UCSB JOG/CPG REPORT May, 2003

JOG

The Information Technology Planning Group (ITPG) has begun the task of coordinating campus actions related to SB1386 and the IS-3 revision. Memos have been prepared for campus community that charaterizes the issue and identifies UCSB's risks and responsibilities. A draft IS-3 guideline is being developed. In addition, campus IT organizations will provide educational forums which will inform appropriate faculty and staff of the issues and their responsibilities.

Authentication: The UCSB Directory (LDAP) continues to evolve as the source of truth for individuals currently associated with UCSB. The directory is again being used as the source of the campus directory (phone book). This year, functions have been developed that will allow designated department representative to update the directory entries for faculty/staff who are unavailable. In addition, the UCSB Directory is also the source of data to be used for publication of the UC Directory. In addition, several applications are now authenticating against the directory.

Authorization: The RFQ for role based authorization software was sent to potential vendors, and responses were received in April. Responses are currently being reviewed. The primary features we're trying to obtain are 1) role based authorization, 2) web based single signon, 3) delegated administration, and 4) support for the existing UCSB LDAP based directory.

IS&C is currently beginning research into acquiring a new IMAP server software product for IS&C EMail customers (about 1,000). An RFI was sent to 6 potential vendors. Five of the six have responded and the responses are being reviewed.

Implementation of the fully automated Transfer of Funds (TOF) system has been completed. The application was initially made available to a set of major department financial control points. After a level of comfort was achieved by the campus, the application has been released the general financial control population. We have learned a couple JSP lessons with the deployment of this application: 1), UCSB needs a generic workflow engine - given that we don't currently have one, we had to address business processes in code - as soon as the "no-doubt-this-is-the-way-it-is" business process was released, major exceptions to the rules were identified (collaborative design didn't help), 2) even with strictly HTML/java script pages being served by the JSP architectures, there are still irritating differences between the MAC based browsers and PC based browsers that force non-optimal code design decisions, 3) JSP is not well suited for applications that will return large data sets. We have a couple of instances where queries are generating 5Mb html pages. While performance isn't necessarily poor, the ability to change view perspective on that html is cumbersome.

Implementation of the Transfer of Expenditure Web Application (TEWA) is in the implementation stage. TEWA makes use of many of the same components (authentication, authorization, workflow, mainframe interfaces) developed for TOF and is also a Java (JSP based) application.

Development has begun to rehost the campus Web Travel application from its current architecture (java script with CGI type backend interfaces) to a MS .NET architecture. The intent of this migration is to (1) eliminate some dead end techology (Netscape LiveWire), and (2) achieve a level of browser independence.

The Degree Audit System (DARS) has been successfully migrated from an AIX/Sybase environment to Windows 2000 Server/SQL Server environment. The result of the migration was an order of magnitude improvement in performance (degree audits in 6 seconds compared to 75 seconds in the old environment).

IS&C had begun investigating the purchase of a new IBM mainframe. The target hardware, generation 6, was the smallest and least costly machine that was appropriate to the UCSB environment. The decision was made to defer the purchase primarily due to the increased cost of software licenses for the generation 6 machines.

CPG

Campus Cellular Sites – The OIT is developing a white paper on cellular sites that will serve as the starting point for a campus-wide discussion on the placement of cellular sites on campus.

Telephone Switch – our new NEAX2400 IPX telephone switch has been in operation since August 10, 2002, but we have not yet accepted it due to issues of contract performance.

ONI – We are trying to get started on the last construction piece of our first last mile project. We purchased fiber materials from Level(3) to make sure that we match their specifications, and they ended up giving us twice what we ordered, so we should have enough fiber for both of our last mile projects. Over the holidays we moved equipment and fiber terminations in our switchroom to prepare for the arrival of the 15808 equipment sometime in April. We are now working on the electrical requirements.

Intrabuilding Wiring Projects – By April we should have completed all our Phase I projects. We have made significant progress on 12 of our 26 Phase II projects.

Next Generation Backbone – we used 802.11b wireless equipment to provide a backbone connection to an off-campus building. we're using 128-bit WEP with a pre-standard version of TKIP to provide automatic key rotation, as plain WEP is not adequate. During this implementation we ran into a couple of problems related to VLANs: the initial wireless equipment that we deployed didn’t support Ethernet frames large enough to support VLAN tags. Our current wireless equipment requires an untagged link for management purposes, and the Foundry BigIron 4000 does not fully support both untagged and tagged VLANs on the same link.

Network Security –

The majority of the incoming scans during the fall were probably from hosts infected with the Microsoft based Bugbear or Opaserv worms. We reported 17,000 of these scans to the appropriate ISPs through our automated process, but this was only a fraction of the scans that we were hit with. The rate was as high as about 3,000 scans per day and is currently between 1,000 and 2,000. We also recorded 1,000 other scans with half of them scanning for things like MS-SQL, BackOrifice, and IIS.

About 20 of our Windows hosts managed to get infected by one of the previously mentioned worms. We also discovered 41 Windows hosts that were running an IRC bot normally used to transfer WAREZ, such as movies and software, and 32 Windows hosts that had an FTP server running on a non-standard port as another way to distribute WAREZ. Another 4 Microsoft hosts were compromised and being used for various hacking activity. Most of these Windows hosts either have a weak of non-existent Administrator password or an unprotected network share. We have plans to limit our exposure to this problem by setting up a VPN server to handle off-campus NETBIOS traffic sometime this year.

There was also 1 compromised Solaris host and 2 compromised Linux hosts.