Olympic IT security requires advance planning

Lessons learned in Salt Lake City in 2002 will come in handy in Athens

If there's one thing the Atos Origin SA team understands as lead contractor for the Olympic IT infrastructure, it's that you must learn from your mistakes.

One such lesson learned the hard way: IT security must be built in from the start, according to Claude Philipps, program director of major events at Atos Origin. For the 2002 Olympic Games in Salt Lake City, the company "started embedding the security too late, so it wasn't running well."

The lapse caused nothing serious, except for a few headaches. "We had a lot of attacks, but we ran the games safely," Philipps said.

During those games, the Atos Origin team found that the number of alarms generated by IT security systems could quickly become unmanageable without software help. With that in mind, Philipps expects to see 200,000 IT security alarms per day in Athens -- most of them irrelevant warnings -- and has software in place to help sort out the false alarms.

"This is not manageable," he said. "We want to reduce it to [the] 10 to 50 that are real."

Information security manager Yan Noblot explained how much goes into culling the false alarms from those that are real. To begin, he said he monitors traffic between the 10,500 or so workstations and 900 servers on the network.

"We start with the traffic in the venues and compare that with known traffic. This includes traffic at the operating system level," he said. "On top of that, we are receiving logs from all the routers and antivirus system."

This year, Atos Origin is using Computer Associates International Inc.'s eTrust to filter the alarms based on a set of rules developed by the team in Athens, Noblot said. "The amount of information generated every day is massive. You can't put all that on a screen. We have some business intelligence to extract what is really meaningful."

Careful filtering can help in other ways, too, particularly when it comes to Windows 2000 permissions. Noblot said the IT team will be using NetIQ Corp. for security administration.

"It allows us to have a more granular definition of rules," Noblot said. "We don't have to give admin rights to the help desk. We give them only the rights they need."

That precaution might rule out some social engineering attacks, but there are other ways in which the network can be vulnerable. In Salt Lake City, for example, would-be hackers got around application-level locks on public-access PCs by rebooting them and trying to get into the network from there, Noblot said.

This time around, the possibilities for introducing hacking tools or other unauthorized software have been greatly reduced. "We have a very small footprint to the Internet. It's almost nonexistent, and we don't send or receive Internet e-mails, so viruses are locked out," he said.

Anyone hoping to introduce a virus or other software directly onto the network in Athens will find the CD-ROM drives, floppy drives and USB ports on PCs and servers disabled.

According to Philipps, it's cheaper to have suppliers deliver standard machines, then uninstall the drivers and disable the drives and ports at the BIOS level, than it is to order special machines.

If any of the PCs later need a last-minute antivirus update or security patch installed, "we distribute it through the network using tools like LANDesk or Symantec Ghost," Philipps said. With the CD-ROM drives out of use, he said, there'd be no point in sending someone running around the 60 or so venues with an update CD -- unless they were training for the marathon.

Copyright © 2004 IDG Communications, Inc.

8 highly useful Slack bots for teams
Shop Tech Products at Amazon