Hackers probed firewalls in search of ports they could exploit to get onto the Salt Lake network, and scanned for IP addresses, says Lee Robertson, the Games' chief of IT security and principal security consultant at Schlumberger Network Solutions. Hackers typically used hijacked, legitimate IP addresses to cover their tracks and grab e-mail messages they hoped would give them intelligence about the network. They tried using standard access methods--telnet and SSH, for example--to get to the firewall's management interface or to an IDS (intrusion-detection system) box on the Olympic network, Robertson says. But they got no further than the external firewall.

When a hacker actually opened a firewall port, the action triggered alarms in the network's firewall logs and IDS probes. Then it was up to IRT members to trace the intruding IP address. If a particular firewall scan or other intrusion attempt during the Games looked threatening, the team cut off the compromised network segment, but that was rare, Robertson says. Usually, it was a matter of singling out the intruder's IP address and shutting it down.

The attempted break-ins weren't surprising, but the volume and flow were unsettling. Hackers struck most often on evenings and weekends, when most events were televised, and most attempts came through the Internet and other outside firewalls rather than from inside. The IRT witnessed more than 100 fingerprinting attempts--that is, when a hacker pokes around to see what operating systems are running--and significantly more firewall scans.

The Salt Lake network was protected by dual firewalls and IDS probes at every edge and location. The network was closed to the outside world except for links to MSNBC and some news agencies for sending results and other information. The Internet connection was separate, too. On the inside, the network was segmented by VLANs, so a virus or break-in couldn't spread from one segment to another automatically.

For firewall logs and intrusion detection, the IRT chose mostly open-source tools, such as the Snort IDS probe and Demarc IDS management console, so team members could respond to incidents on their own rather than relying on vendors. As with any corporate network, the hardest part was digesting all the security data generated--sifting through the alerts, alarms and log entries, and weeding out false alarms.