CalNetAD Planning Committee

May 17, 2005

2195 Hearst, 200C Conference Room, 1-2:00 PM

Updated: 05/18/2005

Agenda

1. Windows 2003 SP1 Plan and Schedule (John Weber)

2. Encrypted File Services (John Weber)

3. Synchronization of new attributes (Karl Grose)

4. Other Business

Notes

Windows 2003 SP1 Plan and Schedule

John discussed his testing of SP1. Two problems were discovered: 1) the permissions required by the service account for Windows Time keeping were not set properly and 2) authentication for Remote Desktop was broken. Correcting the permissions took care of the first problem. Microsoft has published a KB article for a workaround to the second problem. John plans to finish testing my May 31. Implementation in production will be staggered. A schedule will be published in the CalNetAD Change Management System.

Encrypted File Services

John gave an PowerPoint presentation about the abilities and dangers of EFS. There was a good discussion of Microsoft's Key Archival and Data Recovery Agent (DRA) features.

Some of the points that were raised were:

• PKI policies should followthe decentralized trust model in use at Berkeley
• Should there be an opt out policy for key escrow (if that is even technically posible)
• Procedures need to be in place to verify the authority of individuals attempting to recover a key
• Encryption policies must take into account non-university owned data
• Many laptops that have the need to encrypt the data on them are not members of CalNetAD
• Departments need more information about securing data and the advantages and disadvantages of encryption.

It was agreed to refer this subject to the Security Subcommittee for futher discussion and to develop proposals for submission to the Campus Information Security Committee (CISC).

Synchronization of new attributes

Karl reported that the new Java Messaging Service (JMS)-based synchroniztion process has been very stable and reliable. The next step in the service will be to implement High Availability (HA) infrastructure. He asked for input from the committee for additional attributes that could be synchronized between the CalNet and CalNetAD directories.

Other Business

Next meeting to be held in three months.