Slashdot Mirror
Information Security On An Olympic Scale
jeffy124 writes: "Wired is running a story about the man in charge of securing the computer systems at the Salt Lake City Olympic Games next February. Matt McClung discusses how he's withstanding an 'overhype' in the media on the possibility getting his systems cracked and what he's doing to prevent it in the first place. With 4500 PCs and 550 servers, that shall be a daunting task, especially given the reliability problems at the '96 Atlanta games."
Urmmm... I work in a small company (50 employees) so I've never seen really big networks. But somehow, 2000 computers doesn't seem like that compares in any way to various military and Fortune 500 networks. By an order or two of magnitude.
So, is somebody who has never seen (let alone worked with) this many machines the right guy for the job? Sounds like he is in over his head a bit.
(Now, if this IS an incredibly huge/large network, please bitchslap me)
Jesus was all right but his disciples were thick and ordinary. -John Lennon
just don't hook one single system up to the Internet. Establish a private network (not VPN - actually private) for the entire thing.
:)
Use dedicated hosting boxes, with ALL DYNAMIC FUNCTIONS OFF, that run NOTHING but the http server on the public interface. The secure FTP server runs on a dialup connection that only connects to the private network, with hardware authentication of the modems to each other.
Choose a bare-bones http server, with no bells and whistles. Both IIS and Apache are out. Maybe thttpd? Not familiar enough with it, to be honest.
Yes, you're going to have to work around not having dynamic portions or ubiquitous connectivity, but you're having to choose, flexibility or security.
Would this make for an enjoyable online olympics? Probably not, but that wasn't really what the story addressed.
This can't be right...
1337 h4x0r5 5cH001 r0x0r5
(Must be an Eastern Europe immigrant...)
Those servers aren't just for their internal network. They are hosting the Olympic website too.
I was a relatively low level voluteer, assigned to a specific area at a single venue. My badge said as much in codes that every security person was supposed to know.
I was able to access behind the scenes areas, chat with athletes and celebrities, watch events at other venues, all without a single question from a security person. (Most of them were volunteers too). Even when I was out of my uniform, all I had to do was flash my badge and I was never denied access to even the most sensitive areas. Part of it has to do with attitude of course. If you act like you belong, they assume you do, and I consider myself a Master of Social Engineering, but even then, I should have at least been questioned when I walked into the athletes change area. (There were none there).
I'm pretty sure that Salt Lake City will be more secure, if only because of all the money being poured into it now. But what they need to realize is no matter how many $B you spend on security, you still need people with the balls to say "I'm sorry sir, your badge doesn't allow you in this area" and to stick to it.
Reality has a liberal bias
The man in charge of the security? Is it just me or does this seem like they are setting up a fall guy for the inevitable failure of their network security... Give the guys name out well in advance so we have someone to blame when everything gets hacked...
Pretty smart...
---
Programming is like sex... Make one mistake and support it the rest of your life.
I never really understood the need for hundreds of servers for a task like this, especially for the public website. There is no need for true dynamic content when they can come 99.9% as close with static content on a small farm of servers that's continually updated (say, on a 5 minute interval) by one or two dynamic "feeder" servers. Granted, they'll want one or two backup machines for every production machine, but that's far from a server farm warehouse. Sounds to me like a large scale "because we can" project moreso than a conservative project.
... because they wanted to control it all, including everything on the Olympics.com Web site.
http://www.forbes.com/2000/08/23/feat.html
Stupid job ads, weird spam, occasional insight at
Hmm... with a little hacking, and I could be the first person in my family to win a gold medal for figure skating.
Swannie
:q!
...only that it was the most complex network he'd ever seen.
Personally, I can think of some rather complex topologies for even a twelve-computer network, even ignoring multi-homing possibilities. Depending on how the network structure is designed, as well as how many other networkable devices are involved and how they are connected (I'd assume a rather large contingent of wireless devices as well), this network might well be more complex than anything you or I have seen or even visualized.
The reason I bring this up is that the article mentions the "great hack of 2000" where it was thought that the Sydney Olympics network would be compromised.
Given the current state of affairs, current legislation, and this soon to be widely publicised network, are we going to be seeing any "Terrorist Attacks" against these games? Seems that it would be a very convenient situation for the US gov to prove the neccesity of the U.S.A. legislation just recently passed.
Secure the equipment!!!!
If the guy from Atlanta was right, it does absolutely no good to put up firewalls, anti-virus, or intrusion detection. If any volunteer can take his limited badge and walk anywhere in the complex, then someone could volunteer, camp out around the IT room(s) and do their work from the inside.
And then there is the ever present wireless links. Walk into the games with a laptop loaded with packet sniffers and a wireless NIC and wallah!!...you have all the info you need, even if you don't hack from inside the games, you have still obtained the needed info to go sit at home and go to work.
I cannot believe that security was that bad at the '96 games, but I am not really all that surprised.
No, it isn't legal to have more than one wife in Utah, and hasn't been since before the territory of Utah achieved statehood in 1896 (which was one of the conditions of statehood).
