Slashdot Mirror
Behind the Scenes at MIT's Network
BobB writes "MIT's head of computer networks and security gives an inside look at how the techie school is fending off hackers, cranking up its network to handle voice over IP and become a fiber network operator to link to other research institutions. From the article: 'Q - How do you actually enforce security standards among MIT's departments and network users? A - Enforce is not a word you can use at MIT. We try to entice people to do the right thing. We've made a lot of progress. We've removed the financial incentive to run your own network, which used to be cheaper than having us do it. We've been a cost-recovery network since forever now though. At many universities the network is free and they just fund it out of operating costs.'"
FTFA:
....
Q:.. I know MIT has not been immune to breaches either, but what do you think when you hear about new breaches like these?
A:.. The problem we all have is the Microsoft patch of the week. I hate to say it, but it's sort of the payback for universities not paying attention to security for decades or being sloppy about administrative computing.
Not that MS is the only problem, but they helped secure that mentality. I don't think Linux would have made it easier or better either. He goes on to talk about use of SSNs and other bad ideas. If only businesses would listen to this type of advice!!
Support NYCountryLawyer RIAA vs People
FTA:
What about dealing with wireless on campus these days?
We recently started surveying our community about what mobile devices they are using, how they are using them, etc. We have a team of people worrying about this.
The cool thing about MIT is that they own the entire 18.0.0.0/8 Class A address space, so every device on campus has a public IP.
And all computers (even student machines) are connected directly to the Internet - no NAT, no firewall, no protocol limitations, no bandwidth caps.
The catch is that all computers need to have a registered MAC address in order to get on the network, so if your Windows machine gets infected with a virus, they can disconnect you in a hurry.
This space intentionally left blank.
What's this: No pictures?
"We've removed the financial incentive to run your own network, which used to be cheaper than having us do it."
Sounds like here at $IVY, where it was actually more financially viable to run all of your own cabling and just pay the monthly cost on a gateway than it was to pay $CENTRAL_IT for each jack and IP. Then $CENTRAL_IT caught on and instituted a minimum bandwidth cost on every single IP address, thus "removing the financial incentive."
Then they charge $80 to flip a dipswitch to "on".
How do you actually enforce security standards among MIT's departments and network users?
I like to rely on my friends Mr. Louisville and Mr. Slugger.
From the article: "our toilet server, which does voice mail and all the other crap, runs Asterisk software"
:-)
Wow, at MIT, even the *toilets* are servers? No wonder they have their own class A!
I really hate articles that describes all these great networks and server rooms but don't have any pictures of the hardware. It's not like someone is going to search a picture to find an unsecured air vent in the ceiling so they can drop down among the laser sensors to hack into the computer.
It's not "standard," but there are places that do it. Generally small campuses, or ones that didn't build-out wired infrastructure when they should have, and are now trying to catch up and be 'wired' using 802.11 as a substitute for a real copper network.
I know there are quite a few schools deploying it strategically, which seems like a good plan. It only takes a few minutes walking around a college campus to realize that there are a few key places where wireless would be most useful, and a lot of places where it would probably be underutilized. Libraries are huge -- go into any uni library and you'll see rows of people typing away on laptops. If you can't afford to put an Ethernet drop at every study carroll, wireless is the next best thing. (Well, actually, both would be best.) Study lounges and communal spaces are probably next, followed by cafeterias and big lecture halls (if you want to encourage people to use laptops in class; some schools might have faculty that would rather discourage that). In warm climates, outdoor locations can be great locations for Wifi, too.
But deploying it all over a large campus would, for most schools, be impractical. It would take too many base stations and would cost too much for the number of users you'd probably have at a time on most of them. I think if you did roll it out everywhere, you'd probably find pretty quickly that some nodes took huge amounts of load, while others were basically never used. For this reason, most large places with a competent IT staff don't just shotgun it all over campus, but are more selective.
"Ladies and gentlemen, my killbot features Lotus Notes and a machine gun. It is the finest available."
That MIT-level hackers (See Steven Levy's book) have direct, Class-A network access to the Internet, or that a school like MIT still doesn't get the idea of the network as an infrastructure utility rather than a cost-recovery service.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
I know users can be pretty dense where change is concerned but to say that people would be upset because the phone is a different color is even worse than what I had to go through recently.
I was assigned to replace someone's pc with one of our new ones. After I was done I got a call from him asking if he could have his old keyboard back because the keys on the new one weren't the same. I looked at the old one and compared it to mine (the same type he had). The only difference was the six buttons where Home, PgUp and so forth are located are arranged vertically on the new keyboard compared to horizontally on the old one.
So, to answer this question, it's not the fault of those of us in IT that we have bad attitudes when we have users like the above to deal with.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
When I switched to a keyboard that rearranged my “Super Six”, I was distraught too. I kept hitting the wrong keys and it was annoying for some time. This is not a trivial difference for people used to not staring at their keyboards as they work.
Why bother.
From the article:
The FCC chief of staff told Educause this wasn't about universities and to go away, but Educause wouldn't let it go and asked the FBI. And of course if you ask the FBI if they'd want cameras in every bedroom of every American citizen, they'd say of course, we could cut down on domestic violence. They woke a sleeping giant. For now, CALEA is a source of angst for IT, but the lawyers are busy.
CALEA = Communications Assistance for Law Enforcement Act, http://www.askcalea.net/
So, they've had to make provisions to allow wiretapping on their VOIP network inside MIT, because some consider them a "telecommunications carrier"? Or, they are fighting it now, hoping they don't need to make provisions.
