# Presentation: 723475

## ICESat:ESDIS Network Status&IT Security

- As of January 25, 2002

## Agenda

- ESDIS Project Reorganization
- Overview of ICESat Data Flows
- Mission flow implementation status diagram
- Science flow implementation status diagram
- Current NSR and CSR status
- IT Security
- Changes since September 11, 2001
- Security implementation
- Host security rules
- Issues and Concerns

## The ESDIS project is currently undergoing a reorganization

- The ESDIS Project will now focus only on Science Systems
- Mission Systems (including networks) will move to Code 428
- Code 428 will be reorganized and renamed the Earth Science Mission and Operations System (ESMOS)

## All ICESat mission data flows are implemented(Does not include voice)

- All ICESat mission data flows are implemented(Does not include voice)

## Most ICESat science data flows are implemented; Some modifications needed

- Most ICESat science data flows are implemented; Some modifications needed

## Status of NSRs / CSRs relating to ICESat (1/2)

## Status of NSRs / CSRs relating to ICESat (2/2)

## In summary, the implementation of the ICESat ground network is nearly complete

- 16 of the 18 ICESat related NSRs and CSRs are implemented and in service
- Two items are not complete but are expected to be implemented by their respective need dates
- GSFC/LASP voice expected completion by need date of 3/1/2002
- New keyset for Bldg 22 expected completion by need date of 2/2002
- Minor modifications are in progress for the 52 Mbps links from Alaska; the link is in service
- Testing of the connectivity to the remote SCFs has shown the throughput meets all requirements; routes to a few universities are being modified
- University of Texas will be installing a firewall
- University of Washington is currently fixing a bad host

## Security

- Changes since September 11, 2001
- Security implementation
- Host security rules
- Issues and concerns

## Security is increasing since September 11

- All GSFC badged employees require National Agency Checks (NACs)
- Previously, NACs were only required for Mission personnel and “Privilege” account users
- Now, all contractors with more than six months remaining on their contract must get a NAC
- Checks will be performed regularly in the future
- Data on public web servers and internal web servers must be modified to meet security guidelines
- No “Sensitive, but unclassified” data is allowed on public servers
- Authentication on internal servers is required in order to get access
- All “green card” immigrants will be treated as foreign nationals which will result in the badge processing time to increase
- Current “green card” immigrants will be grand fathered in
- Once the GSFC badge expires, it will take 10 days to complete the proper paperwork to get a new badge
- EMSn is migrating towards a fully managed network [by the IPNOC (CSOC)]
- Security plans must be in place and a system vulnerability scan must be completed before connecting to the network
- Periodic vulnerability scanning and security assessments will be performed

## Security Implementation:  Use NPG 2810.1

*Highlights of the NASA Policy and Guidelines (NPG 2810.1) Security of Information Technology include:*
- System Classification Science Engineer and Research (SER) and Mission (MSN)
- Assignment of Security POC
- IT Security Plans (Risk Management, Security, Contingency Plans)
- Required for Ground Stations, MOC, EDOS, CSAFS, EBnet, WOTIS, MMFD, GDAAC, ISF, ISIPS, GLAS SCF
- Verify security implementation and controls in place
- Authorization to Process
- Metrics

## Host Security Rules

- Host Security Rule No. 1:  ***Only run services that are absolutely necessary***
- Avoid default installs (they install many unnecessary services)
- Do minimal installs and only add services that are absolutely necessary
- Host Security Rule No. 2:  ***Apply all security patches ASAP***
- Apply all patches at OS installation time
- Apply new security patches ASAP
- Host Security Rule No. 3:  ***Scan the host for known vulnerabilities and corrections ASAP***
- Scan and harden the system before placing it on the network
- If you don’t know your vulnerabilities, you don’t know your risk
- Use Nesus [free for NASA employees] and/or Internet Security Scan (ISS) [NASA has a site/address license]
- Scan, Scan, Scan
- Host Security Rule No 4:  ***Lock down host***
- Use tools like tripwire that detect anomalous changes
- Configuration Control
- Know your system configuration
- Make backups (local and offsite)
- Host Security Rule No 5:  ***Run Anti-virus software and update virus definitions daily***

## Issues and Concerns

- Personnel screenings (NACs) can take a year or longer
- Hackers are becoming increasingly sophisticated and brazen resulting in increased risk
- Users have an inadequate assessment of risk which can result in inadequate host security
- Sensitive, but unclassified data needs to be monitored
- Must not be available to the general public, but must be available so that the people who need to know can access the information
- Must balance convenience verses confidentiality