Information Security On An Olympic Scale

jeffy124 writes: "Wired is running a story about the man in charge of securing the computer systems at the Salt Lake City Olympic Games next February. Matt McClung discusses how he's withstanding an 'overhype' in the media on the possibility getting his systems cracked and what he's doing to prevent it in the first place. With 4500 PCs and 550 servers, that shall be a daunting task, especially given the reliability problems at the '96 Atlanta games."

Comments

Is this the right man for the job?

[gmhowell]

McClung said the Salt Lake City Olympic computer system, comprised of 4,500 PCs and 550 servers, is the most complex network he's ever seen.

Urmmm... I work in a small company (50 employees) so I've never seen really big networks. But somehow, 2000 computers doesn't seem like that compares in any way to various military and Fortune 500 networks. By an order or two of magnitude.

So, is somebody who has never seen (let alone worked with) this many machines the right guy for the job? Sounds like he is in over his head a bit.

(Now, if this IS an incredibly huge/large network, please bitchslap me)

Not that hard...

[RollingThunder]

just don't hook one single system up to the Internet. Establish a private network (not VPN - actually private) for the entire thing.

Use dedicated hosting boxes, with ALL DYNAMIC FUNCTIONS OFF, that run NOTHING but the http server on the public interface. The secure FTP server runs on a dialup connection that only connects to the private network, with hardware authentication of the modems to each other.

Choose a bare-bones http server, with no bells and whistles. Both IIS and Apache are out. Maybe thttpd? Not familiar enough with it, to be honest.

Yes, you're going to have to work around not having dynamic portions or ubiquitous connectivity, but you're having to choose, flexibility or security.

Would this make for an enjoyable online olympics? Probably not, but that wasn't really what the story addressed. :)

Olympic Security in Atlanta was a joke

[CokeBear]

Olympic Security in Atlanta was a joke.
I was a relatively low level voluteer, assigned to a specific area at a single venue. My badge said as much in codes that every security person was supposed to know.

I was able to access behind the scenes areas, chat with athletes and celebrities, watch events at other venues, all without a single question from a security person. (Most of them were volunteers too). Even when I was out of my uniform, all I had to do was flash my badge and I was never denied access to even the most sensitive areas. Part of it has to do with attitude of course. If you act like you belong, they assume you do, and I consider myself a Master of Social Engineering, but even then, I should have at least been questioned when I walked into the athletes change area. (There were none there).

I'm pretty sure that Salt Lake City will be more secure, if only because of all the money being poured into it now. But what they need to realize is no matter how many $B you spend on security, you still need people with the balls to say "I'm sorry sir, your badge doesn't allow you in this area" and to stick to it.

IBM passed on the job

[Lumpish Scholar]

... because they wanted to control it all, including everything on the Olympics.com Web site.

http://www.forbes.com/2000/08/23/feat.html

A chance to win...

[Swannie]

Hmm... with a little hacking, and I could be the first person in my family to win a gold medal for figure skating.

Swannie

Rule Number 1

[darrad]

Secure the equipment!!!!

If the guy from Atlanta was right, it does absolutely no good to put up firewalls, anti-virus, or intrusion detection. If any volunteer can take his limited badge and walk anywhere in the complex, then someone could volunteer, camp out around the IT room(s) and do their work from the inside.

And then there is the ever present wireless links. Walk into the games with a laptop loaded with packet sniffers and a wireless NIC and wallah!!...you have all the info you need, even if you don't hack from inside the games, you have still obtained the needed info to go sit at home and go to work.

I cannot believe that security was that bad at the '96 games, but I am not really all that surprised.

Security already not so great

[imrdkl]

Just looking at the Saltlake official webpage, I see only one link which uses encryption, and that's the signup link so that you can download a screensaver and get some kind of updates. Theres a tremendous amount of javascript there, and it's clearly being served already from M$.

We might already be too late to help them. :-/

The Test

[Rolo Tomasi]

OK, after they've got all rigged up and ready to go, they're ready for

The Ultimate Test

Fill the servers up with pr0n and serve it to the public, for free! If it withstands that, the Olympics will be a piece of cake.

Hey, I'm serious ...