Security Vulnerabilities of Local Area Networks

To:       All Employees

From:     Donald Watson, Bureau Automated Information Systems Security Officer

Subject:  Security Vulnerabilities of Local Area Networks

The purpose of this message is to remind the owners, administrators, and 
users of USGS local area networks (LANs) that these networks are inherently 
unsecure. The fact that most, if not all, LANs are connected to other wide 
area networks such as DOINET and the INTERNET further increases the 
security-related vulnerabilities.  Although we are continually improving our 
network security controls, it is practically impossible, at present, to 
guarantee the privacy and confidentiality of sensitive information either 
transmitted over or stored on our LANs.

In recent years, many private sector and Federally owned LANs have been 
broken into by individuals commonly referred to as 'hackers'.  After gaining 
"privileged" access to a networked host computer through one means or 
another, these intruders typically plant monitoring software known as 
'sniffers'.  Using the 'sniffer' software, these individuals monitor network 
traffic, reading all information traveling over the LAN.  From information 
gathered in this fashion, the intruder can collect sensitive data and 
potentially compromise other, connected computers.

Electronic mail (E-mail) is an application that is often overlooked when 
considering the possibility of someone compromising confidential 
information.   We generally tend to think that E-mail is private, and it 
should be.  However, there are two situations that can jeopardize the 
privacy of E-mail.  First, an individual can capture and read messages being 
transmitted over the network using 'sniffer' software.  Second, someone 
could break into a weak, unprotected E-mail server, become the system 
administrator, and read any message stored on that server.

Due to the risks described above and until stronger security measures can be 
implemented, I encourage you not to transmit the following types of 
information over our networks or store them, in the form of documents, on 
our E-mail systems.

Privacy Act Information - data that uniquely identifies an individual, e.g., 
Social Security Number.

Procurement-related materials such as proposal evaluations, actual bid 
numbers, or any other proprietary information.

System registration information that includes User ID along with initial 
password.

Documents written by supervisors that contain negative or adverse action 
comments on employee performance or behavior.

Any information addressed to systems administrators that could be used to
compromise the systems they manage, e.g., a list of devices with their 
passwords.

Remember, successful 'hacks' into computers or networks are not always the 
result of brilliant technical prowess or superior hacking tools.  Many times 
they are accomplished by taking advantage of the naive behavior of staff and 
users.  It is important that everyone adheres to sound security practices 
and procedures when using any of our computing resources.  It is especially 
important that network system administrators make sure that everything 
possible is being done to protect the systems under their control.

If you have any further questions regarding the recommendations discussed in 
this message, please call me at (703)648-7046 or send an E-mail message to 
dwatson@usgs.gov.