1
00:00:05,910 --> 00:00:02,149
that sounds great and jody thanks very

2
00:00:09,589 --> 00:00:07,990
i'm here in building 4200 with jonathan

3
00:00:11,430 --> 00:00:09,599
pettis marshall's chief information

4
00:00:13,030 --> 00:00:11,440
officer and jonathan when we think about

5
00:00:14,789 --> 00:00:13,040
what your organization does we think

6
00:00:15,910 --> 00:00:14,799
about computers and email systems but

7
00:00:17,590 --> 00:00:15,920
you guys actually have your hands on a

8
00:00:18,950 --> 00:00:17,600
lot of things here at marshall we do we

9
00:00:20,870 --> 00:00:18,960
do those things that you mentioned we

10
00:00:22,630 --> 00:00:20,880
have twelve thousand over twelve

11
00:00:24,390 --> 00:00:22,640
thousand computers or desktop systems

12
00:00:25,830 --> 00:00:24,400
that are used by practically all the

13
00:00:27,990 --> 00:00:25,840
employees here at marshall space flight

14
00:00:29,669 --> 00:00:28,000
center in their daily jobs we're

15
00:00:31,109 --> 00:00:29,679
responsible for the local area network

16
00:00:32,389 --> 00:00:31,119
that connects all those computers

17
00:00:33,910 --> 00:00:32,399
together so that employees can

18
00:00:35,110 --> 00:00:33,920
collaborate and communicate with one

19
00:00:36,790 --> 00:00:35,120
another

20
00:00:38,310 --> 00:00:36,800
we're also responsible for some other

21
00:00:40,310 --> 00:00:38,320
services that are very important to the

22
00:00:42,470 --> 00:00:40,320
center for example what we call

23
00:00:44,229 --> 00:00:42,480
application services which are really

24
00:00:45,830 --> 00:00:44,239
software systems that run on those

25
00:00:47,990 --> 00:00:45,840
computers that

26
00:00:49,350 --> 00:00:48,000
accomplish various kinds of processes

27
00:00:51,110 --> 00:00:49,360
for different kinds of employees

28
00:00:53,990 --> 00:00:51,120
different people here in different areas

29
00:00:55,910 --> 00:00:54,000
for example software solutions that

30
00:00:57,830 --> 00:00:55,920
support the financial management process

31
00:00:59,750 --> 00:00:57,840
here at the center budgeting project

32
00:01:01,910 --> 00:00:59,760
management solutions and also

33
00:01:04,869 --> 00:01:01,920
engineering type solutions we have

34
00:01:06,550 --> 00:01:04,879
actually over 13 million lines of code

35
00:01:07,910 --> 00:01:06,560
in all these software systems that we

36
00:01:09,510 --> 00:01:07,920
support

37
00:01:10,630 --> 00:01:09,520
things like in the engineering area that

38
00:01:12,469 --> 00:01:10,640
i mentioned

39
00:01:14,149 --> 00:01:12,479
systems that capture the requirements

40
00:01:15,510 --> 00:01:14,159
for flight vehicles that we're

41
00:01:17,350 --> 00:01:15,520
developing launch systems that we're

42
00:01:19,590 --> 00:01:17,360
developing systems that are used by our

43
00:01:20,789 --> 00:01:19,600
engineers to design those particular

44
00:01:22,230 --> 00:01:20,799
solutions

45
00:01:24,070 --> 00:01:22,240
we have

46
00:01:25,910 --> 00:01:24,080
application developers or programmers

47
00:01:28,230 --> 00:01:25,920
who support scientists and things like

48
00:01:30,469 --> 00:01:28,240
lightning detection systems so it's

49
00:01:32,230 --> 00:01:30,479
really an integral part of what how the

50
00:01:34,230 --> 00:01:32,240
work gets done here at the center and

51
00:01:35,670 --> 00:01:34,240
you also work on things agency-wide we

52
00:01:38,069 --> 00:01:35,680
do a lot of people are not familiar with

53
00:01:39,510 --> 00:01:38,079
those services that we provide here but

54
00:01:41,190 --> 00:01:39,520
from huntsville here at marshall space

55
00:01:43,190 --> 00:01:41,200
flight center we provide all the wide

56
00:01:45,270 --> 00:01:43,200
area network services that are services

57
00:01:47,109 --> 00:01:45,280
that are used to connect the centers

58
00:01:49,429 --> 00:01:47,119
together and so employees all across the

59
00:01:51,190 --> 00:01:49,439
agency who are working together

60
00:01:53,270 --> 00:01:51,200
to collaborate to work together on

61
00:01:54,789 --> 00:01:53,280
nasa's mission are using that wide area

62
