22. Guest Lecture by MIT IS&T

What this lecture covers

This is a guest lecture, not a technical build-up like the rest of the course. Mark Silis, who oversees MIT's network and security operations, and Dave LaPorte, manager of network infrastructure and security, describe what it actually takes to secure a huge, deliberately open university network, and walk through real incidents MIT has handled. It gives you a practitioner's view of the threats and defenses discussed more abstractly elsewhere in the course: DDoS, phishing, social engineering, and IoT/building-system security.

After watching, you should be able to describe why an open campus network is harder to defend than a locked-down corporate one, explain how reflection/amplification DDoS attacks work and how MIT mitigated them, and recognize social-engineering patterns like spear phishing, caller-ID spoofing, and "wailing" against executives.

Key ideas

• Open network philosophy: MIT runs without a campus-wide firewall, so security has to be layered at every level (application, host, network) rather than relied on at one boundary.
• Federated administration: MIT has limited central authority over devices like building-management systems, so the security team often can only mitigate at the border rather than fix the device itself.
• DDoS reflection and amplification: attackers spoof a victim's address and send small requests to misconfigured DNS, SNMP, or NTP servers, which reply with much larger responses, overwhelming the victim's bandwidth.
• BGP mitigation: during a large-scale attack, MIT lets a partner autonomous system (Akamai) advertise its address space so attack traffic is scrubbed upstream before it reaches campus.
• Akamai CDN offload: mirroring web.mit.edu onto Akamai's content distribution network and using split-view (bifurcated) DNS protects the origin server from being directly targeted.
• Shift from network to human targets: as hosts have become harder to exploit directly, attackers increasingly rely on social engineering: spear phishing, caller-ID spoofing scams, and "wailing" attacks against high-level staff using their own public writing style.
• Two-factor authentication: MIT rolled out Duo, tied to its Touchstone/SAML identity system, so a stolen password alone can no longer compromise an account.
• IoT and building systems as weak points: building-management systems were deployed with no real security model, and MIT's response was to isolate them onto a separate VRF (virtual routing and forwarding instance) behind a firewall rather than trust the vendor's claims.

Walkthrough

Why an open network is a hard security problem (1:00)

Mark Silis describes MIT's philosophy of running an open network with no broad campus firewall. A test where a fresh laptop was left connected for 24 hours received connection attempts from every country except two, illustrating the scale of exposure across roughly 150,000 devices on campus. He also recounts discovering that MIT's facilities department had connected a huge building-management network, larger than MIT's own core network, to the internet with no real security beyond an IP address, based on a mistaken assumption that "the network people" handled security for them.

DDoS attacks and how MIT mitigates them (37:23)

Dave LaPorte explains denial-of-service attacks as targeting the availability leg of the CIA triad, and describes the shift toward reflection and amplification attacks using DNS, SNMP, and NTP, which can multiply a small spoofed request into a much larger flood aimed at the victim. MIT experienced attacks in this range on its own network and responded by rate-limiting NTP, splitting DNS into internal and external views served partly through Akamai, and moving web.mit.edu onto Akamai's CDN. For attacks large enough to saturate MIT's own bandwidth, MIT uses BGP mitigation, letting Akamai temporarily advertise MIT's address prefixes so it can absorb and scrub the traffic before forwarding clean traffic back.

Three attacks tied to the Aaron Swartz case (52:34)

LaPorte walks through three separate attacks following the Aaron Swartz case: a low-bandwidth attack against border router management interfaces that took MIT net offline, fixed by patching and restricting management access to VPN; an HTTP flood that killed the stateful firewall in front of web.mit.edu (not the web server itself), fixed short-term by moving to a routed network and long-term by moving to Akamai's CDN; and a defacement of MIT's homepage that turned out to be caused by a breach at MIT's domain registrar, educause, rather than anything on MIT's own network.

The shift toward exploiting people, not machines (1:00:40)

LaPorte argues that host-based vulnerabilities have become less common as operating systems ship more securely by default, so attackers have moved up the stack to exploit humans instead. Examples include spear phishing that redirected victims' payroll direct deposits, police caller-ID spoofing scams that exploit trust and fear, and "wailing," where attackers impersonate senior staff using their real public writing style to request fraudulent wire transfers. MIT's response includes user education and rolling out Duo two-factor authentication integrated with its Touchstone identity system.

Recent network-level exploits and future risks (1:15:59)

The speakers note a resurgence of serious network-level vulnerabilities (major SSL implementation bugs and Shellshock) and describe MIT's layered response: fast patching, automated scanning for vulnerable services, and automatic BGP null-routing of hosts exhibiting anomalous scanning behavior. They close with future trends: bring-your-own-device policy challenges, consumerization of cloud services like Dropbox raising data-custody questions, and Internet of Things devices, especially building systems, that ship with little to no security, which MIT addresses by isolating them onto separate network segments.

Before you watch

• General familiarity with DDoS attacks, DNS, and BGP routing helps, since the lecture assumes this background rather than teaching it from scratch.
• Recall the CIA triad (confidentiality, integrity, availability) referenced early in the talk.
• This talk works well as a practitioner companion to the course's earlier lectures on network attacks and social engineering.

Check your understanding

1. Why does MIT's open-network philosophy make security harder than a traditional corporate firewall model?
2. How does a DNS or NTP amplification attack let an attacker generate far more traffic than they send?
3. What is BGP mitigation, and why did MIT rely on Akamai to absorb large attacks rather than handling them locally?
4. What made the "wailing" attack against a senior MIT staff member unusually convincing, and how was it caught?
5. Why did MIT isolate its building-management systems onto a separate VRF instead of leaving them on the main campus network?