NASA Network Faulted For Security Gaps

WASHINGTON -- Hackers have been breaking into an unclassified worldwide computer network that contains data on research in the space and earth sciences. So far the 100,000 scientists who are linked to the Space Physics Analysis Network (SPAN) are lucky: The unauthorized access hasn't been malicious, and no files have been altered. But a recent government report to Congress chides NASA for not doing enough to protect the integrity of the system. It takes the agency to task for its failure to conduct a thorough analysis of the potential risks to the data in the system. In response, NASA officials say that they are worried any preventive measures could be worse than the disease. Restrictions on users, they say, could rob the network of the accessibility that has made it so convenient for scientists. The dispute is one aspect of the larger issue of whether the access that computer users have traditionally enjoyed is now jeopardized. It seems that some of the information on such networks is so valuable that there are persons who will break the rules to obtain it. "NASA is in an awkward situation," says Ron Beers of the General Accounting Office (GAO), whose report to Rep. Robert Roe (D-N.J.), chairman of the House Science, Space, and Technology Committee, was released shortly before Christmas ("Computer Security: Unauthorized Access to a NASA Scientific Network," GAO/IMTEC-90-2). "They have created an effective system that has strong benefits for the scientific community. "But the environment has changed from the days when physical security was the top priority and data security was secondary," Beers continues. "There are people out there who want to get into SPAN - and the other systems that are connected to it - and it's difficult for NASA to enforce security at every site that has access to SPAN." NASA, for its part, believes that the best approach is to make it clear that attempts to gain unauthorized access will lead to the arrest and prosecution of those responsible. According to the scientist in charge of SPAN, that commitment has been demonstrated repeatedly over the past several years. In fact, explains James Green, SPAN project scientist and head of the National Space Science Data Center at NASA's Goddard Space Flight Center in Greenbelt, Md., that high profile may have even triggered congressional interest in the issue. "SPAN is the only open wide-area network which investigates every reported security incident, turning it over to other government agencies for help when needed," says Green. "The clear message is that, if one is going to hack on SPAN, he will eventually be caught. For the naive, an easy conclusion is that something must be very wrong with SPAN, since there are not as many reported security incidents with other government-wide area networks. Based on SPAN's aggressive security activities and reporting procedures starting in 1984, it was inevitable that Congress would want to know what is going on." SPAN was created in 1981 by NASA to link researchers from around the world. It's become an easy way for scientists to connect to other computers, to send electronic mail messages, and to copy and transmit data long before they would be available in the open literature. Says one astrophysicist at Goddard, "SPAN is designed to make it easy for me to get into computers around the world. On my project, I depend on up-to-date data, and it's a tremendous advantage to share ideas, make queries, and obtain other material as soon as somebody puts it into the system." But concern about the growing number of incidents involving computer viruses led Roe to ask Congress's GAO to find out if SPAN was protected from such attacks. And the answer, says GAO, is no. In fact, according to the report, NASA's own record-keeping system recorded 67 cases of unauthorized access during the period between January 1988 and March 1989. The GAO report notes that one reason for the frequency of attacks is that SPAN also offers easy access to unclassified computer networks in other government agencies. And it says that NASA may be forced to restrict this feature, which is highly desirable for legitimate users, for the sake of shielding the data from prying electronic eyes. Before it acts, however, the GAO says NASA should conduct a security risk analysis to pinpoint where the system is vulnerable. "Suppose a SPAN user at university X taps into the system and is connected with the Johnson Space Center," explains Beers. "And suppose he figures out how to bypass the files he is pointed to and taps into another database. Could he cause significant damage to that system if he tried to change it? And what's that information worth? That's what we think NASA should be trying to find out." It appears that the GAO report may have spurred NASA into action. Although Green says that "no formal guidelines exist at present for doing a formal risk analysis on an open wide-area computer network" such as SPAN, he notes that NASA began working on a risk analysis plan shortly after it received a draft of the GAO report last fall. Such a plan is now on file at Goddard. "This plan serves to document all SPAN security activities, provides an extensive list of where SPAN vulnerabilities exist, and what is being done about them," Green says. "Due to the nature of this document, however, its distribution is severely restricted." A House science committee aide says that Roe hasn't decided whether to pursue the matter. "He's still very interested in it, and he's concerned about the potential damage that someone could cause," the aide notes.

NASA Network Faulted For Security Gaps

Interested in reading more?

Become a Member of