TheFermilabNetwork,ComputerSecurity,andyou….pptVIP

The Fermilab Network,  Computer Security, and you…. Phil DeMar / Donna Lamore Computer Security Awareness Day March 8, 2005 Fermilab Network Overview ~10,000 systems Organized on model of work group LANs Organizational: AD, CD, PPD, TD, BSS, DIR, ESH, FESS, LSS Experiment: CDF, D0, CMS, MINOS, mBoone, SDSS Geographical: Fixed Target, Site 38, Village Work groups supported on switches that connect to the core network Core Network Facilities  Essential Network Services Core network facilities: FCC core router WH core router Border router Essential network services: Name service Dynamic address allocation service Time service Off-site Network Access Off-site traffic traverses border router: Delineation point between onsite offsite Our 1st line of defense against the Internet Flow data collected on border router: Logs all off-site network connections Source/destination IP addresses ports Flow timestamp duration, bytes/packets sent received Useful for detecting infected systems investigating computer security incidents We are also collecting flow data on internal routers Off-site Network Access (II) Current site perimeter access policy: Open inbound access with a few protections Open outbound access with minimal restrictions Changes to default inbound openness under discussion: Likely a multi-level security zone architecture Green zone = default inbound allow Yellow zone = default inbound deny Openness for open science collaboration is recognized as a requirement Off-site Network Access (III) An alternate very high bandwidth offsite path now in place: Via dark fiber connection to StarLight Intended use – high impact scientific data movement Restrictions on Network Facilities Services at Fermilab The network is a restricted central service Per the Fermilab Policy on Computing /cd/policy/cpolicy.pdf Prohibited activities include: Routing bridging (switching…) on systems attached to the campus network Using IP addresses not assi