Med informatics survey (0:05) Julie what is the status? John Muir Hospital (0:15) Julie Julie contacts the hospital in Walnut Creek Debrief CMAD (0:30) Chris expand Julie's task to cover data-driven attacks (e.g. ActiveX, Java) does NT auditing provide all the data that we need? obtaining real audit data Meeting notes, monthly reports (0:05) Chris we've asked Cheryl to help us scribe our meetings. comments from Jim & Jennifer KDD (0:10) Steven continuation from last week Topics for next agenda (0:05) Brant move meeting to 4pm?
Med informatics survey (0:05) Julie
Nancy handed them out and Leah collected them. Steven will contact Leah.
Another med student was also conducting a computer usage survey. Brant will try to get the results of the that survey.
John Muir Hospital (0:15) Julie
julie handed out a marketing blurb from Xircom and Clinicomp. The John Miur Hospital in Walnut Creek hospital uses an on-line, wireless system to charting duties (e.g., vital signs, fluids, treatment) at the patient's bed-side. CliniComp provides Unix servers and the clinicians use toshiba slates. (Most likely, the slates run Pen for Windows 3.1.)
Julie will contact clinicomp and ask them for a list of clients that use NT, in healthcare. we want audit data. we want clients with information security awareness. Perhaps the vendor would use our research to improve their security features and improve the marketability of their products.
Debrief CMAD (0:30) Chris
Per converstation with Jennifer & Jim, we will change Julie's task to cover data-driven attacks (e.g. ActiveX, Java) and compromised software as the lower priority sub-task.
what is a data driven attack? The complexity of documents (data) (e.g., ActiveX, Java, Postscript, JavaScript, HTML) create opportunities for malicious attacks via "data-only" documents. Julie will delve into Java and ActiveX. Does a data-driven attack make long term changes to the victim? julie will check out Simpson Garfinkel www page.
Steven raised the question whether NT auditing provides all the data that we need? This launched a discussion of on-line v. off-line misuse detection algorithms. we defined an on-line misuse detection vs. off-line. The difficulties of off-line MD is that if insufficient information
Re: obtaining real audit data. we need to establish collaboration relationships well in advance of when we actually need the data. We anticipate needing audit data at the beginning of the summer research session. we will add on modules to NT systems to enhance the efficacy of NT built-in audit module.
Jennifer was glad that we had obtained the NT 3.5 evaluation report; kudos to Cheryl for placing the order.
Meeting notes, monthly reports (0:05) Chris
we've asked Cheryl to help us scribe our meetings.
comments may be forthcoming from Jim & Jennifer
KDD (0:10) Steven
postponed to future meeting.
Topics for next agenda (0:05) Brant