Georgia County Looks At Network Traffic

The message for employees working for Fulton County, Ga., is clear: The boss is monitoring the way you use technology that's paid for by taxpayers. That means no more inappropriate use of instant messaging or non-work-related activities such as downloading peer-to-peer file-sharing applications from the Web. The county's Department of Information Technology has just completed a network-security upgrade that gives it the ability to detect the amount of network resources being consumed by applications across the county's 5,500 PCs. The county is using a high-performance packet-processing applications server from CloudShield Technologies Inc. to monitor the network.

"We let people know there's no confidentiality with their messages and their department heads will be paying them a visit," says Rod Smith, the county's chief security officer. The county's network and PCs are public property, and any information moving through county information systems is available as an open record.

Use of instant messaging, radio broadcasts over the Web, and peer-to-peer file sharing apps such as Kazaa are not new to the county. But their proliferation had recently begun "eating up bandwidth that I'm purchasing with taxpayer dollars," says county CIO and IT director Robert Taylor. "We had a person going around all the time to clear up nothing but Kazaa downloads."

Not a good thing, particularly as Fulton County expands its E-government initiatives to provide its 886,000 residents with greater access to county records via the Web. One such Web-based application offers residents real-time information about the value of their property.

Rather than buying additional DS3 lines, which run at around 45 Mbps and cost about $8,000 per month, Taylor and his staff decided to make better use of the network's existing bandwidth. Making better use of an existing resource makes sense, he says, because his annual IT budget of $20 million hasn't grown much since 2000.Another impetus for implementing CloudShield was to improve security. The county's network was hit last October by a denial-of-service attack caused by the Welchia virus, an aggressive infection designed to exploit a software flaw in recent versions of Windows. Although the virus was contained, Smith says, the CloudShield server is being used to identify malicious behavior before it becomes a problem. "It lets us see the source address of a box trying to come into our network and who that box is trying to talk to," he says.

Fulton County installed the high-performance packet-processing applications server last December and earlier this month began upgrading it to more closely monitor network traffic. Fulton County runs apps for logging, identifying, and profiling the host computers communicating over the network; managing and enforcing the county's Instant Messenger policy; scaling up Cisco Systems' IOS-formatted access-control lists; and gaining visibility into traffic statistics, applications, and network flows.