After Katie brought home the new Whitworthian and the front page had info on a virus that SHUT DOWN the campus again, I had to say something on the only medium I care about: the Whitworth Information Systems (WIS) department cannot compete in today’s technologically diverse arena. The consistent response of WIS has been to shut down internet access until a crisis has abated. Twice, that I know of, the internet has been shut down due to viral activity. Once here and this time. So what, you say, twice in a year isn’t that bad. True…if that was all. This type of response is typical of a campaign of security through obscurity by WIS. I have weathered four years of switched-off ports in the library, wireless access points that aren’t running or are powered, but with no internet access available. That’s tragic, you mutter. Yea, except Whitworth is rather expensive and in their computer use policy it states that the goal of Whitworth “is to provide adequate computer facilities for support of education, research and administration for all Whitworth computer users and to update these facilities as needed to keep the college competitive.” This says that computers are important to everyone and their continued use keeps the college “competitive,” whatever that means. At the end of the policy was something that caught my eye: Inappropriate use of technology includes “intentionally block or overload the system or prevent its use by others.” This sounds strangely like shutting down a subnet because of “unusual network traffic” as stated in the Whitworthian article.
Let’s talk about the article. I would have liked to read something about the steps WIS is going to take to prevent a shutdown of the campus internet. Instead, the article blandly talks about virus “buzz words” like “Internet Relay Chat” which is implicitly to blame for the current infection, according to the article. Like there is this phantom person roaming around logging machines onto IRC servers. It doesn’t address the fact that the H variant of the virus is just that, a variant. This virus was not a surprise. The original virus was discovered on July 8, 2002, according to Symantec, the antivirus of choice for WIS. The H variant mentioned in the article was discovered on September 8, 2004 by Symantec. Symantec classify this virus as a Trojan horse, not a Denial of Service (DoS). For those readers who are confused, a Trojan horse slips into your computer and calls home, allowing unfettered access to information and bandwidth. A DoS attack is not a virus at all, “but a method hackers use to prevent or deny legitimate users access to a computer”1 Symantec’s site was very informative on the difference. Now, the H variant COULD be used as part of a DoS attack on another machine, most likely off-campus, but isn’t there a limiter on each individual port usage in the dorms? I think there is. There is mention of it here as well. If there is, then the virus isn’t that nasty, right? After all, there isn’t much bandwidth to suck. Symantec, as well, classifies this virus as low distribution and medium damage. The threat of damage is mostly to private data and less to other computers. What does that mean? The privacy of individual computers is at medium risk, but the distribution is low risk. The Whitworth computer policy states that users have no privacy on Whitworth campus. “The Information Systems staff has the ability to view all network activity, messages and files of any user.” The next sentence in the policy is designed to alleviate any fears. “However, it is not the routine policy of the staff to view others’ files and the intention is to keep files private, even though such privacy cannot be guaranteed.” Is WIS so concerned with user privacy that they shut down internet access? Of course not, they clearly state that any computer on their network is essentially theirs.
What IS really important in this instance of internet totalitarianism? The virus isn’t that dangerous, except to user privacy, which clearly isn’t important. From what I can guess, since the article gave almost no important information about the network, each dorm at least is its own subnet. This is helpful in categorizing a network and restricting access to the main trunk and servers. Now, I think that if my network is subnetted, I would use other security tactics as well to take advantage of all my hard work.
Hmmm, new freshmen move in early September. I can do several things to ensure new users are virus-free. I can lock down individual dorms and hold dorm-wide meetings and hand out antivirus discs, telling the attendees that once every computer in their dorm is verified as running Symantec software, the internet access will be turned on. You can bet that people will be checking their roommate’s computer every hour until its done. Alternatively, you can upgrade every computer to Windows 2000 or better and in return, you get administrator privileges and remote administration. This would allow WIS to install Symantec on every computer without the user’s permission, clearly applicable given the computer policy, and update those virus definitions three times a day if necessary. Or, you can install virus filters at the subnet level to catch errant traffic that has virus-like tendencies. Definitely email messages, you can use an Intrusion Detection System (IDS) to scan packets on subnets and make educated guesses on what an individual computer is sending. I assume WIS has some way of looking at packets, “unusual network traffic” sounds about right; but why not tell the reporter(s) that traffic is filtered and this signature inside this packet is most likely a virus-related activity? If they had it, they probably would have said so, if only to alleviate any fears of future outbreaks. Or, to get back to initial options, you can cross your fingers and just hope to a computer deity that everyone will pick up a antivirus CD outside the library and install it on their own. Don’t forget that WIS has the ability to turn off individual network ports as well. That is another option available.
I know that I sound like a broken record, but why is WIS turning off internet access when there are multiple options available, not to mention ones that I haven’t thought of in 30 seconds, to the savvy network manager? My answer is, I don’t know. The interesting thing is, Jack Miller, Whitworth Director of Information Systems, is running for office. “Miller, a 16-year-employee of Whitworth, is attempting to win a seat in the House of Representatives, Washington State 7th District, Position 1.” 2 Is this taking away from his work? I have no idea. What is clear to me is that WIS isn’t thinking creatively to fix this reoccurring problem of internet access.
