MDMLG News

Sue Skoglund, Editor
Valerie Reid, Webmaster

Table of Contents

Firewalls
Focus on Members:  Canadian Librarians
DALNET's Health Calendar
Election Results
MDMLG Summer Luncheon Meeting
Announcements
Upcoming Dates

Firewalls

"I was brought up to believe that the only thing worth doing was to add to the sum of accurate information in the world." Margaret Mead

I recently received a catalog from Information Toady, Inc. The catalog has titles of books of particular interest to librarians. Two titles caught my eye: one is called The Accidental Webmaster and the other is The Accidental Systems Librarian.  This got me thinking how, as librarians, we often wear many hats. Even if we are not directly doing web development, we are expected, at the very least, to understand basic HTML. And if we are not actually performing system maintenance, we are expected to understand the technology behind it. In this brief article, I hope to provide basic information about computer firewalls so that, should you find yourself in the position of "accidental systems librarian", you can feel confident in your ability to ask the right questions and make good choices. After all, knowledge is power!  

It seems that I always knew that cars have firewalls. Then I learned that buildings have them, too. (Cars first…I was raised in Dearborn.) And recently I learned that airplanes have them as well. A brick and mortar firewall is designed to contain fire in one part of a building and prevent it from spreading to other parts.  A computer firewall works in a similar way. Its purpose is to ensure that if something bad happens on one side of the firewall, it won’t spread to computers on the other side. 

So, why is a firewall so important? Aren’t we all just being a little paranoid?  As the saying goes, "Just because you’re paranoid doesn’t mean that they’re not out to get you." (5) Consider the cost of a breach to the security of your network:  staff time, lost data, especially confidential data, down time, and a potentially hijacked computer. Computers that have an "always on" connection (like a DSL or T1 line) are the most vulnerable. Except for possibly our home computers, that designation probably applies to all of the computers that we use.

The threats to computer systems are various: viruses, worms, hacking, and hijacking. If your computer is hijacked, it can be used to initiate a denial-of-service attack, which it turns out, is not uncommon. In this situation, the hijacked computer (yours) connects to numbers and websites in an attempt to bring down a server by flooding it with thousands of hits. This results in "serious repercussions" for the computer owner (you). "Implementing a firewall is a critical part of any company’s security process". (2) Which of us would seriously consider not having virus protection for our computers? Like virus protection software, a firewall is a sort of insurance policy against potential damage.  

First, let me explain what firewalls cannot do. They cannot protect you from inside attacks, viruses, "social engineering" (situations whereby hackers obtain privileged information by pretending to be an employee or member of the security staff), or poorly trained firewall administrators.

The basic principle of a firewall is this: "Analyze the data being sent to the PC over the internet or LAN, then reject or accept that data according to the security rules that are either predefined or which can be configured by the user." (4) Simple enough?

Different firewalls operate on different filtering methods. The best firewalls will provide more than one type of filtering which will supply layers of security. There are 5 basic types of filtering methods.

1. Packet filter method: This method analyzes every TCP/IP data packet entering or leaving the PC through an Internet connection. Packet filtering is usually effective for as far as it goes. However, the "outside world" can learn the IP address of your computer, and packet filters have "limited decision capabilities because they look only at a small portion of the network packet." (4) Packet filter "rules" can check such things as the source and destination IP addresses, IP protocol ID, TCP or UDP port number and fragmentation flags.
2. Application gateway filtering: This filtering operates by "analyzing any piece of data sent or received by a specific application running on your PC which does not tell you that it is trying to access the Internet. Even running a game or multimedia title can often result in data being sent out to the Internet without the user’s knowledge."! (4) This type of filtering allows the user to specify which applications are allowed to send and receive data and which are not.
3. Circuit level gateway: This type of filtering is used mainly in point-to-point connections and dial-up access from remote users. "Circuit-level gateways are efficient in that once a connection has been established between two specific IP addresses, such as the user PC and the server at the Internet service provider (ISP), or a remote PC and a server on a company network, data packets can then flow between the two systems without any more checking." (4)
4. Proxy servers: In this situation, all Internet traffic passes through a single point (the proxy server) where you can control it and apply the rules of your security policy. "Because servers on the Internet never see the actual IP addresses of the computers that establish a connection, a proxy server effectively hides your internal network structure." (4) The proxy server "intercepts Internet requests, examines them and then issues the requests to the Internet, making them look as if they originated from the proxy server. With a proxy server, your entire company or organization requires only a single IP address that is valid on the Internet, which is the IP address of the proxy server." (4)
5. Stateful inspection: The packet filter method could be considered "unstateful inspection" because it does not remember the "state" of expected return packets. Stateful inspection could be considered the deluxe version of packet filtering. "When a firewall sees an outgoing network packet, it should remember that an incoming response is due soon, and only allow those expected incoming network packets." (4) When this happens, it is called stateful inspection. This firewall records the configuration of approved packets and then permits future packets of the same configuration to pass.

