Report on Computer and Network Security Tobias Haas, DESY for the HTASC Subcommittee on Computer and Network Security

Mandate Advise HTASC/HEPCCC on Computer and Network Security needs and to suggest policies to meet those needs for HEP laboratories and institutes by defining computer/network security guidelines for HEP institutions, estimating the resources needed to implement such guidelines, suggesting means of communication between the institutions in case of security incidents.

Membership R. Cecchini, INFN, Firenze, (R. Cowles, SLAC) A. Flavell, University of Glasgow, W. Friebel, DESY, Zeuthen, J. Gamble, CERN, Geneva, T. Haas, DESY, Hamburg, (Chairperson) D. Heagerty, CERN, Geneva, (J. Kadleczik, Institute of Physics, Budapest) P. Moroni, CERN, Geneva, B. Perrot, IN2P3, Orsay, M. Rott, Institute of Physics, Prague E. Wassenaar, NIKHEF, Amsterdam

History Subcommittee founded by HEPCCC on the recommendation of HTASC in their 11/98 meeting. Working meeting at DESY, May Draft report to HTASC, June 1999 at the NIKHEF meeting. Proposal for final report this meeting.

What has happened since 6/99? Draft report was generally well received. A number of comments on these topics: –X11 –SSH –WINDOWS

X11 Any discussion on X11 was essentially missing. Section added: –Point out that X11 is a generically insecure protocol –Two specific remedies are pointed out: SSH tunnelling MXCONNS monitoring

SSH Initial recommendation on SSH was rather weak - strongly influenced by the CERN postion After a number of discussion via with a number of committee members: Strengthen the SSH recommendation.

WINDOWS Situation here is rather unclear and debated: –One view: WINDOWS protocols should never be allowed over border routers –Another view: NTFS most secure wide are file system. Problem that MS has a very unsatisfactory information policy.

Shortcomings Completeness!! Fast moving nature of the subject. Limited involvement of various labs that should probably have a say in this. Limits imposed by coming to a consensus on some controversial issues.

(Imperfect) Final Report My Proposal: Come to a final report for HEPCCC in November: –Include some pending comments –Point out shortcomings of the report in the introduction –Point out the need to review the subject regularly

Thanks To all members of the committee: –in particular those who went to the trouble to travel to Hamburg for the discussion meeting (J. Gamble, D. Heagarty, R. Cecchini, W. Friebel) –and those who went to the trouble to read the document very carefully and to write lengthy messages (A. Flavell, B. Perrot) D. Moenkemeyer (DESY Security Officer)