Jefferson Lab Remote Access Review: Free-Electron Laser Wesley Moore FEL Computer Scientist 01 December 2010

What is the Free-Electron Laser (FEL)? FEL's relationship to sensitive information (SI) Outline adopted policies and procedures Remote Access to SI and control systems Quality Assurance Future plans FEL Presentation Objectives

The FEL is the world's most powerful free- electron laser. It is primarily an infrared laser, although it can also produce ultraviolet and other colors of laser light. The FEL also holds the world record as the brightest source of Terahertz (THz) light and is now in the process of characterizing it's kilowatt-scale ultraviolet capability. Description of JLab's FEL UV WigglerUV Lasing

Science and Technology (S&T) is typically considered to be sensitive if the S&T involves activities or items on the Military Critical Technologies List (MCTL) or if the S&T is included in the Department of State's International Traffic in Arms Regulations (ITAR). Sensitive S&T has consequent export control requirements by law, regulation and the JLab DOE contract. Please note there is no Classified Information involved with FEL activities at this point. Cause for Sensitive Information

Policies & Procedures The FEL wanted to maintain a proactive posture with respect to information security, not reactive. Early involvement of the Chief Information Officer (CIO) Obvious the FEL would become a moderate enclave Initiated compliance with JLab site wide policies and procedures for sensitive information Procedures used for the following: o Personnel security o Physical security o Handling of hard copies o Handling of electronic information

Sensitive Information Security Remote Access o 2-Factor Authentication o Restrictive inbound and outbound firewall configuration FOUO-ITAR documents are stored on a secure file server o File server provided by IT Core o Located in Computer Center with card reader access security

EPICS access security protects IOC databases from unauthorized Channel Access Clients. Access is based on the following*: Who: Userid of the channel access client. Where: Hostid where the user is logged on. This is the host on which the channel access client exists. Thus no attempt is made to see if a user is local or is remotely logged on to the host. What: Individual fields of records are protected. Each record has a field containing the Acess Secuirty Group (ASG) to which the record belongs... How: User Access Groups (UAG) and Host Access Groups (HAG) combine to create read/write permissions. Local IOC console is protected via physical security and telnet access protected via networking security. * extracted from EPICS Application Developer's Guide, Base Release Slide 7 Control System Security 1/2

Key Points to Remote Access: Once through the firewall, an accepted user and host has transparent remote access. Recall: o Who: Userid of the channel access client. o Where: Hostid where the user is logged on. This is the host on which the channel access client exists. Thus no attempt is made to see if a user is local or is remotely logged on to the host. Channel Access Security is granted by the System Owner (W. Moore) o Read/Write Access is role based (operator, user, student, etc.) Remote actions are administratively coordinated through the on-site Duty Officer and operators. Slide 7 Control System Security 2/2

Slide 7 Quality Assurance Active QA: o Network and system level QA (reliant on IT Core) o Security of FOUO-ITAR is periodically reviewed Gaps : o Some embedded IOCs are not using EPICS Channel Access security files. o Periodic audit of Channel Access security configuration. Remove old userids Changes in personnel o PLCs and other network capable devices??

Future... We are currently evaluating our readiness for future ITAR related experiments on the FEL. Things we must consider: o Machine hardware is not ITAR, configuration could be. o Effort required to "Black-box" the FEL's control system Is all Remote Access denied?? o Proper storage of machine parameters. o Staffing issues and requirements due to heightened information security. o Cost associated with protecting information.

Questions?