Draft Context Document

In February, 1996, the Campus Network Committee recommended to the Senior Officers that the primary source of remote access to the campus networks from off-campus locations should be via a commercial dial-up modem pool operated by an Internet Service Provider (ISP). Based on this recommendation, the Senior Officers asked Communications Services to develop and issue a Request For Proposal for commercial dial-up modem and Internet access services, which was done. The vendor selected is GTE Intelligent Network Services.

Although commercial dial-up services are expected to provide the bulk of off-campus access, Communications Services continues to provide a public modem pool, which is available to campus members at no charge. However, the number of modems will not be increased. The public modems should therefore be viewed as a "safety net" service that provides access to UCSB hosts for those faculty, students and staff who are unable to afford or unwilling to use an ISP.

This modem pool currently consists of ninety-six 14.4 kbps modems and thirty-two 2.4 kbps modems. There is an RFP out to get bids for upgrading the 128 modems to 56Kbps modems. One time costs for purchasing the new modems are estimated at $86K. Annual recurring expense for equipment maintenance is estimated to be $8K/year. Annual recurring expense for the modem telephone lines is $35,600. The funding source for equipment acquisition has not yet been identified. The funding source of the recurring expenses is the telephone line Data/Networking Surcharge.

The demarcation point for the campus backbone is currently the Fiber Building Termination Panel (BTP), which is usually located in the basement of fiber connected buildings. There has been no campus responsibility assigned to the wiring and equipment that must exist between the BTP and a person’s desktop system in order for the person to be functionally on the network. There are at least 5 types of wiring media that are currently being used for intra-building wiring: Thick ethernet (10Base5), thin ethernet (10Base2), Category 3 UTP, Category 5 UTP, and Multimode Fiber. The current campus wiring standard specifies using Category 5 UTP which is capable of running Fast Ethernet (100Mb/s) to the desktop. The current UTP wiring standard is Category 5e and Category 6 is in the process of becoming a standard. In June 1999 the standard for 1000Base-T (IEEE 802.3ab Gigabit over Copper) was approved.

There are buildings that are not currently capable of running Fast Ethernet to the desktop (Geology, Music, Arts (Art Museum, Art Studio, History of Art and Architecture), Snidecor (Dramatic Art, Speech and Hearing Sciences, Math program), Noble Hall (Biology, Life Science Computing Facility), Bio II (Biology), Bio III, 407/408, 478, Pharmacology, Marine Bio (partial), Psychology.), and it is unproven whether existing Category 5 installations will be capable of running Gigabit over Copper.

Intra-building wiring maintenance and upgrades are currently occurring through the following funding mechanisms: Core Funding, Recharges, New Building Projects, Renovated Building Projects and Extramural Grants. There is at least $1.2M in intra-building wiring projects that currently do not have a funding source.

In fiscal year 98/99, 21 classrooms were added to the Classroom Data Network at an approximate cost of $89K funded by X. This brings the total number of general assignment classrooms that are on-line to 63. (IS THIS TRUE, ART?)

A paper presented to the CNC (Alternatives for Funding UCSB's Internet Connectivity and Networking Infrastructure, April 21, 1998) identified eight potential alternatives for funding networking projects. These alternatives were:

1. IP address charges (currently $11/system/year)
2. Data Networking Phone Surcharge (currently $9/phone/month)
3. Core funding
4. Assess a charge on each division or department based on number of FTE.
5. Charge each person accessing the Internet based on the number of packets (or bytes) transferred.
6. Reduce existing communications expenses charged to the campus by vendors (e.g., long distance calling charges), leave recharge rates at their current levels, and use the net increase in income to pay for Internet connectivity.
7. Generate a new or increased external source of revenue, by developing a program that will redirect faculty, staff or students personal payments for goods or services from an off-campus vendor to the campus.
8. Use a portion of the new student technology fee.

The Campus Network Programmers are the current contact point for computer intrusion events. The campus response to security events has been limited to reactive efforts after root compromise intrusions have occurred or systems have been used as sources for SPAM or for distribution sites for pirated software. Since most of the root compromise attacks have occurred using well known publicized holes, a more proactive effort is called for.

A new FTE with the following tools could address these problems:

1. 1 FTE – CNT III (Annual cost 45-63K for salary, and 10-14K for benefits)
2. 1 desktop and 1 laptop for FTE - $6K (amortized over 3 years)
3. Intrusion Detection Software ( $8-15K one time, Y annual maintenance & upgrades)
4. System to run Intrusion Detection Software - $3K (amortized over 3 years)
5. Software to proactively search for vulnerable systems (assume this runs on the FTE’s desktop.) ($6K one time, Y annual maintenance & upgrades)
6. Annual training classes for NT server & Unix, and annual conference attendance

The campus should make use of existing filtering capabilities available in backbone equipment. Currently Firewall software could only be effectively implemented at the edge of the FDDI backbone. The estimated costs for this would be $7K – 25K for the software license, Y for software maintenance and 6K for two Pentium II class systems to run it. Our assumption is that the firewall would be configured to let most everything through by default, but could be used to lock out attacks once they are discovered.

An office location has not been identified for this FTE.

The Directory Authentication and Authorization service is planned to consist of two mirrored servers running the Netscape LDAP server software. The estimated one-time cost for 25,000 entries is $107K, with a recurring annual cost of $27K. The estimated cost for 25,000 Authentication Certificates is a recurring annual cost of $125K. No estimates have been made for the hardware or staff costs for supporting this service.

This service consists of three basic components. The first is a mail server that processes electronic mail that is sent to in the form emailaddress@ucsb.edu and re-writes the To: field on the envelope to forward the mail message to another email address. The second is an interface that allows authenticated and validated users to specify their desired emailaddress@ucsb.edu and also their actual email address and then stores this information on the mail server. The third is an LDAP directory server that contains all Faculty, Staff and Student records.

The first two components have been developed and tested. Development of the campus LDAP Directory Service is in progress.

This service is provided to campus users for free by both IS&C and the Campus Network Programmers. No estimates have been made for the cost of providing this service.

This service is provided by Instructional Computing for both undergraduate and graduate students. The estimated annual cost of this service is X.

This service is provided by the Campus Network Programmers.

The ITPG estimates that it will cost $800K/year, assuming a 4 year replacement cycle, to maintain the existing 1244 campus-based workstations used by students.

The Data Warehouse contains financial transactions of all departments. It is available to all departments on campus. The yearly support costs are estimated to be $75K which is paid for by IS&C Core funds and recharges to other AIX users.