Internet2 Network Security SIG

[Frank Seesink <>]

Have not experienced this with the Air Force per se, but a few years back we were approached by the WV Office of Technology (WVOT)—the state gov’t dept. responsible for the MAN in Charleston and our sister org on the gov’t side so to speak—if we’d be willing to install the MS-ISAC folks' “Albert sensors” in our network  with the intention to share information gleaned.  (MS-ISAC being the Multi-State ISAC or state gov’t variant of REN-ISAC.)

At the time I did my research into these and determined that what these “Albert sensors” were was pretty much appliances running the open-source Suricata software ( https://suricata-ids.org/ ) with some secret sauce most likely, and from their own description these appliances “phoned home to mommy” as it were, thus aggregating all the “Albert sensor" info collected to find threats/attacks/etc. across member state networks.  The sending of network data to who-knows-where was the first red flag.

Being a network provider for everything from higher ed to state/county/local gov’t, K12, public libraries, etc., we’re obviously ideally positioned for such a thing.  But I remember thinking that some of our customers, notably higher ed schools, would balk at the idea, not to mention we’d likely have to determine if this would violate any of the usual suspects (HIPAA, FERPA, COPPA, etc.).  And sure enough, during a meeting less than a month later with one of the higher ed customers, we asked the main IT guy if they’d be ok if we did that, and I believe the response was “No f*ing way in h*ll.”

Needless to say, we have never allowed it, and it died on the vine.  I believe those sensors may exist within the state gov’t network, but that’s it.

On Feb 8, 2018, at 4:09 PM, Karl Newell [!] <> wrote:

Hi all,

 

One of our members experienced the following, I’m wondering if anyone has heard of something similar or what your thoughts are.

 

The Air Force contacted the member’s DNS registrar saying they had information to share about the member’s network.  This request made it to the CISO who called back.  The Air Force wanted to install a device on the member’s network to monitor traffic.  It was assumed there would be information sharing but the member did not agree to work with the Air Force.

 

Thanks,

Karl

Frank Seesink
Telecommunications Networking Specialist III
West Virginia Network (WVNET)
304.293.5192 x241