Creating a Secure Computer Virus Laboratory
Laboratory Protocol
Our laboratory protocol to regulate behavior in the laboratory was initially based on biohazard protocols (Health Canada, 2001); biologists and chemists have had decades of experience working with dangerous substances, and it is only prudent to build on their experience. Obviously, the analogy breaks down after a certain point, but there were a number of things to be learned about laboratory access, operation, and personnel training.
Since the contagions of concern in the computer virus lab are electronic, we had to add a number of provisions with respect to media handling, and any means of electronic transmission, both wired and wireless. Our initial thought was to let students bring media into the lab, so long as it was not brought out again, to allow material researched on the Internet to be brought in, but after negative reviewer feedback we scrapped this idea. Printouts were also contentious, in two ways: first, that we were allowing them to be made at all; second, how they were to be handled by students. We eventually clarified the protocol to specify how printouts should be handled, but still allowed them to be made – at the very least, printouts can be useful for debugging purposes.
The final lab protocol is given in the Appendix. The provision dealing with laboratory entry, where people have to enter individually, is taken from our observations of airport security. Disallowing ‘tailgating’ gives us an electronic card key entry record for each person, in case a later audit is necessary.
The lab protocol includes mention of technical staff and the course instructor, and this is deliberate. While the laboratory was active, even these people were subject to the laboratory protocol. The behavioral safeguards established by the laboratory protocol are meaningless unless everyone adheres to them. Indeed, the first author (as the course instructor) religiously removed his cell phone upon entry to the laboratory and was seen by the students to be doing so. This type of action is vital to underscore the seriousness of the protocol.
Download file here
