Agenda for Misuse Detection Project Meeting: Monday 03-Feb-97, 12-2pm

Select a timekeeper.
Reminder about the CNY dinner on Friday.

Monthly reports (0:15)
   Chris faxed Dec report & financials to Jennifer on 2/3/97
   January in preparation.
   talked to Jennifer this AM.
   Reschedule meeting on 10th; julie has a job interview.
    Windows NT seminar offer from New Boston Systems.

Installation of machines. (0:10)

Ethics surrounding Misuse detection technology (0:10)

Healtheon letter. (0:05)

NT Vulnerabilities report (0:20) 

Topics for next agenda (0:05)


03-Feb-97 Meeting Notes

Attendees: Steven Templeton, Chris, Julie, Brant
Notes taken by Chris Wee
Meeting began @ 12:10pm and ended @ 1:30pm
Julie was the timekeeper

Monthly reports (0:15)
    Chris faxed Dec report & financials to Jennifer on 2/3/97
    Meeting rescheduled to 10am-12pm on 10th Feb.
    All 4 of us are interested in the
    Windows NT seminar offer from New Boston Systems. Chris will
    contact Jabri and schedule it within the next 6 weeks.
    Furthermore, Steven has found a tutorial on data mining in March.
    He will bring further details.

Installation of machines. (0:10)
Both Brant and Julie have installed NT. However, the printer
sub-system does not work for both installations; different reasons.
Julie's install left too little space on HD (20MB) for any
useful work. She will purchase an additional HD rather than
waste time repartitioning existing one. approx $200.

Ethics surrounding Misuse detection technology (0:10)
We discussed how technology may be neutral and will regularly discuss
how misuse detection technology can be used to benefit both
centralized monitoring (aka Big Brother) and improve user security
(privacy, integrity etc.)

Healtheon letter. (0:05)

NT Vulnerabilities report (0:20) 
Brant described how he tried to activate NT bas auditing. Brant
modified the registery per the instructions in the NT paper.
However, no audit logging was observed. Chris suggests
measuring performance, before, during, and after to compare the
performance impact upon the system. This provides an indirect
indication of whether base object auditing is occuring. A direct
indication would be preferable, but w/o propiertary information about
T auditing, cannot be done.

Topics for next agenda (0:05)
	Equipment issues
		HD for julie
		HD for notebook
		Backup
		Insurance
		more RAM for Gateway (32MB)
		Network Card (keep or return?)
	Auditing base objects in NT 4.0
	NT seminar
	KDD talk
	Julie's thesis proposal
	Healtheon letter