Categories of Firewalls

1. Embedded firewalls: These are built into a network router. They work at the network level and may not trap application-level issues such as worms. They have limited security functionality and store sensitive information such as administrative passwords in an unencrypted manner. (1)
2. Software-based firewalls: This type of firewall is commonly used on servers and desktop operating systems. This would probably be the type that you would install on a home computer, or installed on each desktop computer in a small business.
3. Network firewalls: These are hardware-based firewalls that come ready to plug in between WAN (wide area network – Internet) connections and your LAN (local area network). These types of firewalls are usually accessible via a "browser based administrative interface". Network firewalls are more sophisticated and are usually part of a wider security system. They support blocking of a greater array of transmission protocols.

Most firewall products allow three levels of security – high, medium and low. These settings can be controlled based on the direction of the traffic (incoming or outgoing), the port number, or the application. In addition, the firewall administrator should be able to choose which applications are permitted to bypass the firewall, if any. The firewall should also be able to identify different types of net traffic according to IP protocols (TCP, UDP, DHCP, etc.) and should be able to block activity of Java applets or ActiveX control, if the administrator desires. (These connect to the Internet automatically without consulting the user.) Most firewall software starts up automatically with the PC, like the virus protection software. But some have to be opened manually when you start with a certain application, like a browser or dial-up connection. The administrator should have the option of manual override to instantly stop all Internet traffic; and/or a timer that initiates a lock on all Internet traffic after a certain time of inactivity, much like a screensaver. In fact, this type of lock can be designed to activate when the screensaver comes up. Lastly, some firewalls can split the Internet into zones with different levels of security for each.

Many firewalls are available as part of application suites which include things like anti-virus, cookie-blocking applets, encryption tools, web history logs, usage reporting and other web tools. The firewalls in these suites are usually the most basic. Naturally, upgrades should be installed as they come available, and in many cases are free for at least the first year. Managing a firewall on a large system is not easy, so usually administrative tools are part of a firewall security system.

Remember earlier when we said, "the basic principle of firewalls is to reject or accept data according to the security rules that are either predefined or which can be configured by the user"? Normally, users don’t just "go with" the security rules that are predefined, but do indeed customize the rules to suit their needs. It is not my intention, or within my capabilities to explain the process of configuring security rules for a firewall.  This is where having a firewall administrator is really nice. Some firewalls create rules "on the fly" after presenting you with a pop-up notification. The order in which the rules are applied is an additional consideration that can be addressed by your firewall administrator. (So much to think about!)

So, once the parameters are defined, then what does the firewall do if there is "suspicious activity"? Even a simple firewall copies the contents of its alerts into a text file, but "wading through these files can be time consuming" and fruitless. Some more sophisticated firewalls condense activity into logs, sort the information and present it in a format that can then be exported to other applications like word processor, spread sheet or HTML browser. How the logs are handled is especially important because the denial-of-service attacks (remember those?) often operate by flooding host servers log records until the system hard disk fills up and either crashes or freezes.

