X-Sender: mbishop@pop200.gsfc.nasa.gov\
X-Mailer: QUALCOMM Windows Eudora Version 6.0.1.1\
Date: Wed, 02 Mar 2005 16:18:08 -0500\
To: (210 All)\
From: Mary Ann Bishop \<Mary.A.Bishop@nasa.gov\>\
Subject: Misuse of Gov PC - Use of Instant Messaging\
X-Proofpoint-Spam-Details: rule=notspam policy= score=0 mlx=0
adultscore=0 adjust=0 engine=2.5.0-05022500 definitions=2.5.0-05030102\
\
Hello,\
\
**This is a reminder that due to IT Security purposes, the use of
commercial Instant Messaging on your Government PC is prohibited.**  Due
to recently improved detection capabilities, a greater number of systems
involved in Instant Messaging chat sessions have been identified by Code
297, Enterprise IT Security Branch.  When captured, chat session
summaries contain full bi-directional chat data, and file transfer
information.  \
Reports of misuse may result in restricted access to resources, if
warranted, or access privileges terminated as a result of repeated
offenses.\
\
Our Division has had a couple of reported instances of the use of Yahoo
IM.   If you require IM for work-related activities, NASA has a secured
Instant Messaging for use with other NASA employees.  You can obtain
information from the following site and contact ODIN (x6-3100) for
assistance if needed. 
<http://insidenasa.nasa.gov/nasa_nas/ops/chat/about_jabber.html>\
\
Below outlines activities that NASA considers misuse of Government IT
resources:\
\
•  Public Internet Chat Rooms, News Groups, or similar activities\
•  Connecting to commercial Instant Messaging (IM) systems. (i.e.,
Yahoo, AIM)\
•  Peer-to-Peer file sharing (i.e. sending/receiving files through IM)\
•  The creating, downloading, viewing, storage, copying, or transmission
of sexually explicit or sexually oriented materials.\
•  Maintaining or conducting an outside business.\
•  Monitoring network traffic (e.g., run a sniffer); access IT
resources; or copy data, files, or software without prior
authorization.\
•  Advertising goods or services for sale for monetary or personal
gain.\
•  Sending chain letters, personal mass mailings, hoaxes, or harassing
messages.\
\
Thank you.\
\
Code 210 Computer Security Officials\
Mary Ann Bishop x5740\
Wanda Behnke x2361

Below are excerpts from NPR2810.1A outlining what you CAN'T do regarding
P2P

file-sharing:

11.3.11  Peer-to-Peer (P2P) Connections

11.3.11.1  NASA shall follow OMB, Memorandum for CIOs' ; dated September
8,

2004; subject: Personal Use Policy and "File Sharing" Technology, which

provides direction for establishing NASA P2P requirements. 

11.3.11.2  Unapproved P2P file sharing technology has inherent security

risks of downloading information from sites which may contain programs
that

pose considerable risks to NASA's IT infrastructure by introducing
viruses,

worms, Trojan horses, and other malicious code.  Installing P2P software
can

make the system more vulnerable to compromises and unintended sharing of

information from its hard drive.  Federal law is clear and explicitly

forbids the illegal distribution or other inappropriate use of
copyrighted

material.

11.3.12  P2P Requirements 

11.3.12.1  Centers should actively prevent the use of unauthorized P2P
file

sharing.

11.3.12.2  The Center NCCBs shall implement port blocking and/or

bandwidth/rate limiting to block or limit the most frequently used
Internet

ports for P2P file sharing applications.  (Contact the Center ITSM for
the

most recent list of P2P ports.)

11.3.12.3  P2P file sharing technology shall only be utilized when
approved,

case-by-case, by the Center CIO or CIO designee and documented with the

appropriate NCCB.

11.3.12.4  Unauthorized P2P traffic, once identified and traced back to
a

user by the Center ITSM, shall be blocked and the appropriate management

notified to take appropriate administrative actions for the policy

violation.

11.3.3  Network Security

11.3.13.1  Networks allow systems to connect for the sharing of data and

files, as well as providing access to the resources themselves.  The

security architecture and configuration control of a network permits
network

connected systems to interact securely without jeopardizing their own

security controls.  Typically within NASA, there are WANs, LANs, WLANs,

project-level networks, and network address translation (NAT) networks
with

private address space. 

11.3.13.2  Each network is established to provide a different level of

protection and typically connected in a layered fashion from the WAN to
LAN

to project level or NAT networks.  Most NASA systems have a connection
to a

public network such as the Internet which is considered non-secure and

presents threats that must be countered by security controls, vigilance,
and

monitoring.  NASA systems that connect to networks operated by others
shall

review and concur on the protective measures and risk inherent in
connecting

to the network.