CERN Computer Security Information

Working remotely

Here we provide some hints and tips when tele-working from home, when traveling, or when working for CERN outside its sites.

Maintain a confidential work environment

  • Do not let other persons see what you are working on. Ideally, use a "privacy screen" when working in presence of other people (like on the train or plane). These screens are available through the CERN store's "Distrelec" punch-out catalogue;
  • Never leave your device unattended. If you can't avoid it, lock the screen with a password or, even better, log off, so that other persons cannot see information that is not intended for them;
  • Ideally, use your device only to connect remotely to CERN's central services or your office PC using CERN's Terminal Service or LXPLUS. Your office PC, however, would need to remain switched on during your absence.

Preferred: Use your CERN device

Ideally, you use your CERN device also for remote working. In that case, the basic CERN protections like operating system updates and anti-virus software are already applied to that device (for recent Windows, Mac and CentOS operating systems). In addition, please consider the following:

  • Have your local harddisk encrypted with Bitlocker for Windows, FileVault for Macs or LUKS for Linux. Also consider encrypting external harddisks and USB sticks;
  • Do not install any software other than what CERN holds a license for. Software catalogues can be found on CMF for Windows devices, LXSOFT for Linux systems and on the CERN/Apple Mac Self-Service. Dedicated licenses are also available for engineering software and for control software. If these do not suit your needs, or if you are in doubt as to whether the licence conditions of your applications are compliant with usage at CERN, please contact the CERN Software Licence Officer to check your options and, if needed, agree to make a central purchase. Please note that some licensed software require you to be at CERN and/or have a connection to CERN's license servers;
  • On CERN Windows devices, save your data only on in the standard "My Documents" folder or on the Desktop so we can ensure automatic data back-up once your device is back on the CERN network again;
  • Recall that the CERN Computing Rules still apply to those devices even when being used outside CERN.
At the border

If you are on duty travel, any device owned by CERN is enjoying, as such, inviolability on the territory of the CERN Member and Associate Member States. This, however, does not imply that the customs or police officials are aware of CERN’s international status. As a precaution, we recommend to completely power off your CERN device before passing through customs. If you are requested to switch it on, we recommend that you state calmly that it is protected by the inviolability granted to CERN property and that you disagree with any search. If you are obliged to disclose your password or PIN code, please inform Computer.Security@cern.ch of this unauthorized access ASAP. Please also note that we need to be informed if your device has been taken away, even for a few minutes, or connected to another device. We will take the necessary measures to prevent any potential remote access and, if necessary, replace your CERN device.

When using your personal device

A "personal device" in this context is a computer, laptop or tablet you own and you use for mixed personal and professional purposes. It is yours and your full responsibility to keep it appropriately secured. In any case, consequences of its compromise are born by you...

  • Make sure that your device is up-to-date, with all recent patches applied, and configured in a way that it is auto-updating itself. Permanently run an anti-virus software. Check out here for more general hints how to secure your PC or Mac;
  • Protect access to your local account on that device with a password known to you and only to you. Here are some hints for good passwords;
  • Have your local harddisk encrypted with Bitlocker for Windows, FileVault for Macs or LUKS for Linux. Also consider encrypting external hard-disks and USB sticks;
  • When charging your tablet (or smart-phone) using random USB ports, employ a so-called “USB Blocker” which physically blocks any data exchange but still lets you charge;
  • Refrain from installing any CERN-owned software or using your CERN e-mail address to register for your personal software. Make sure that you own a valid license for all other software (recall that "free" not always means "free");
  • If you use P2P applications for sharing music or videos, make sure that those are disabled when you connect your device back to CERN;
  • If you tunnel into CERN, recall that our monitoring tools will also be able to see all your private communications. Hence, please respect the CERN Computing Rules.

Avoid using shared/public devices

Those are devices shared regularly with others like a family's laptop used also by your kids and partner, or, more broadly, PC kiosks, hotel PCs, and computers in Internet cafés. Due to their mixed usage, it is not unlikely that those devices were infected, e.g. by kids browsing unconsciously malicious webpages, hotel guests opening infected emails, or Internet café run by fraudsters. Hence,

  • Avoid them!
  • If you can't,
    • Use them only to remotely connect to CERN;
    • Never tick "store your password for future use";
    • Make sure that no confidential data is downloaded, or can be found in the cache or in temporary folders. Reboot the device once you have finished your work;
    • When back at CERN, change your CERN password.