November 2022 - Physics-Departmental-Computing

Fwd: FoNS Device Management - Defining a research devices and user group
by David Colling 01 Dec '22

01 Dec '22

FYI ... Please feel free to send comments ... I have a very busy up to the meeting this afternoon and will not have really enough time time to scrutinise the attached (so far I have not even had a chance to open it) so your comments will be very useful. Best, david -------- Forwarded Message -------- Subject: FoNS Device Management - Defining a research devices and user group Date: Tue, 29 Nov 2022 18:22:48 +0000 From: Joannou, Ingrid <i.joannou(a)imperial.ac.uk> To: Hanham, Neil A <n.hanham(a)imperial.ac.uk>, Prescott-Jones, Steven <s.prescott-jones(a)imperial.ac.uk>, Taylor, James A <james.a.taylor(a)imperial.ac.uk>, Willson, Thomas H <t.willson(a)imperial.ac.uk>, Colling, David J <d.colling(a)imperial.ac.uk>, Bresme, Fernando <f.bresme(a)imperial.ac.uk>, Jaffe, Andrew H <a.jaffe(a)imperial.ac.uk>, Harrison, Nicholas M <nicholas.harrison(a)imperial.ac.uk>, Bearpark, Michael J <m.bearpark(a)imperial.ac.uk> CC: David Colling <david.colling(a)gmail.com>, Pengelly, Ellen <e.pengelly(a)imperial.ac.uk>, Richards, Andrew <a.j.richards(a)imperial.ac.uk>, Villamil, Juan <juan.villamil(a)imperial.ac.uk> Dear All, Apologies for the late sending of this. Attached is a draft proposal based on some of the discussion so far. We are hoping this can be the basis for our conversation tomorrow with the aim to define further that middle layer of research machine. David, please feel free to forward to anybody else that you think might need to be included in this discussion. Kind Regards, Ingrid Dear All, I hope you are well. As per our previous meeting, I am setting up this meeting so we can follow up on defining the research devices with services used and user group for FoNS. A few of us will be on site for this meeting so I have added the room number in ICT but also happy to go to you if you can book a room for us? Kind Regards, Ingrid ________________________________________________________________________________ Microsoft Teams meeting *Join on your computer or mobile app*** Click here to join the meeting <https://teams.microsoft.com/l/meetup-join/19%3ameeting_MmFlNzM4YWEtMmRhNy00…> Meeting ID: 328 697 732 543 Passcode: CgLPAv Download Teams <https://www.microsoft.com/en-us/microsoft-teams/download-app> | Join on the web <https://www.microsoft.com/microsoft-teams/join-a-meeting> Learn more <https://aka.ms/JoinTeamsMeeting> | Meeting options <https://teams.microsoft.com/meetingOptions/?organizerId=add04a20-8545-483d-…> | Legal <https://www.imperial.ac.uk/media/imperial-college/administration-and-suppor…> ________________________________________________________________________________

3 3

Services needed on a research computing desktop and laptop
by David Colling 30 Nov '22

30 Nov '22

Hi All, I am sending this to the Physics Departmental Computing Committee and to the departmental members of the FRCC so that they can gather information from their departments. As some of you know ICT are increasingly confining what people can do on college machines, even those bought on research grants and used by individual researchers. This has been most noticed by the change in the management of Macs. In my years involved in departmental computing, no issue has annoyed more people. Behind this is the increased number of attacks on university computing system which is visible both at Imperial and elsewhere. Some universities have been badly hit and have ended up paying £Ms to ransomware attackers. Apparently this is one of the things that keeps our President awake at night. This is clearly a threat that we have to take seriously, but it is also not clear how much damage could be done to college systems by a laptop or desktop used by a single (or team of) researcher(s). In discussions with ICT the most sensible approach seems to be that we define a class of machine that is a research desktop or laptop that ICT don't manage but which also has limited access to college central systems. Most of us have no reason to access payroll (say) and in fact would view it as a security breach if we could. We have a meeting on the 30th November where we will discuss this proposed set up. What I need going into is the list of services that researchers would need access to from these research machines, how that access would them + any other thoughts/comments. For example the sort of thing that occurred to me are: service: Office365 (including sharepoint, email, OneDrive teams etc) Access: Is access through the secure web portal enough for most of these plus a mail client providing secure access the the email. [I use Office365 much less than almost anybody to whom this email is going so am the least qualified to answer this one] Service: ICIS (Payslips, expenses claims etc) Access: Secure web access should be enough. Service: Starfish Access: Secure web access is sufficient. What other services are needed and how? Other comments: - I don't think that it is unreasonable to have a requirement that the disks of all research laptops are encrypted in case they are lost when travelling. The performance hit is minimal and if that is important then running on a laptop might not be ideal. So please do send me your thoughts (on services mainly) and comments. For once I would not be against you sending to everybody as I would welcome debate on this. Best, david

