Education takes security lesson

French hackers infiltrated an Education Department server in 2001, partitioning off a portion of the device's storage for their own use. The intrusion went unnoticed for months as the hackers used the server to store movies, games and music.Finally, officials at the department noticed a huge disparity in the amount of outbound to inbound traffic. An investigation revealed the carefully concealed hacker files.Much has changed in the department's security since then. The French hacker incident, combined with intrusions and a Web site defacement by Brazilian hackers, spurred Education to bolster its information assurance and incident response efforts under the direction of Matthew Baum, the department's acting director of information assurance and its computer security officer.'They've made tremendous strides over the last couple of years in developing a comprehensive incident response center for the entire department,' said Larry Hale, director of the Federal Computer Incident Response Center, which conducts interagency security reviews. 'They've worked closely with us at FedCIRC to make sure that their plans make sense and that their information and processes were compatible with what FedCIRC does.'Over the last three years, Baum has overseen the growth of the Education Computer Incident Response Center from its infancy. The center has suffered some growing pains, but it has made considerable progress in implementing the elements it needs to protect the department.Education's information assurance program and EdCIRC are ahead of the five-year plan that Baum and his team established in 2000. The staff has grown to eight employees, and Baum plans to add three more staff members soon. The information assurance budget also has increased, from $566,000 in 2000 to $3 million this year.When Baum started in Education's CIO Office in 1998, he found that the department lacked experienced staff, training, and effective security policies and procedures.Responsibility for the department's IT security was scattered. 'It was like looking at a bowl of spaghetti,' he said. When someone reported an incident, the information was often weeks old before anyone responded.Baum has assembled what he calls a crackerjack staff of security experts. He also instituted a training program, developed policies and procedures that mesh with the department's business processes and garnered support from senior managers.The Government Information Security Reform Act required many of the provisions Baum advocated, giving his security requests credibility with Education's top bosses. And the intrusions by the French and Brazilian hackers supported Baum's conclusion that the department's security resources were 'woefully inadequate.'Education awarded EDS Corp. a contract last year to provide incident response support.When the Slammer worm hit earlier this year, the EDS team warned Baum and specified which firewall ports needed to be blocked to prevent the worm from gaining entry. EDS offered workarounds for Education to use until a patch was released. The department's systems survived unscathed.Besides hiring outside help, Baum also worked to build personal relationships with key systems staff. 'Instead of just having coffee with those guys, we started pulling working groups together to come up with scenarios'tabletop exercises'to poke holes in our procedures to see if there was any way we could fall on our face if we had a major incident,' he said. It helped reduce incident response time by one-third by the end of last year, Baum said.In March, Microsoft Corp. announced that its Internet Information Server software contained a vulnerability and issued a patch for Windows 2000 servers running IIS.FedCIRC's Hale said Education's security team examined the changes the patch made and noticed that they affected all machines running Windows 2000, not only those running IIS. The department contacted the company, which updated the statement it released with the patch.'It's that kind of thoroughness and professionalism that Baum has instituted throughout the department,' Hale said.Although the Education security team has made significant strides over the past three years, it fell short of the congressionally mandated goals, which the Office of Management and Budget noted in its 2002 report on federal IT security.Baum said he had only recently begun incident response training and monitoring systems proactively when the report was being compiled. But the weaknesses identified in the report helped accelerate security efforts.Like other agencies, Education still must certify and accredit many of its systems as required by law. But Education is winning the war, Baum said. '2003's report should show improvement, and the 2004 report should have a totally different result,' he said.