Tune IT Up
From Fermilab Today, November 9, 2009
Check for IDs
In the past, we have warned employees about visits from Red Teams, groups of cybersecurity experts who work directly for, or under contract to, the Department of Energy. Red Team members are charged with testing whether federal cybersecurity standards are being followed at organizations within DOE, including the national labs. Red Teams often try to bypass our defenses by gaining physical access to laboratory computers. They may come to an office claiming to be a new system manager and say they need to install special software. If you give them access, they will attempt to install malicious software on your computer.
Over the course of the next four or five weeks, legitimate contractors working for the Tune IT Up campaign will visit many people at the laboratory, and you will have an opportunity to put what you've learned to use. Contractors with the Kemtah Group, an IT organization, will visit Windows, Linux and MacOS laptops and desktops (not servers). They will have Fermilab contractor ID badges, and you may ask to see those badges or call the Service Desk at x2345 to confirm their identities.
An article in today's Fermilab Today describes what the contractors will do during their visits. We have also posted photographs so you will know ahead of time what the contractors look like.
The contractors will attempt to notify the system administrator of each computer before visiting, and the system administrator may choose to accompany them. Remember that you should never give your password to anyone, including your system administrator and the contractors. The system administrator, who in some cases is the user of the machine, will assist the contractors in logging into desktop and laptop computers. But in no case should anyone reveal passwords to the contractors.
Fermilab's computing professionals are trying to make this part of the Tune IT Up campaign a smooth, secure experience.
— Mark Leininger