Network Citizenship

Revised January 2004

Purpose

The UCSB Hostmaster is charged with the maintenance and administration of the campus network space, and as such must ensure the proper operation and security of systems attached to the campus network. The requirements and processes in this document are intended to describe the minimum network administration responsibilities that accompany the delegation of subnets within the campus network space.

Background

"The Internet is a co-operative endeavor, and its usefulness depends on reasonable behavior from every user, host and router in the Internet. It follows that people in charge of the components of the Internet must be aware of their responsibilities and attentive to local conditions."

The above statement was written in 1990 in an Internet Engineering Task Force Request For Comments (RFC) describing the basic responsibilities of network managers. In the intervening years, changes in technology, in the way the network is used and abused, and in the legal obligations of those providing network services have created a growing set of challenges to the successful maintenance of an effective Internet. For the UCSB campus data network to be able to meet institutional goals and responsibilities, the following issues must be addressed:

1. The security and integrity of the campus network must be maintained. In addition to the efforts required for normal operation, there is an increased need to address the effects of viruses, worms, and other security exploits, both to minimize their disruptive effects and to limit institutional legal liability.
2. Access to campus network resources needs to be controllable based on the usage and licensing requirements of those services.
3. The source of network traffic must be identifiable (both the source system and the person responsible for that system) to be able to appropriately respond to security compromises and other problems, in addition to limiting institutional liability.

Requirements

To address the above issues, the following requirements and processes will be implemented.

1. All network address allocations ("Subnets"), including existing allocations, are subject to the following conditions.
   1. Network address space allocations are made based upon the request of a department and with consideration of all relevant technical issues, including utilization of allocated space.
   2. The unit requesting the subnet must propose a Network Administrator, authorized and capable of acting in accordance with the requirements described below. Note, in cases of emergency, a Network Administrator may be required to be available during non-standard working hours. (See 2.b.)
   3. Proposed Network Administrators are subject to Hostmaster approval based upon an evaluation of his/her ability to ensure implementation of the requirements.
   4. A network may be without a Network Administrator for up to sixty days during a staffing transition, with further extension subject to approval. In those instances where the Network Administrator responsibilities are not assigned within a timely manner, the subnet allocation may be revoked in accordance with section 4 below.

2. Network Administrator responsibilities include:
   1. Sole accountability and responsibility for the operation of the subnet and its attached systems.
   2. Serving as interface between the unit, network users, and the campus network administration, including campus Hostmasters, Network Security Coordinator, and Network Operations Center staff. As the point of contact for networking issues, routine availability of the Network Administrator can have an impact on the function and availability of a network. This is particularly true under abnormal circumstances, such as a compromised or infected system.
   3. Designating secondary contacts for the subnet. Secondary contacts are optional and may have specific roles, such as security, desktop support, etc., and are recommended to ensure ongoing support when the Network Administrator is not available. Secondary contacts do not obviate the Network Administrator's responsibilities under 2.a above.
   4. Identifying and correcting known vulnerabilities in a timely manner.
   5. Denying network connections to individual systems or devices based upon:
      • Inadequate support.
      • Existing vulnerabilities.
      • Known compromise(s). Connections may remain online as required for investigation by law enforcement or the campus Network Security Coordinator.
      • To maintain proper operation and security of other systems.
      • Other incompatibility with the requirements of this document.
   6. Providing to campus Network Security personnel the specific source system and responsible individual for network traffic observed on the campus backbone, given a date, time, Internet Protocol address, and port number. Identification of source systems must be possible for one month after traffic was sent.
      • This has significant implications for use of wireless or NAT, as such systems frequently lack sufficient accounting as required by this section. As with any system, the Network Administrator may deem these systems unsupportable, and thus prohibited from deployment on the network in accordance with 2.e above.
      • Data collection performed in an attempt to comply with this requirement must be conducted in accordance with UC policies and law. In particular, the Electronic Communications Policy (see 2.h below) should be read and understood by the Network Administrator. Data collection can only be performed to ensure proper operation and security of the network, must be as least intrusive as possible, should be destroyed as soon as possible consistent with administrative responsibilities, and packet contents should be avoided unless clearly and specifically necessary to the forgoing purposes.
      • Hostmaster may reduce the requirements of this clause (f) for specific systems for a limited duration based upon an evaluation of the risks associated with a well-defined implementation.
   7. Maintaining knowledge of all attached systems and the services they support.
   8. Maintaining knowledge of relevant policies, including the U.C. Electronic Communications Policy and SB1386 implementation guidelines. Knowledge of IS-3 is encouraged but not required.
      • University of California Electronic Communications Policy
      • UCSB Interim Electronic Communications Implementing Guidelines 5612 (pdf)
      • SB 1386 and AB 1298 Guideline
      • University of California Electronic Information Security (pdf)
   9. Ensuring compliance with system requirements described in section 3 below.
   10. Notifying the Network Security Coordinator, security@ucsb.edu, in the event of a known or suspected system compromise.
   11. Notifying Hostmaster in the event the Network Administrator is incapable of fulfilling their responsibilities for any reason.

3. Systems attached to the network must not:
   1. Provide unrestricted anonymous access to the UCSB network or Internet.
   2. Provide open proxies or open SMTP relays. SMTP relays may be open to traffic originating from campus networks, with authenticated relaying for non-campus networks.

4. Network allocations may be revoked due to failure to meet these requirements. This would clearly be a significant and disruptive action, and would not be undertaken without first providing written notice to the department's control point, department chair and/or MSO or equivalent. It is the explicit objective to seek correction of deficient network administration rather than disconnection, but disconnection is the only alternative in the absence of routine and responsive maintenance and administration of networked systems.

Updates

The above requirements are subject to change. Should changes occur, reasonable efforts will be made to notify Network Administrators of said changes, and continued use of campus network resources constitutes agreement to comply with the revised requirements.

KPS