Goal 1: Maintain Security of ITS Enterprise Systems

Transcription

1 INFORMATION TECHNOLOGY SERVICES University Technology Administration, Infrastructure and Support Open Systems Infrastructure Calendar Year 2018 Overview The primary mission of Open Systems Infrastructure is: to manage all central enterprise storage, backup, and recovery services for the University to provide central file storage services to departments and users to provide virtual machine services to University departments to provide virtual application services to University departments to provide hardware and operating system support for all central Unix and Linux enterprise systems to provide web hosting services, mail listserv services, and file transfer services for the University to administer the service and system monitoring service for enterprise ITS systems and services to support the University s Disaster Recovery systems Goal 1: Maintain Security of ITS Enterprise Systems Continued weekly (or more often as changes require) updates and distribution of Infrastructure Maintenance Calendar to the ITS/IOS/ERP/ODL/CORE community. o Created and continue to maintain IOS Maintenance Support Contacts distributed list for maintenance support communications. Continued bi-weekly Infrastructure Maintenance meetings with IOS/ERP Directors and representatives alternating with the bi-weekly PeopleSoft Application Support Initiatives meeting with the same group. Continued to meet with ITS/IOS subgroups as needed, such as DB, MW and PeopleSoft admins. Participated in forensic review of three on-campus VM customer server breaches. 1

2 Continued use of Nexpose vulnerability scanning tool for credentialed scans o Implemented post-operating-system-updates with Nexpose scans and report generation to aid in identifying non-operating system vulnerabilities. o As of December 2018, two sets of ITS-wide Nexpose scans and resulting data reports collected. o In February 2018, a joint Unix/Microsoft presentation was given on ITS Vulnerability Status & Review for select ITS/IOS Directors. o Occasionally assisted ISPO with Unix based credentialed scans for on-campus units Continued weekly reviews of ClamAV anti-virus scan results. Contributing to discussion on handling vulnerability scanning and assessment for on campus department server customers of ITS/IOS including operating system and installed application updates and patching. Assisting Middleware Team with review of F5 security and application recommendations through the use of the F5 BIG-IP ihealth tool. This effort was first launched in December Beginning January 2018 reviewed ihealth results of qkview file evaluation of all seven F5 instances monthly with Middleware to identify issues to be addressed. Began first phase in collecting information on the Vulnerability Management Process for IOS. This phase was related to identifying the patching processes of related areas. Participated in defining the Vulnerability Management Standard for consideration of campus-wide FSU computing resources with ISPO and other representatives. Chose Sophos as an alternative to ClamAV as our anti-virus solution for Linux systems and began migration. Advantages of Sophos over ClamAV include the ability to do onaccess scans of files. Implemented Sophos on all newly built servers. Evaluated use of Secure Works RedCloak endpoint protection system for enterprise Linux hosts. Developed and implemented a system to track Linux system shell accounts, allowing for automated monthly review and cleanup of unnecessary shell accounts belonging to terminated or otherwise departed users. Performed regular operating system patching semi-annually for 95% of all enterprise Linux hosts and quarterly for 100% of departmental Linux virtual machines. Worked with the Database Administration team to implement standard procedures for patching the Exadata enterprise Oracle database systems. Continued to support the Splunk Cloud environment and accompanying on-site log collector/gateway forwarder system. Supported other ITS teams in their use of Splunk Cloud to address security, performance, and operational concerns. Completed retirement of LEAS-managed hosts on legacy VLAN 306 and nearly completed retirement of LEAS-managed hosts on legacy VLAN 602. These legacy VLANs do not have the firewall protection of our newer VLANs. Upgraded Red Hat Satellite server to version 6.4, enabling performance increase and additional features. Implemented Red Hat Insights product to provide SaaS-based operational analytics. This tool enables proactive assessments of risks related to performance, availability, stability and security on RHEL systems. 2

