“Computer security” might be perceived as a technological endeavour – technology intended to solve technological problems. Firewall hardware. Anti-malware appliances. Multi-factor tokens. Encryption. Anti-virus software. EDR. BC/DR. SBOM. SOC. You name it. But, actually, computer security is far removed from technology. It is a people’s problem of sociological nature. The solutions are in front of the screen, not in the bits and bytes in the hardware. So: “Thank you, folks!” for reading on and helping us keep the Organization secure.
As we have shown in many past issues of the Bulletin, we live in symbiosis with information technologies. Computer security is as important as protecting your apartment, industrial pipelines or your cooking skills. Computer security is a game of permanent chess. You are the main player on the board of “prevention”, “protection”, “detection” and “response”.
Prevention-wise, computer security requires you to be vigilant and careful when browsing the web and its dark corners, when faced with weird links, when opening (or not!) attachments on unsolicited emails or when logging into a computing service through dodgy sign-on pages. Making sure that you stay alert is one of the main reasons why we run our annual “clicking campaigns”. Getting you to identify malicious emails, attachments and links is the very first line of computer security at CERN. Having you report them to us is the last line of defence – detection – because such emails, attachments and links were able to slip through our detection mechanisms and be delivered to your mailboxes. Hence, while we are inundated by the reports, questions and tickets we receive in this regard, we deeply appreciate them! Since your message – you having identified and reported our (and other) emails as malicious – is our last line of defence. Every report is a human sign of detection. Social detection at its best. “Thank you, folks!” for obeying the mantra “STOP – THINK – DON’T CLICK”! and for reporting to us.
Prevention implies avoiding the introduction of vulnerabilities and bugs. Prevention by secure coding. Following best coding practices, making sure that secrets, passwords and other credentials are not exposed in any source code hosted on public software repositories or exposed directly by distributing the software. Preventing web applications from being exploited by properly filtering and sanitising any third-party input. And preventing the import of potentially malicious software by better controlling the supply chain. “Thank you, folks!” for programming safely and securely!
Finally, prevention also means keeping our software stack secure, up-to-date, patched and based on the skills and professionalism of the people running the many IT services at CERN – throughout the IT department, in FAP-BC, in EP-SFT and in the Controls group of the Beams department. Use their centrally managed provisioning, and you won’t need to worry about computer security yourself. They’ll do it for you. “Thank you, folks!” Computer security depends heavily on protection. It depends on the IT Network Engineering section, who have deployed a next-generation, highly sophisticated firewall. It depends on the IT Windows and Mac experts, who are readying a new – and free-for-you – anti-virus software solution (stay tuned here!). And it depends on the IT Identity and Access Management section, who are rolling out multi-factor authentication, requiring a hardware token like your smartphone or a USB dongle in addition to your password in order to better protect your account. “Thank you, folks!” for your tireless work for computer security. And a special “Thank you, folks!” to all the many volunteers who have already signed up for our two-factor pilot!
Response is what we want to avoid. Luckily, CERN is prepared with a qualified team of knowledgeable experts, the “Guys and Girls on Duty” (“Gods”) and the “Security Escalators”, who, day in and day out, run the computer security operations centre, react to its alerts, dig into details to understand the cause of a potential breach and try to answer all your questions related to computer security and beyond. “Thank you, folks!”
And, last but not least, these awareness articles in the CERN Bulletin would not be possible without the help of many more people: IT communications, the Translation service, the Bulletin editors. “Thank you, too, folks!”
As you can see, computer security is so much more than just cold IT – hardware and software. It’s in the commitment, vigilance, skills and professionalism of all of us. It’s sociological. Hence, once more, a hearty and sincere “Thank you, folks!” to all of you for helping us keep the Organization secure. This. Is. Really. Appreciated!
Do you want to learn more about computer security incidents and issues at CERN? Follow our Monthly Report. For further information, questions or help, check our website or contact us at Computer.Security@cern.ch.