00:01:56,149 --> 00:01:54,799
network when they're using their i.t

63
00:01:58,389 --> 00:01:56,159
systems

64
00:02:01,030 --> 00:01:58,399
also we provide a set of business

65
00:02:03,270 --> 00:02:01,040
applications that the agency uses to

66
00:02:05,190 --> 00:02:03,280
manage its finances to manage its

67
00:02:06,870 --> 00:02:05,200
procurement acquisition processes those

68
00:02:09,270 --> 00:02:06,880
systems were implemented and are managed

69
00:02:11,350 --> 00:02:09,280
here out of marshall and you also

70
00:02:13,190 --> 00:02:11,360
mentioned the i t systems but you guys

71
00:02:15,430 --> 00:02:13,200
protect our information here at marshall

72
00:02:17,589 --> 00:02:15,440
with that right we do and that's a major

73
00:02:19,510 --> 00:02:17,599
focus area for us today there's a lot of

74
00:02:21,430 --> 00:02:19,520
visibility on how well we protect our

75
00:02:22,869 --> 00:02:21,440
information from the federal government

76
00:02:25,350 --> 00:02:22,879
across the board

77
00:02:27,670 --> 00:02:25,360
here at marshall we really are focusing

78
00:02:29,589 --> 00:02:27,680
on how to ensure that people understand

79
00:02:31,430 --> 00:02:29,599
the kinds of information that they store

80
00:02:33,190 --> 00:02:31,440
and use in their systems and what are

81
00:02:35,350 --> 00:02:33,200
the appropriate mechanisms to protect

82
00:02:37,750 --> 00:02:35,360
that information we actually do a lot in

83
00:02:39,350 --> 00:02:37,760
terms of safeguarding our information as

84
00:02:41,350 --> 00:02:39,360
far as threats that may come into the

85
00:02:44,309 --> 00:02:41,360
center we have a facility where we

86
00:02:46,150 --> 00:02:44,319
monitor all of the potential threats

87
00:02:48,470 --> 00:02:46,160
that can occur from an external

88
00:02:50,869 --> 00:02:48,480
perspective into our center well can we

89
00:02:53,190 --> 00:02:50,879
go check that out you can

90
00:02:55,110 --> 00:02:53,200
and i did finish my i.t security

91
00:02:57,430 --> 00:02:55,120
training just so we own it

92
00:02:59,190 --> 00:02:57,440
we're at building 4629 and are joined by

93
00:03:00,710 --> 00:02:59,200
david black who's the manager of i.t

94
00:03:02,470 --> 00:03:00,720
security here at marshall and he's

95
00:03:04,309 --> 00:03:02,480
giving us a behind-the-scenes look

96
00:03:06,390 --> 00:03:04,319
starting with well this room what goes

97
00:03:08,710 --> 00:03:06,400
on here this is the information mission

98
00:03:10,470 --> 00:03:08,720
control center for the agency we monitor

99
00:03:12,309 --> 00:03:10,480
the entire wide area network for

100
00:03:14,229 --> 00:03:12,319
security issues that might be happening

101
00:03:16,550 --> 00:03:14,239
at the various centers if something is

102
00:03:18,949 --> 00:03:16,560
identified that may be a security threat

103
00:03:20,550 --> 00:03:18,959
then this room here will notify the iot

104
00:03:21,990 --> 00:03:20,560
security manager at that center so that

105
00:03:23,830 --> 00:03:22,000
we can take action

106
00:03:25,589 --> 00:03:23,840
if we're notified of a threat here at

107
00:03:27,430 --> 00:03:25,599
marshall then as the iot security

108
00:03:28,790 --> 00:03:27,440
manager our incident response team here

109
00:03:30,550 --> 00:03:28,800
will respond

110
00:03:32,630 --> 00:03:30,560
analyze the threat and decide what needs

111
00:03:34,710 --> 00:03:32,640
to be done to protect the center and be

112
00:03:36,229 --> 00:03:34,720
sure that all the resources here are

113
00:03:37,589 --> 00:03:36,239
properly protected

114
00:03:39,190 --> 00:03:37,599
let's start with what kind of things you

115
00:03:40,390 --> 00:03:39,200
look for here

116
00:03:42,390 --> 00:03:40,400
well they're looking for any kind of

117
00:03:44,070 --> 00:03:42,400
traffic that would indicate some type of

118
00:03:45,750 --> 00:03:44,080
problem either on the internal network

119
00:03:47,190 --> 00:03:45,760
or from the outside it could be an

120
00:03:49,270 --> 00:03:47,200
outsider threat trying to get in and

121
00:03:51,750 --> 00:03:49,280
break in and you know get access to some

122
