EDUCAUSE/Internet2 Computer & Network Security Task Force Update Dan Updegrove VP for IT, University of Texas at Austin Task Force Co-chair Tempe, Feb 3, 2003 Copyright Dan Updegrove, This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

Brief History of the Task Force  Established summer 2000 ~ DDOS  2001 largely volunteer efforts  9/11/01 ~ stakes increased  National Strategy to Secure Cyberspace  2002 NSF grant & energetic leadership by Rodney Petersen

NSF Workshops  1) IT leaders  2) Librarians  3) Research leaders & Fed agencies  4) Summit  Final Report expected this spring

HE Environment ~ Leadership  Often reactive rather than proactive  Lack of central authority, esp in large, research universities  Few clearly-defined security goals  Few metrics to base/monitor policy  Difficult of defining policy that: Is general enough to accomm change Is practical & enforceable

HE Env ~ Academic Culture  Tolerance, experimentation, & anonymity highly valued  Top-down regs generally resisted  Faculty independent, esp if tenured  Many theoretical & technical experts  Persistent belief that security is antithetical to academic freedom

Principles to Guide HE Efforts  Civility & community  Academic & intellectual freedom  Privacy  Equity, diversity, & access  Fairness & process  Ethics & integrity

The Research Environment Challenge  Diverse HW/OS/SW, expertise focused elsewhere  Role of central IT varies widely  Grants – govt & corporate – rarely fund IT support  Indirect cost recovery often capped  Need more R&D on cybersecurity, plus connection to deployment

Briefing ACE Board  Educause Pres Brian Hawkins & Educause VP Mark Luker will brief the Board of the American Council on Education, Feb 15 in Washington  Prelude to “What every president needs to know about cybersecurity”

Secure IT Conference  Apr 23-24, Temecula Calif, co- sponsored by Educause, AN-MSI, et al  Apr pre-conference workshop for HE security practitioners, sponsored by Security Task Force – 003/

Other Outreach  CNI conf  Internet2 conf  Educause Regional Conferences  Cumrec conf  Other confs, workshops  Monograph planned fall ‘03

Internet2 ISAC  Information Sharing & Analysis Center to be established at Indiana University, seat of the I2 NOC  To provide a 24x7 watch on the I2 backbone  What will your campus do when alerted at 3 a.m.?

SQL Slammer Survey  Jan 24/25 major worldwide DDOS attack  Jan 31, Educause posted a web survey requesting info on response, impact, and lessons learned from the attack  As of noon today, 140 responses 

ECAR Research  Educause Center for Applied Research  Will devote resources to this area  Contact Richard Katz and Bob Kvavik here at

Task Force Futures  Potential partnership with AN-MSI  Potential partnership with CUDI  Follow-on to NSF grant?  Need for staff leadership as Rodney Petersen returns to UM-CP  Contacts: Rodney, Mark Luker, Gordon Wishon, CIO, Notre Dame, Dan Updegrove, CIO, UT-Austin