Olympic IT security requires advance planning

IDG News Service - If there's one thing the Atos Origin SA team understands as lead contractor for the Olympic IT infrastructure, it's that you must learn from your mistakes.
One such lesson learned the hard way: IT security must be built in from the start, according to Claude Philipps, program director of major events at Atos Origin. For the 2002 Olympic Games in Salt Lake City, the company "started embedding the security too late, so it wasn't running well."
The lapse caused nothing serious, except for a few headaches. "We had a lot of attacks, but we ran the games safely," Philipps said.
During those games, the Atos Origin team found that the number of alarms generated by IT security systems could quickly become unmanageable without software help. With that in mind, Philipps expects to see 200,000 IT security alarms per day in Athens -- most of them irrelevant warnings -- and has software in place to help sort out the false alarms.
"This is not manageable," he said. "We want to reduce it to [the] 10 to 50 that are real."
Information security manager Yan Noblot explained how much goes into culling the false alarms from those that are real. To begin, he said he monitors traffic between the 10,500 or so workstations and 900 servers on the network.
"We start with the traffic in the venues and compare that with known traffic. This includes traffic at the operating system level," he said. "On top of that, we are receiving logs from all the routers and antivirus system."
This year, Atos Origin is using Computer Associates International Inc.'s eTrust to filter the alarms based on a set of rules developed by the team in Athens, Noblot said. "The amount of information generated every day is massive. You can't put all that on a screen. We have some business intelligence to extract what is really meaningful."
Careful filtering can help in other ways, too, particularly when it comes to Windows 2000 permissions. Noblot said the IT team will be using NetIQ Corp. for security administration.
"It allows us to have a more granular definition of rules," Noblot said. "We don't have to give admin rights to the help desk. We give them only the rights they need."
That precaution might rule out some social engineering attacks, but there are other ways in which the network can be vulnerable. In Salt Lake City, for example, would-be hackers got around application-level locks on public-access PCs by rebooting them and trying to get into the network