within two days, your console will be placed in the Gaming Role. The Gaming Role provides network access to console related services ONLY (i.e. if you register your PC for this role you won't have web, email or IM services). Q: What Remediation is Available? A: Authentication Failure. If a user's systems fails authentication, the user is instructed to provide the correct university Email username and password. AntiVirus Failure. Anti-virus Software is required to be installed and running on all ResNet computers in order to gain internet access. If the Clean Access Agent fails to detect qualifying AntiVirus software you'll be prompted to correct this issue. Microsoft Windows Patch Failure. If the user's system fails the check for current critical Operating System patches, the user is instructed to click on the URL for the Microsoft Windows update site and follow the instructions. Q: What Happens If an "Infected" System Behaves Badly on the Network? A: The validation solution can not prevent all infections. Also, we have experienced denial of service attacks originating from within the university network. For those subnets controlled by Clean Access Servers, the process will be to disconnect the offending system using the Clean Access Manager management console. Unless the system is demonstrating a vulnerability for which there is no patch, there should be no need to block the physical switch port, as the user will not be able to reconnect until the sproblem is corrected. |