The most basic type of notification is the on-screen alert. This is a pop-up that provides information such as TCP/IP address of the source and the type of activity. Identification of potential hackers is important to any business LAN. But bear in mind that if a hacker has hijacked a computer, then knowing the IP address only tells what computer is being used, not the identification of the hacker. Once suspicious activity is logged, the firewall can be configured to either permit communication or to shut down all Internet communication. The firewall will record time, date and method of attack. Some firewalls will immediately send an email to a specified address; some are even able to dial into a pager for immediate notification of the firewall administrator.

There are probably as many different firewalls as Carter had pills (as my mother would say). Costs can range from nothing to thousands of dollars. It may seem daunting initially, but determining the needs of your system and then finding a product that meets those needs within your budget is all there is to it. Happy shopping!

Bibliography

1. Biggs, Maggie (2002). "One too many: no single firewall solution is right for everyone". Computer User, v.20, i6, 42-44.
2. Baker, Richard (1996). "Fighting fire with firewalls". Information Week, n602, 53-57.
3. Charnetski, J. R. (1998). "Avoid disaster: Use firewalls for inter-intranet security". Computers in Libraries, October 1, 44
4. Courtney, Martin (2001). "Personal firewalls: you don’t have to be in a corporate network to be a target for Internet hackers. Even our notebook can attract the wrong attention, so a personal firewall might be the tool you need. Martin Courtney explains what they do and how to buy one".  PC Direct, March, 178-182.
5. Komar, Brian, Beekelaar, Ronald & Wettern, Joern, PhD (2001). Firewalls for Dummies. New York: Hungry Minds, Inc.

Carla Caretto
Oxford Public Library

BACK TO THE TOP

Focus on Members:  Canadian Librarians

This month we’ve chosen to profile our Canadian MDMLG librarians, and find out more about them and what library life is like on the other side of the border.

Toni Janik

Toni is originally from Leamington, Ontario just a short 30-minute drive from Windsor in the Tomato Capital of Canada. She’s been with Hotel Dieu Grace Hospitals for 28 years.  Currently she is the Medical Library Director, and, as we all know, is President of MDMLG.  Her job duties include administration, searching, end-user instruction, software updating, e licensing, staffing, cataloging and whatever else comes up.  Her educational background began with a Library Technician Diploma from Sheridan College in 1975, BA in Psychology from University of Windsor 1996, and M.L.I.S. will be completed December 2003 from Wayne State University .

In her free time she enjoys gardening, camping, wine-making, and spending time with her family, husband of 23 years, Dan, and her two children, Lisa and Douglas.  Lisa is entering her third year of science towards her BSc at University of Toronto, and Douglas is entering his second year of Computer Networking at St. Clair College in Windsor .

Mary Ellen Bechard

Mary Ellen hails from Windsor, but lived for several years in Toronto before returning.  She has been the Coordinator for the Medical Library at Windsor Regional Hospital for 2.5 years.  She directs the activities of a Library Technician and a Library Clerk.  Her duties include research, overseeing interlibrary loan requests, budget, acquisitions and collection development, coordinating resources for Windsor ’s Satellite Medical School students arriving September 2003, and conducting library orientation and tutorials.

She received her degree from the University of Toronto.  Before she became a librarian she worked for the Royal Conservatory of Music in Toronto.  She was a musician, teacher and administrator.  In her free time, she and her husband enjoy going back to Toronto to eat, people-watch and enjoy hip coffee shops.  They are also film buffs, especially British films. 

Margaret Campbell

Margaret is originally from Chatham, Ontario.  She’s been working for the Chatham-Kent Health Alliance for some 17 years in various capacities. She’s worked for the hospital portion of the Alliance for 28 years. (“Egad!” she says.)   She worked as an assistant, and then progressed into a full-time employee.  She’s a solo librarian and deals with the same issues that most solo librarians do.  In her personal life she enjoys playing the flute.  She gave lessons for many years, but the requirements of raising a family have not allowed her to continue to instruct for the last few years.  She jokes that the demands of playing chauffeur have significantly cut into her free time.  She still plays for church concerts and other community events.  She has also developed an interest in genealogy and is working on discovering more information about her family tree.