3 Implemented Content Views in Red Hat Satellite to enhance ability to keep all environments (dev, tst, qna, prd) of particular application hosts at the exact same operating system patch levels. Implemented and documented requirements for ITS-managed Linux systems in scope for PCI DSS. Multi-Factor Authentication (MFA) has been setup on our virtual desktop pilot project for systems administrators. Through the use of a compliance management tool within the VMware Virtual Operations Management Suite, a secure template for all virtual machines and hypervisor infrastructure has been put in place. This template can be deployed per infrastructure component as needed to identify, remediate, and report on security and hardening discrepancies. We will be testing this out during the upcoming year. The Virtualization team worked with the operating system teams to identify methods to automate the process of updating virtual machine tools and virtual machine hardware. This process helps to simplify and automate updating VM components during operating system maintenance. Goal 2: Ensure Operational Stability, Reliability, and Performance for ITS Enterprise Systems An additional block storage array was purchased to meet the needs for enterprise storage. This array is an all-flash array, providing high performance and throughput as well as space optimization through the use of deduplication and compression. We enhanced our backup and data protection capabilities while reducing costs through the acquisition of a Dell EMC Integrated Data Protection Appliance (IDPA). The IDPA allows for the backup and protection of all physical servers, virtual machines, and Oracle databases deployed within the ITS enterprise. In addition, this solution allows us to replicate our backups to an offsite location, either our physical co-location space in Atlanta or cloud-based services and also gives us the ability to use the backups to recover virtual machine images in the cloud. Refreshed the fibre channel switching infrastructure in Tallahassee and Atlanta, ensuring optimal performance and continued vendor support. Completed retirement of all RHEL5 systems, removing risk from running aged systems with an operating system that no longer gets support or updates. Planned roadmap and started the process of migrating all RHEL6 systems to RHEL7 in preparation for RHEL6 end of life. Explored option of creating a Red Hat Satellite capsule server to allow for external provisioning of Red Hat Linux systems in the cloud. Determined that it was not needed at the present time. Implemented Splunk s NMON application to improve system monitoring and alerting for performance and security issues. 3

4 Implemented Splunk dashboards and alerts to detect potential issues for Mailman and mailrelay services. Goal 3: Enhance Service Offerings and Improve Customer Experience Supported the Enterprise Applications team with their initiatives (new ModoLabs portal, Platinum Analytics, Snowflake, Campus Reimagined Initiative, Civitas) - building out onpremise systems, cloud systems, and facilitating data exchange between on-premise and cloud systems. Introduced the use of Ansible, an open source automation and configuration engine. This has improved standardization and efficiency of server deployment and management. Began using Ansible for operating system patching and account management processes. Supported staff development/training efforts to ensure that staff are in the best position to provide value to internal and external customers by offering access to online training via Linux Academy as well as sending staff to the Splunk conference. Upgraded the FSU Dropbox service to enhance user experience and usability. The FSU Virtual Lab service added applications to meet the needs of the Chemistry Department, who was losing access to their physical computer lab. Assisted the College of Engineering with piloting the use of the FSU Virtual Lab for applications requiring graphic processing. In the past year, virtual lab unique user logins increased by over 1200 users. Updates and software enhancements have been made to the virtual machine infrastructure and data protection/storage infrastructure to support hybrid cloud deployments. Worked with the College of Engineering to begin migration of their systems to the ITS Virtual Machine service. Completed auxiliary rate review/update for ITS Virtual Machine service, incorporating new equipment while lowering rates. Goal 4: Support the University s Disaster Recovery Plan Continued to provide support for all of the systems and storage at the DR site. Kept the DR site up to date with patching and security updates as needed. Kept data synchronization for DR hosts up to date. 4

5 Participated in planning for next phase/iteration of DR site and any changes in scope that result from the Business Impact Analysis scheduled to be done this fiscal year. Participated in evaluation of use of public cloud services for DR in lieu of existing method of managing our own infrastructure in Atlanta. Specifically assisted with proof of value exercise to deploy PeopleSoft environments in AWS. Goal 5: Implement secure research computing environment in support of NIST requirements Staff learned new skills necessary to support NIST computing environment in AWS cloud. Provisioned and maintained secure cloud computing environment to provide infrastructure needs for research contracts that have NIST compliance requirements. Ensured continued availability and security of NIST computing environment. Assisted EOAS with data transfer in and out of NIST computing environment. Goal 6: Support ITS Initiatives to Operate According to ITIL Framework Strove to adhere to established CRM case management guidelines. Continued to follow standardized change management practices. Transitioned to the use of Service Now for project management. Continued efforts to do effective long term planning for infrastructure and to provide enhanced visibility for larger infrastructure refresh project needs. FSU Strategic Goals reference(s): Strategic Goals reference(s): FSU Strategic Goals (Click Here for More) Goal I: Deepening Our Distinctive Commitment to Continuous Innovation Goal II: Amplifying Excellence Across our Academic and Research Programs 5

6 Goal III: Realizing the Full Potential of Diversity and Inclusion Goal IV: Ensuring Student Success on Campus and Beyond Goal V: Preparing our Graduates for 21st Century Careers Goal VI: Investing Strategically in Our Institution and Reputation 6