Also, although scandalous, bribing IOC officials was found to be the standard fare for most host-site hopefuls. Utah wasn't the first to do so. Utah was just the first to be prosecuted. IOC officials from previous years admitted to such.
Check your facts before you troll.
__
Do not meddle in the affairs of dragons, for you are crunchy and taste good with ketchup...
Do not meddle in the affairs of dragons, for you are crunchy, and taste good with ketchup.
We might already be too late to help them. :-/
The Ultimate Test
Fill the servers up with pr0n and serve it to the public, for free! If it withstands that, the Olympics will be a piece of cake.Hey, I'm serious ...
Did you know you can fertilize your lawn with used motor oil?
And now for our ceremony:
Gold medal - France - l'intrus d'élite vous possède
Silver medal - Spain - el hacker de la élite le posee
Bronze medal - USA - 133t h4x0r 0wnz joo!!!!
Not true. While OpenBSD is infinitely more secure than windows, thats only a small portion of the problem. You've got to train people to use decent passwords, audit the data so that you can tell exactly where the info is coming from, and design a contingency plan so that if someone does get through, the damage done is minimal. OBSD may be a better foundation, but it's far from being a magic bullet. Much of OpenBSDs security comes from the fact that the admins start with a sense of paranoia; it's very possible to have the same security level with other OSes, its just you've got to know what you're doing.
Marxism is the opiate of dumbasses
Funny how the downward slope just happens to coincide with when they switched from Linux and Solaris to W2K. Well, maybe they're getting the bugs out. Or something.
"If he thinks he can hide and run from the United States and our allies, he's sorely mistaken." Bush on bin Laden
... and what is more spectacular than the Olympics?
The Utah-based company where my day-job is has had a hand in the ticket sales side of the Winter Olies and I've noticed that whenever something this big comes around, people come out of the woodwork to make it go wrong or atleast cause general mayhem.
A lot of people don't like the olympics, and a lot downright hate it to the point where they'll do anything they can to sabatage it including -- you guessed it -- hitting my company so that tickets cannot be sold online for the events.
Now that they're imminently upon us things have calmed down a bit, but a while ago not a day would go by that we didn't get DOS'ed, Skript Kiddie'd and even had a near hit/miss with a domain hijacking, and a lot of the action carried nice little messages saying things like "death to those who promote globalization" and soforth. I can feel for Matt in this, especially since in a little over 2 months it's going to be his systems on centre stage along with the atheletes. The Olympics are too high-profile of a target for anyone lacking in self-esteem to pass up becuase it'll so "so 31337" to say "I changed the name of a frech competitor to 'Le Shithead' on the statz page! W00h00!"
Maybe in 2004 Firewall configuration should be made an Olympic sport?
Hilary Rosen's speech was about her love of money and her desire to roll around naked in a pile of money.
Meanwhile, the Olympics are going to be held in the US in two months and as far as I can tell, no one besides me cares. I've seen a handful of commercials but there's absolutely no buzz. And judging from the tickets the organizers keep pleading for me to buy (men's hockey medal round games, women's skating long program, other really high-profile events) they're having a lot of trouble moving tickets.There was the bribery scandal a few years back (as if that wasn't how every previous Olympics was offered) and now the fuss about terrorism, but are people really bothered by that? I suppose the WTC attack, and the subsequent war and anthrax have driven everything else out of peoples' minds.
Come on, like terrorists are really coming to Utah to blow up a bobsled run? I've eaten plenty of meals in the McDonalds you see in the pictures of the Jerusalem bombing last Saturday -- I can't bring myself to get too worried about going to Snowbird.
What I'm listening to now on Pandora...
I live near Baltimore/Washington, and say a prayer of thanks every time we don't get the Olympics. I mean, we just built about $1billion in stadiums (two in Baltimore, one near DC) and, uhh... We haven't gotten quite that much benefit out of them. I can only imagine the insanity of the Olympic games.
My cousin lived near Atlanta. Had a bunch of leave saved up (gov't job). Took it all during the games. She wasn't alone.
(BTW, nice flag)
Jesus was all right but his disciples were thick and ordinary. -John Lennon
Saltine or Ritz?
What kinds of topings did you have in mind? The cheese variety or maybe something along the lines of Seafood Sald?
Oh wait, maybe I need to askin h4x0r speek:
541+in3 0r R1+2?
Wheeeee
ahem
since the 96 games (in america), and the upcoming games, in America there have been two other olympiads that may have gone unnoticed (perhaps due to not being held in America?).
And while I'm sure they had their hairy moments in the back-room the tech side seemed to run OK...
America is not the ENTIRE world you know.
'There is a Light that never goes out.'
forma3
We'll take 'em! The last time we had them here in L.A., the traffic got BETTER, not worse!!!!!
Fascism starts when the efficiency of the government becomes more important than the rights of the people.
Dude, perhaps you have heard of the website that generally runs during the Olympics? You know, the one that gives (semi-)realtime results, so you don't have to wait five days for NBC to get its act together?
Fascism starts when the efficiency of the government becomes more important than the rights of the people.