Water Resources Division ITAC Home Page

ITAC - Nevada Meeting, action item #3

-- following is the email/memo drafted by Mike Slifer from ITAC to the GIO Leadership Team describing the requirements statement, including target list of sites and the ITAC pros and cons for Active Directory Service.

The Water Resources Discipline's Information Technology Advisory Committee (ITAC) met in Carson City, Nevada, January 15-17, 2002. Most of the first day was devoted to gaining a better understanding of the proposed deployment of a single-domain Windows Active Directory Services (ADS) model for all USGS offices. We reviewed concerns and alternatives related to the proposed single-domain model. ITAC accepts that ADS deployment will occur in WRD cost centers, whether the single domain model is ultimately coordinated across all USGS cost centers or whether multiple domains are deployed autonomously--and uniquely--in each cost center.

ITAC views the GIO Leadership Team as the decision-making authority to whom advisory groups, including the ADS Implementation Team, will make their recommendations. Therefore, ITAC requests that you take the following points into consideration as you make decisions:

1. Use an RFC Process

Utilize a request for comment (RFC) process into your information-gathering/decision-making process. In particular, proposed deployment initiatives--and even proposed policies--should be provided to grass-roots constituents. In the case of ADS implementation, constituents include the computer support staff at each cost center.

2. Define Control and Roles

The cost center computer support staff role needs to be better defined relative to Bureau support staff in the case of ADS implementation, and a clear management chain of command established.

3. Recognize Security Vulnerability

USGS should assume that ADS can and will be hacked. The implication is that the accounts and passwords should be considered vulnerable and security should be planned accordingly. ITAC feels that the proposed Bureau-wide, single domain model poses a significant security vulnerability. We feel that the multi-domain model would reduce the likelihood of a hacker gaining access to all Bureau accounts and passwords. Implementation of either model should fully involve Bureau and Discipline security experts, so that the best known security practices are employed.

Concerning WRD acceptance of the proposed single domain model for Bureau-wide implementation of ADS, ITAC provides the following requirements on behalf of WRD Senior Staff.

1. An adequately funded support staff must be established, before Bureau-wide ADS implementation begins.



2. The ADS design must provide reliable service to all USGS staff and cooperators. At a minimum, and funded as part of the Bureau's implementation, each WRD district office and all larger subdistrict offices require a domain controller (see the attached list). Each district reserves the option to deploy, at its own expense, additional domain controllers as warranted.



3. An opportunity to review an updated cost/benefit analysis and implementation plan to include the increased number of ADS domain controllers in WRD (and the Bureau, if applicable).



4. An opportunity to review test results to determine the impact of the increased number of ADS domain controllers on the network capacity and performance.



5. An opportunity to evaluate the updated Bureau-wide ADS cost/benefit analysis and implementation plan in relative priority to other IT needs in WRD and the Bureau.



6. Training for local Windows administrator at each location where an ADS domain controller is installed.

Attachment

List of WRD Offices that require an Active Directory domain server:

1. Montgomery, AL
2. Anchorage, AK
3. Flagstaff, AZ
4. Tuscon, AZ
5. Little Rock, AR
6. Menlo Park, CA
7. Sacremento, CA
8. San Diego, CA
9. Arvada, CO
10. Lakewood, CO
11. East Hartford, CT
12. Dover, DE
13. Altamonte Springs, FL
14. Miami, FL
15. Ocala, FL
16. Tallahassee, FL
17. Tampa, FL
18. Atlanta, GA
19. Norcross, GA
20. Honolulu, HI
21. Boise, ID
22. Urbana, IL
23. Indianapolis, IN
24. Iowa City, IA
25. Lawrence, KS
26. Louisville, KY
27. Baton Rouge, LA
28. Northborough, MA
29. Baltimore, MD
30. Augusta, ME
31. Lansing, MI
32. Mounds View, MN
33. Bay St. Louis, MS
34. Pearl, MS
35. Rolla, MO
36. Helena, MT
37. Lincoln, NE
38. Carson City, NV
39. Las Vegas, NV
40. Pembroke, NH
41. West Treton, NJ
42. Albuquerque, NM
43. Troy, NY
44. Raleigh, NC

Address questions or comments to Charles Merk, ITAC Secretary cfmerk on (703) 648-5680