Security pilot paves the way for wireless throughout Treasury
Connecting state and local government leaders
Rather than fight the proliferation of personal digital assistants and notebook PCs at the Treasury Department, Scott Hill is working to shore up the Treasury infrastructure before wireless services become commonplace.
Rather than fight the proliferation of personal digital assistants and notebook PCs at the Treasury Department, Scott Hill is working to shore up the Treasury infrastructure before wireless services become commonplace.Twelve Treasury employees are participating in a pilot to set wireless use parameters that will keep the department's backbone network safe from unsecured devices. The department is about to expand the test program.For the pilot, wireless devices are secured at the user, device and network levels across the enterprise, said Hill, information security officer for the Treasury Communications System, the WAN and Internet backbone for Treasury, and project manager for the Treasury Computer Security Incident Response Center.'Security is incorporated into the network, the process, the equipment, the people,' he said. Pilot users access their e-mail and select Web applications with their wireless devices.Hill's Treasury IT security staff implements client configuration, virtual private network design, biometric and other remote-authentication controls, firewalls and security awareness training.The active security elements of the system are a wireless intrusion detection system from NetSec Inc. of Herndon, Va., and a geolocation component to track unauthorized use within the network.'The feeds from those devices are coupled with Treasury's security policy, and then alarms are generated when there is an infraction against those policies,' said John Wynn, director of federal markets at NetSec. For example, if an authorized user tries to connect with an unauthorized wireless device, it will trigger an alarm to the network operations center, which contacts Hill and the incident response team.With the geolocation capability, 'I can pinpoint exactly which office this was coming from' in near-real time, Hill said.'You want to know if the individual device is located in your parking lot, or if it's an authorized user on the inside of the building,' Wynn said.It's easy for most systems administrators to set up wireless network service with a notebook, wireless access point and wireless PC card, he said. So the geolocator 'really prohibits people from expanding Treasury's network beyond what is authorized,' he said.When unauthorized and authorized users employing rogue access points threaten Treasury's network, 'it's an unauthorized extension of your wired network,' Wynn said.Hill and Wynn gave four examples that illustrate the types of security holes they're trying to close through the Treasury pilot:Before the pilot, 'we weren't using wireless devices. Now we can,' Hill said. He wants the department's network to remain as secure as it was when wireless devices were first deployed, he said.Within a month, Treasury will expand the pilot to 10 users in the Office of the Treasury CIO and test how the system works in a second environment. Users will be able to access all their desktop PC applications with their wireless devices, Hill said.The next phase will be to conduct detailed risk assessments of the service, such as evaluating communications between the wireless network and the wired infrastructure and the safeguards applied to both networks, Hill said. His office also is developing training programs to make sure employees understand wireless policies and procedures.In a final phase early next year, Hill wants to add more users to the pilot and create a more realistic environment to test wireless security measures. Only then will his team give the thumbs-up to offering wireless service to bureaus throughout Treasury.Besides the intrusion detection service and the geolocation component, NetSec has deployed sensors inside the Treasury Communications Systems network. NetSec's operations center monitors the information from the sensors, which identify rogue access points or clients and also authorized clients communicating with unauthorized access points. When it detects these, NetSec follows established alert procedures and coordinates with Treasury's incident response team.'We're keeping track of all the authorized users, and once somebody outside that group tries to connect, we see them almost instantaneously,' Hill said.
Pilot expansion
'Security is incorporated into the network, the process, the equipment, the people.'
'Treasury's Scott Hill
Olivier Douliery
- Users connecting to unsecured wireless access points with a simultaneous connection to the Treasury network. If an authorized user were sitting in a cybercafe and connected to the Treasury network, an unauthorized user could access that users' device and loop through into the Treasury network.
- Someone parked outside a Treasury building who tries to access the department's network via a wireless access point.
- An insider using wireless devices to transmit data outside to an unauthorized recipient, bypassing security controls on the wired network.
- Weak encryption technologies used in most wireless applications that let others sniff data as it moves from point to point.
Pilot expansion
NEXT STORY: With 10g, Oracle gets on the grid