10 28

Re: [Physics-Departmental-Computing] meeting tomorrow on managed devices
by Jaffe, Andrew H 28 Nov '22

28 Nov '22

Hi David et al, I’m not going to be able to make today’s meeting, nor Wednesday’s. So apologies for the following lengthy screed. One more “service” has come to mind, slightly more general: license servers for various software packages. The most obvious example is Mathematica, but also includes IDL for at least a few people in Astro and perhaps elsewhere. (I suspect Office365 falls into a version of this category, as well.) I’m sure that there are others. More generally: we shouldn’t provide a laundry list of software that we run on our machines — the spirit of our request is that we don’t want ICT controlling them at a low level. We want to ensure that we have access to vital services on the college network, and that we aren’t firewalled from other necessary locations on the broader internet. Alongside a discussion of this list of services, we need them to give us a better understanding of the future of the different classes of networks that they described, i.e., the distinction between (a) off-campus access; (b) BYO machines on campus; and (c) managed machines. Right now, there are a small number of services for which off-campus access requires the VPN. But as far as I can tell, that appears to be the only restriction and the only difference, at least with respect to the services that I require. There are possibly admin and secure-data services that require being on the managed network (e.g., payslip access from off campus has moved from ICIS to “My Imperial”). Is this intended to change under “Universal access” or any other coming reforms? This gets to the nub of the problem, I think. Is ICT happy with these machines becoming BYO, but intend to severely curtail access to crucial services from that network in the name of security? I suspect that this would be unworkable, given the large number of student and other machines that will be in that category, not to mention how this inevitably overlaps with questions of access from external networks. Absent a more reassuring response from ICT so far, I am led to believe that the situation is actually that they just really, really, really want to maintain explicit management of our machines no matter what, without actually justifying the security implications. Sincerely, Andrew ______________________________________________________________________ Professor Andrew Jaffe a.jaffe(a)imperial.ac.uk<mailto:a.jaffe@imperial.ac.uk> Astrophysics Group +44 207 594-7526 Blackett Laboratory, Room 1018B Imperial College, Prince Consort Road London SW7 2AZ UK http://imperial.ac.uk/people/a.jaffe On 27 Nov 2022, at 18:00, David Colling <d.colling(a)imperial.ac.uk> wrote: Hi All, For those of you who can make it we will have a meeting to discuss managed devices tomorrow at 12:00. I have another meeting at 13 but that should give us plenty of time. For thos of you actually in college and want to meet in person, I have booked Blackett 532. For those wishing to join on teams the coords are: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx Name: Managed Devices Start: Mon Nov 28 2022 12:00:00 GMT+0000 (Greenwich Mean Time) End: Mon Nov 28 2022 13:00:00 GMT+0000 (Greenwich Mean Time) Id: ff530f5e-239f-4f72-814e-bc10308feea9 URL: https://teams.microsoft.com/l/meetup-join/19%3ameeting_Y2RiNzI0ODQtZDJlZS00… xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx If you cannot make it tomorrow and want to send in a contribution by email in advance then please do so although I do suspect thatn almost everything has already been said. Best, david

1 0