Do not post this contact information with the publicly accessible BSP.

• Dennis Taylor
  Director, SEWPSC
  QSS Group Inc.
  Goddard Space Flight Center, Code 295.3
  Greenbelt, MD. 20771
  Telephone No. 301-286-4290
  Fax No. 301-286-4549
  E-mail – dtaylor@sewp.nasa.gov

Alternate:

• Dave Heimann
  SEWP Information Systems Manager
  QSS Group Inc.
  Same Address information as Dennis Taylor (above)
  Telephone No. 301-286-8656
  E-mail – dave@sewp.nasa.go

• NASA Procedures and Guidelines (NPG) 2810.1, Security of Information Technology applies to all NASA employees and NASA contracts (as provided by the terms and conditions of the contract), where appropriate in achieving Agency missions, programs, projects, and institutional requirements.
  
  • Section 4.11.1 Guidance for Using Encryption Technology discusses the risk of relying solely on user-password authentication and that use of encryption technology must be considered when doing risk assessments of IT systems.
  • Appendix A.6.3.8 Password Distribution requires that management give passwords "reasonable protection from unauthorized disclosure.”

POP mail, which is often the mail server for Eudora and Outlook clients, historically uses an insecure protocol. The mail password is transmitted between client and mail server in clear text. This password may also be (and typically is) a Unix account password, which could lead directly to an account compromise on the mail server.

Travelers and home workers are especially vulnerable since they send their passwords across the open Internet. The NASA SEWP Security Center has posted a short “How To” white paper.

For the technically inclined, this paper provides a brief technical overview of how SSH TCP port forwarding works at Internet nodes.

However, the bulk of the paper provides step-by-step directions, illustrated by screen-shots, for implementing SSH on Eudora and Outlook clients. The examples use the Tera Term freeware SSH application for illustration; however, the principles are easily applicable to other SSH applications.

The references section at the end of the document provides links for obtaining an SSH client.

See the white paper referenced in Section 3.1, above.

Software costs range from $0 for a freeware SSH client to around $100 for a fully supported commercial version.

A computer-literate end user can work through the step-by-step instructions in the NASA SEWP white paper in less than half an hour. An IT support professional should be able to set up a machine in just a few minutes.

• SSH: http://www.openssh.org
• Tera Term (version 2.3 used in example): http://hp.vector.co.jp/authors/VA002416/teraterm.html
• TTSSH – an SSH extension to Tera Term (version 1.5.4 used in example): http://www.zip.com.au/~roca/ttssh.html
• SSH Communications Security, Inc secure shell protocol application (commercial version 2; cost approx. $99 per desktop): http://www.ssh.com/products/ssh

Note: A computer-literate end user can work through the step-by-step instructions for installing these applications in less than half an hour. An IT support professional should be able to set up a machine in just a few minutes.

• http://www.openssh.org/
• For those wanting more technical detail, the O’Reilly Press book: SSH, the Secure Shell: The Definitive Guide by Daniel Barrett and Richard Silverman is a good bet.