It’s not exactly secret, but it might as well be — a former nuclear shelter has become an operations centre for Symantec, the world’s largest internet security vendor. If there is a war in cyberspace, then this is the frontline.
The location — an underground bunker in a field close to the village of Twyford, Hampshire — is up a single-track lane, on land once owned by Southern Water, which still operates a reservoir nearby. The bunker, designed to house 30 people for 60 days, is a relic of Cold War politics. Construction began in 1988 and was completed in 2000, but with the fall of the Soviet empire it was deemed surplus to requirements, and was decommissioned only a year later.
The Cold War is over, but visitors to the bunker can see that the war against the activities of malicious hackers and organised crime on the internet is still in full swing.
Symantec thinks a bunker that can survive most forms of bomb attack is an ideal location from which to run its European Security Operations Centre (SOC). This plays a vital part in the company’s global monitoring services, as well as supporting its European managed services customers.
You enter the bunker through a grass-covered entrance and are then ushered through an isolation chamber, which used to house showers for decontamination. The mechanics of isolationist survival are all around — air vents for filtering air, a chute for ejecting people from the building in an emergency and independent power and water supplies.
The heart of the bunker is an underground room holding about six security analysts — part of a team of 25 staff. They sit in rows rather like a smaller version of the rows of Nasa scientists seen during televised space missions. Each analyst works a 12-hour shift, starting at 7am or 7pm. They sit at two screens used for research, monitoring and internal and external communications. The screens give an overview of current vulnerabilities, and also a newsfeed that provides relevant topical or political stories.
The only sign of the world outside is a widescreen TV at the front of the room, which shows a CCTV image of the car park on top of the bunker.
The analysts — mostly IT security specialists, former academics and military personnel — measure their success in terms of ”kills”: the number of times they spot a new form of malicious code and protect customers before any damage is done.
”On a typical day, we are monitoring what’s happening on the internet, watching ‘bot’ networks, looking at hacker newsgroups, instant messaging to colleagues to share information, looking at government websites, and looking at activity on customer networks. Every analyst has their own favourite sources,” says Symantec’s Mark Onley, operations supervisor security analysis.
Symantec sees ”botnets” as a growing threat. They are created by bots (short for robot software) covertly installed on target systems, often home PCs running Microsoft Windows. An unauthorised user then remotely controls these devices for a variety of malicious purposes, such as spamming and mounting denial of service attacks on e-commerce sites.
The analysts also monitor events on customer networks, using automated logs sent from customer equipment, such as firewalls and intrusion detection systems. The analysts then recommend the best course of action (in the case of monitored customers) or take action on the customer’s behalf (for managed customers).
They have their work cut out looking out for all manner of viruses, worms, Trojan horses, blended threats, and various forms of malicious e-mail. They also watch for misuse of a customer’s resources, such as downloading porn or illegal database access.
In a typical week, about 48 new vulnerabilities are tracked, and analysts’ actions will be impacted by what is known as the ThreatCon rating. This varies from a normal day (rating one) to internet meltdown (rating four).
”The good news is the virus attacks are on the decline, but the bad news is we are seeing a growing amount of malicious attacks that seek to extract funds from victims or companies,” says Jeff Ogden, Symantec’s head of managed security services. ”The so-called phishing emails and e-commerce website attacks are classic examples.”
One of the most serious concerns is that the botnets are getting increasingly sophisticated and dispersed, so locating the main source is extremely difficult. Malicious pop-ups posing as advertising and viruses being sent to mobile devices are also of increasing concern, says Ogden.
With more than 20 000 sensors in 80 countries monitoring internet activity, there is no shortage of data to analyse, and it looks unlikely that this former nuclear bunker will be decommissioned for some time. – Guardian Unlimited Â