Internet2 Network Security SIG

[Rick Haugerud <>]

We have experienced a situation like this a couple of years ago.  We were contacted by a member of US Air Force Incident Command.  They had identified a series of servers and accounts in one of our colleges that had been compromised, and were being used as a jumping point to go elsewhere.  They asked us to install a “black box” that would allow them to monitor the activity.

 

They actually flew to Lincoln (3 of them) and met with us and described some of the activity.  We allowed them to install the “black box” on our network for about 18 months.  Information sharing was minimal, and ultimately we disconnected the box and shipped it back.

 

Rick

 

Rick Haugerud

Office of Cybersecurity & Identity|ITS|

211 Nebraska Hall, 68588-0522

University of Nebraska |nebraska.edu

Kearney|Lincoln|Omaha

402-472-2135 (o)

 

Information Technology Services
Connecting people, ideas and technology for a better University, a better you.

 

From: [mailto:] On Behalf Of John Dundas, III
Sent: Friday, February 9, 2018 9:33 AM
To:
Subject: Re: [Security-WG] Strange request from Air Force

 

On 2/8/18 1:09 PM, Karl Newell wrote:

Hi all,

 

One of our members experienced the following, I’m wondering if anyone has heard of something similar or what your thoughts are.

 

The Air Force contacted the member’s DNS registrar saying they had information to share about the member’s network.  This request made it to the CISO who called back.  The Air Force wanted to install a device on the member’s network to monitor traffic.  It was assumed there would be information sharing but the member did not agree to work with the Air Force.

 

Thanks,

Karl

Karl,

Thanks for posting this.  To my knowledge, CENIC has not been approached by any agency with such a request.

Also thank you for declining the "offer."  Numerous red flags are at full-mast.

John

Attachment: smime.p7s
Description: S/MIME cryptographic signature