Network managers stick to the basics on security

You can protect your network; the technology exists.

Sophisticated tools will let you set up firewalls to screen every e-mail message for
potentially dangerous protocols, encrypt application files and run checksums to ensure no
files have been changed.

Tools can install antivirus software on networks and desktop PCs and keep users off
suspect Web sites. Others can scan a user’s retina, iris, fingerprint or face before
granting access, closely circumscribe user privileges, track use and review audit
trails—even monitor keystrokes in real time from a central console.

If you install all those tools, you will also need well-educated users who follow
security policy procedures to the letter and do not mind a network that moves at a crawl.
Having senior management 100 percent behind you will increase your chances of getting the
hefty budget you will need to buy the software and hardware, and attract, train and retain
the staff to run your finely tuned security machine.

Back on Earth, GCN surveyed 71 federal network security managers to find out what they
do to protect their networks, what their problems are and what they need. Their answers
were sobering.

The most common practices are the most basic: Keep the network going by installing an
uninterruptible power supply, prevent data and software corruption by using antivirus
software at both the network and desktop levels, and keep emergency repair disks.

Most security managers said they try to police passwords, use firewalls and secure
servers, and back up their data. But sophisticated security tools such as distributed
intrusion detection systems, which monitor network traffic in real time, did not make the
list of the top 25 federal network security measures.

Many federal security managers GCN talked with voiced more humble demands:

Part of that more consistent security policy would include intrusion detection systems
using a combination of passive and active technologies. “We get better protection if
we use a range of intrusion detection techniques,” he said.

Intrusion detection tools are high on the wish list of Terry D. Brashley, an Army
senior operations research analyst in Fort Leavenworth, Kan.

“You can see sophisticated intrusion detection tools being used within the senior
and more secret levels of the Army, but I would like to see them used on my level as
well,” he said.

Whatever your strategy, having the right tool is crucial. One civilian agency requires
network managers to perform audit trails, but they don’t always provide the tools to
review the audit trails, an agency security manager said.

“Tools can be used, not as a substitute for vigilance, but as a supplement,”
Brashley said.

Although some pockets of highly sophisticated and stringently enforced security exist
on federal networks, far more rely on systems administrators with little training, said
Mark A. Boster, deputy assistant attorney general for IRM.

Systems administrators are the mainstay, said a Defense Department security specialist.
“They’re the ones who are sitting at their component and monitoring their
networks. But most times, the systems administrator position is a part-time job,” he
said. And that job goes to a staff member with an aptitude for computers.

In fact, increased network staff and training for administrators would be the one
measure that would most improve network security, the DOD specialist said.

“Software is great, but you need the bodies to utilize the information, the
software,” he said. “With a bigger staff we could do more on-site inspections.
We could sit down with systems administrators and say, ‘Let me see your password
list.’ As far as security goes, we have one of the better programs in the United
States, but you can always improve, and we can always use more people.”

Some agencies have developed ways to work around staff shortages.

One DOD security group created a guidance document detailing how and where to set up
firewalls, for example.

“If they can’t do everything we ask for, they have to give us their reasons
and we work

with them,” a DOD security manager said. “It’s risk management. They
might not be able to do something we’ve asked for, but they can do something else to
mitigate the situation.”

Year 2000 is not entirely an ill wind when it comes to security. Updated software is
sometimes inherently more secure. But most network managers are seeing expenses for fixing
date code cut into budgets.

Other factors, such as reduced staff training, tight budgets and increased Internet
access, also heighten vulnerability. So it is not hard to see why some network security
managers recommend shutting all users out of everything and waiting until they complain as
a method of determining user access levels.

That attitude is a mistake, said Jerry Slaymaker, a senior adviser to Environmental
Protection Agency chief information officer Alvin Pesachowitz.

“The sysadmins need to establish security that is responsive to the security needs
of the organization as well as the workers,” Slaymaker said.

EPA has installed Enterprise Security Manager software from Axent Technologies Inc. of
Rockville, Md., on each of its 800 servers, he said. Security for the servers is monitored
on a separate console, which issues reports to the sysadmins.

Browser and Internet access can easily rip a hole in security, and the errors can
compound quickly, security experts said.

To give users the access they need without endangering network security, DOD has
developed what it calls criticality factors with levels from one to five. For some users,
remote access is a Level 1, or mission-critical, factor. They can dial into a modem bank,
which is outside the firewall, a DOD spokesman said. But “no PC within the domain has
direct access” to the Internet, he said.

DOD is not alone in its need to protect its data from broadcast on the Net. The
Internet as a potential security risk has led to a tightening of access at civilian
agencies, too. “There’s no free flow of modems to desktops anymore,” one
security specialist said.

A workable solution must be dynamic, said Jim Christy, a Defense computer crime
investigator. “Networks and information technology are like living, breathing
entities; they’re always changing, there are always new versions and models, and
security must be adapted to the rhythm of that change to be effective.”  

GCN associate editor Jonathan Ewing contributed to this report.