CISL Annual Report 2005 > Production cyberinfrastructure accomplishments

Cybersecurity accomplishments

In March 2004, UCAR and a number of other national research centers were the target of a coordinated cyber-intrusion using stolen passwords. Significant time, effort, and money have been spent on recovering from the intrusion and preventing a recurrence. Both UCAR and CISL remain committed to implementing security procedures that balance the competing needs of an open, collaborative research environment with the security, integrity, and usability of the institution's resources.

At the end of FY2004, SCD received funding from the National Science Foundation to plan, organize, and host a two-day Cybersecurity Summit where over 120 security experts from the nation's leading research institutions gathered to discuss the March 2004 incident. SCD assisted in completing and submitting to the NSF a final report on the meeting. The report provides basic, factual information on the intrusions and contains specific analyses and recommendations on topics such as incident response, training and education, security planning, and future collaborative activities among the research centers.

The UCAR security administration group constantly monitors the security threat to the institution from outside individuals, and the UCAR Computer Security Advisory Committee (CSAC) continues to coordinate consistent security policies and procedures across UCAR. The goal is to provide an appropriate balance between protection and the pursuit of the scientific mission of the institution. During FY2005, CSAC members participated in an exercise to further identify best practices for improving IT security at UCAR.

In November 2004, UCAR witnessed a security incident related directly to the March 2004 intrusion. This attempt was discovered and rebuffed quickly due to the implementation of best-practice security measures: timely intrusion detection, proactive planning, and open, secure communications with other research centers. No significant security incidents have occurred since November 2004.

During FY2005, the UCAR security administration group obtained, installed, and configured six modern hosts that have been deployed as the new gatekeeper facility. A commercial Intrusion Detection System (IDS) was purchased and deployed, as was a new UCAR-wide logging facility. The one-time password (OTP) challenge technology is being deployed into the security perimeter for all UCAR users. The security group provided consulting services for software and network security best practices to F&A, RAL, and SCD; provided PGP instruction for all UCAR divisions; and procured security training by an industry leader for all UCAR administrators.