|
|
||||||||||||||||||
January 31, 2013
As directed by the Department of Energy (DOE), Berkeley Lab will activate activated a new cyber security monitoring sensor in January, 2013. Unlike current other cyber security monitoring which is only directly accessible to LBNL Berkeley Lab employees, the data collected by this sensor will be accessed is accessible by DOE and DOE’s DOE's contractors for the purposes of detecting malicious activity.
All LBNL Berkeley Lab employees and affiliates will be are required to complete a one-time acknowledgement of this change via the JHA system. We’ve created a one page training to track notice of external monitoring. You will receive a JHA notice and have one month to complete. Complete can complete the training now (you'll need your employee/affiliate ID number).
Why
...
did this
...
happen?
Berkeley Lab has been directed by the Department of Energy DOE Office of Science to install the sensor. Previously, installation of the sensor had been voluntary and Berkeley Lab had chosen not to participate in the program in its current iteration.
...
The program is designed to provide DOE with a comprehensive picture of its cyber security status, allow for analysis and detection of suspicious activity across DOE, and support the counterintelligence and intelligence operations of the DepartmentDOE.
Do other Laboratories have this program?
...
- Domain Name Service (DNS) responses.
- Hypertext Transfer Protocol (HTTP) requests.
- Application client and server banners.
- Type of operating system.
- Summary data on network traffic (e.g. record of data between two network addresses).
What is the data used for?
Generally, the data is used by analysts at the DOE to analyze and summarize network traffic patterns looking for malicious activity.
...
If you use the Berkeley Lab network, network traffic from any device - personal or otherwise - will be monitored. However, this does not authorize access to your personal devices or the data stored on your personal devicedevices.
Does this affect what websites or services I can use, including incidental personal use?
No. This monitoring does not control or limit access to websites or services. This monitoring does not change our Berkeley Lab's policy on Acceptable Use of Information Technology. Acceptable use includes business use and incidental personal use. Unacceptable use continues to cover the existing list in our policy, including copyright violations, sexually explicit materials, gambling, for personal gain, etc.
Why do I need to acknowledge this program?
Because of the unusual nature of the program, we are requiring a one time acknowledgement from all employees and guests. This approach replaces the previous paper-based computer cyber security acknowledgement that was used with new hires.
Who can I contact if I have questions?
ITpolicy @ lblITpolicy@lbl.gov