00:03:54,149 --> 00:03:51,760
of our systems unauthorized access it

123
00:03:56,070 --> 00:03:54,159
could be a policy violation by some user

124
00:03:57,990 --> 00:03:56,080
on our network doing some type of

125
00:04:00,390 --> 00:03:58,000
activity that's not that's prohibited

126
00:04:02,390 --> 00:04:00,400
and therefore will you know indicate

127
00:04:03,830 --> 00:04:02,400
on our sensors here that uh it's it's

128
00:04:05,910 --> 00:04:03,840
against policy and we'll have to take

129
00:04:07,589 --> 00:04:05,920
action based on that if it ends up being

130
00:04:09,270 --> 00:04:07,599
a policy violation then a lot of times

131
00:04:11,830 --> 00:04:09,280
we'll have to do computer forensics on

132
00:04:13,030 --> 00:04:11,840
those boxes to see exactly what happened

133
00:04:14,869 --> 00:04:13,040
document it and see what kind of

134
00:04:16,789 --> 00:04:14,879
recovery needs to be done and any

135
00:04:18,550 --> 00:04:16,799
improvements in security to prevent that

136
00:04:19,990 --> 00:04:18,560
from happening again well you touched on

137
00:04:22,390 --> 00:04:20,000
something that i think we need to follow

138
00:04:23,990 --> 00:04:22,400
up on next is that i t security is more

139
00:04:25,430 --> 00:04:24,000
than what happens in this room what

140
00:04:27,110 --> 00:04:25,440
other types of things do you guys work

141
00:04:29,110 --> 00:04:27,120
on that's correct the stuff that happens

142
00:04:31,350 --> 00:04:29,120
in this room is mostly reactionary in

143
00:04:33,030 --> 00:04:31,360
other words after the fact we do the

144
00:04:35,110 --> 00:04:33,040
entire program here at the center for

145
00:04:36,710 --> 00:04:35,120
i.t security covers

146
00:04:39,030 --> 00:04:36,720
from the beginning when you're creating

147
00:04:40,390 --> 00:04:39,040
a new i.t system

148
00:04:41,990 --> 00:04:40,400
what type of information you're going to

149
00:04:43,430 --> 00:04:42,000
have on it we assist in figuring out

150
00:04:45,510 --> 00:04:43,440
what kind of type of security you need

151
00:04:48,230 --> 00:04:45,520
to protect that information all the way

152
00:04:50,390 --> 00:04:48,240
to authorizing that system to operate

153
00:04:52,550 --> 00:04:50,400
at that point we provide other services

154
00:04:54,710 --> 00:04:52,560
like being sure that the patches are

155
00:04:56,870 --> 00:04:54,720
properly installed on those systems we

156
00:04:58,070 --> 00:04:56,880
have metrics that we track in all areas

157
00:05:00,150 --> 00:04:58,080
of the program to be sure that our

158
00:05:02,070 --> 00:05:00,160
program is effective we coordinate

159
00:05:03,590 --> 00:05:02,080
audits and assessments to ensure that

160
00:05:05,110 --> 00:05:03,600
the program is being effective and

161
00:05:06,629 --> 00:05:05,120
healthy at the center and across the

162
00:05:08,230 --> 00:05:06,639
agency

163
00:05:10,230 --> 00:05:08,240
and of course we do i.t security

164
00:05:11,990 --> 00:05:10,240
training too and that includes the

165
00:05:13,909 --> 00:05:12,000
annual i.t security awareness training

166
00:05:16,310 --> 00:05:13,919
that's mandatory that lori mentioned

167
00:05:18,310 --> 00:05:16,320
earlier i think yeah i have to take mine

168
00:05:21,029 --> 00:05:18,320
but uh how did lori do on that in fact

169
00:05:23,110 --> 00:05:21,039
well i was looking at that bill and uh

170
00:05:24,310 --> 00:05:23,120
she actually didn't do too well i'm not

171
00:05:28,390 --> 00:05:24,320
sure we're going to be able to pass her

172
00:05:31,590 --> 00:05:29,909
well bill that motor test at night was

173
00:05:32,950 --> 00:05:31,600
just incredible and i didn't know the

174
00:05:34,390 --> 00:05:32,960
office of the cio covered so many

175
00:05:35,909 --> 00:05:34,400
different areas but we'll be visiting

176
00:05:37,510 --> 00:05:35,919
more of those areas in future editions

177
00:05:38,710 --> 00:05:37,520
of the program hey what do you say about

178
00:05:40,150 --> 00:05:38,720
my test

179
00:05:42,230 --> 00:05:40,160
we'll see you next time as we focus on

180
00:05:44,390 --> 00:05:42,240
marshall i can't tell you tell me no i