From the CALEA website:
The objective of CALEA implementation is to preserve law enforcement's ability to conduct lawfully-authorized electronic surveillance while preserving public safety, the public's right to privacy, and the telecommunications industry's competitiveness.
Our school also gives public IP address to all our machines. It's so nice to be able to directly ssh/scp/sftp to your lab machine from home -- no tunnels, no firewalls, no VPN. Just you and your encrypted password. And then we go to some other institution and wonder why they take forever to load a web page -- and discover all the traffic for the entire network is being funneled through some machine which is trying desperately to NAT the entire campus's network. Siiiigh.
Yes I'm spoiled. It's good to be at a university that doesn't need to baby its users. If you run Windows and it's not up to date, it's kicked off the network until you patch it. Don't like that? Then run your *own* firewall, or switch to a system that doesn't leak like a sieve. Don't expect to ruin it for the rest of us because *you* choose to run insecure software.
That was too short to put up with 8 pages. (The first question was the first page!?! Fer cryin' out loud.)
Behind the scenes of MIT's network
Network Manager/Security Architect Jeff Schiller on buying into VoIP and fiber in a big way
By Bob Brown, Network World, 01/18/07
Massachusetts Institute of Technology Network Manager/Security Architect Jeff Schiller is leaning back in a plum-colored recliner in his office, but he isn't relaxing. The victim of a back problem that has forced him to forgo a more traditional office chair for now, the 25-year MIT network veteran has more than enough to do, with the school forging ahead with several major network projects, including a massive VoIP rollout and its foray as a regional fiber-optic network operator. Schiller covered the gamut in a recent interview with Network World Executive News Editor Bob Brown.
How's the VoIP project coming along?
We have 500 people on our voice-over-IP system, so we've really moved beyond the pilot stage to the service stage, and we're ramping up to 1,500 users in the next couple of months, and to be a VoIP campus not too many years from now, MIT plans to switch all 15,000 of its phones to VoIP. We've got it going in the IT department, since you've got to eat your own dog food. (Some people asked if it was really wise that the phone path to the IT department would use VoIP, but we told them if the network is down, we know.) One of the arguments for having us do it by department or building is that the hard part is getting our 5ESS [phone switch] people to manually route their phone numbers to us so that people can keep their phone numbers (putting new employees on the VoIP system is much simpler, as the school uses a common name space and via a Web administration page can set up new end users with a Session Initiation Protocol address that's the same as the e-mail address).
What's the story behind your VoIP project?
If you would have come here a year ago you would have found that I had an ISDN phone, as we put in ISDN in 1986 [now he has a Polycom IP phone and is among the 500 initial users of VoIP at the school]. We bought a 5ESS phone switch from AT&T that went online in 1988. AT&T rewired the campus at that time and that's how we got our first fiber plant. Around 1999 they contacted us and told us that switch would be obsolete by 2001 because they weren't making any more software updates for it. Our CIO came to me and asked if we could do VoIP by 2001. I said "I wish I could tell you yes, but the technology is just not mature enough," so we went and bought another 5ESS, which was hugely expensive. If you estimate a 10-year life cycle for that phone system that meant the vendor was going to be coming back to us before long to let us know we'd need to buy another one. But now voice over IP is ready, and I told our CIO about a year ago that if we want to be a voice-over-IP campus by 2010 that we'd need to start now.
What technologies are you using for the VoIP system?
We're not 100% decided on some parts, but I'm currently using a Polycom system. The media gateways to the 5ESS are Cisco high-end voice-over-IP switches, and of course we do everything in pairs in different locations. We're running the OpenSER SIP Express Router [MIT is also evaluating commercial offerings] on Dell 2850s redundantly, and our toilet server, which does voice mail and all the other crap, runs Asterisk software. It's fair to say it's mostly an open source deployment. The open source stuff not only is relatively inexpensive but we can integrate it into our infrastructure and customize it. The killer app has been sending voice mail to e-mail., something the Octel voice mail system on the 5E couldn't do. As for the rest of the infrastructure, the voice-over-IP phones are running on a separate VLAN. We have to upgrade the general infrastructure just because it's time to do that. We have physicists who want to send data sets of gigabytes to CERN, and the Media Lab wants to do real-time video. But voice ove
Not that I am going to win a prize on Slashdot...but my keyboard is 11 years old - half the age I am. My keys are smooth, not rough like some new ones, and the letters are staring to fade. (Do the math, I have only been able to use it a lot for the last couple of years.)
Everything was better with ITS! Just get a DECnet hooked up between a few PDP-10s, and... TADA! No viruses! (Not that I'm old enough to remember ITS... :P I'm a retrocomputing geek.)
http://pinopsida.com
City College of San Francisco converted to VoIP, oh, a year or two ago IIRC. Had some conversion issues, but it works well now far as I know. CCSF has some 3,000 employees IRRC (largest community college district in the US with nearly 100,000 students and seven or more campuses.)
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
It is a tradeoff. In the U.S., monopoly wired broadband suppliers charge higher rates and (often) provide lower bit rates than in Europe, S. Korea and Japan. Is 256Kbps considered Hi-Speed broadband where you are? So, there is greater pressure/demand for other ways to connect.
Uhmm- what is the laptop penetration rate (vs. desktop) in Europe vs. the U.S.?
Got a Dell catalog here that ONLY has laptops- Jan 2007. I realize that catalogs/direct-marketing
can be highly tailored.