Is the financial crunch of Ontario Medicine affecting you and in what ways? How is it affecting health care in general, but also how is it affecting the library and long range planning?

TJ: It affects us in declining budgets while journal prices continue to escalate each year while our budgets are decreasing.  End result - fewer titles and more reliance on the library partnerships we have developed for resource sharing.  Longer wait times for patients and it's harder to find a family doctor that is taking on new patients when your doctor either retires or moves to the U.S. (which many of our talented physicians do). From a library perspective it affects our ability to move forward with automation (we want to move to a web enabled Z39.50 library system).  Due to budget restraints, collection development is more difficult with higher prices for electronic access while still needing print due to embargoes, etc.

MEB: Hospitals are closely scrutinizing all costs including library services.  This hasn’t directly affected me yet as far as staffing; however, I must be diligent in keeping statistics and must vigorously market the library to the hospital staff, physicians, and administration. There are long waits for certain surgical procedures (orthopedic) and many physicians only allow patients one “question” per visit.

MC: The financial crunch has always been there. The biggest problems I see are that end users want everything immediately.  Their expectations are higher than before.  Technology changes have changed the user culture. There is a lot of the 'everything is free on the internet' thinking and the library has had to prove its value.  I have been lucky by having a CEO that was a high end user and very appreciative of the services provided. I am worried about the long-term costs of electronic information.  I fear the costs will escalate at higher rates than users will accept.  In Canada, the availability of evidence for evidence-based practice really depends on whom you are affiliated with (hospital, school...).  There are the haves and the have-nots.  I see this gap widening each year. Although provincial initiatives are being worked on, the financial pressures will be great. Long range planning is almost impossible when you look at the mergers and buyouts taking place.  How many budgeted for MDConsult?

Which library vendors do you use?  What sorts of unique issues do you have with them, if any?

TJ: EBSCO has been wonderful with their service of both our print and electronic resources and databases.  The direct linkages from the databases to our e titles are a big hit with our users.  We have direct contact with both the Canadian offices and the American offices for our products we purchase through them and they have been great in making regular site visits for ongoing training of new products and features and just checking in with us to make our jobs easier. We would like to see a consortium pricing for Up-To-Date that would allow us to move to web access for our staff versus the CD-ROM format we are currently using.

MEB: We use EBSCOhost and ScienceDirect.  So far I’m happy with them.  ScienceDirect offered free online training that I appreciated. 

MC: I use EBSCO and have been very pleased with their customer service. They have managed to sustain me in providing access over 3 sites. I am currently looking at OVID as part of an Ontario consortium.  The thought of changing service providers means so much reworking, training and reconfiguring my intranet pages that I honestly hate to think about it.  I also have purchased StatRef with the Michigan Group.  I am very pleased with this service arrangement.  It does raise some eyebrows with my users when they log on and it says Michigan!  I then get the chance to tell them about how librarians work together regardless of borders.  They are always impressed. When you work as a solo, it is always nice to feel that you have colleagues an email away.

What stands out to you as different in a Canadian versus a Detroit area Library?

TJ: The need to pay for the bulk of our journals in US dollars while our budgets are in Canadian dollars and the exchange rate can effectively diminish your budget substantially in the course of a few days between ordering the library material and the invoice arrives.

MEB: I’ve worked in both American and Canadian libraries and the issues are almost identical.  I’d have to say that American libraries (I’m not basing this only on Detroit) generally put more significance on customer service.

MC: What I notice most about the US libraries is their funding models.  You have managed to work together with various government levels and receive some basic common services.  That is amazing to me.  You also have grants and different monies available.  We have been restricted on this.  Since our hospitals are all actively fundraising, we are not permitted to go after donations for our departments.  There is a central office that controls this.  At this point in time, the province has not coordinated any centralized library services.  However, there are many initiatives in place that are currently looking at standardizing access.  However, I doubt the funding base is there to sustain any real changes.

What, if any, problems do you have interacting with US libraries?

TJ: No problems what so ever.  American librarians, particularly those in Michigan we have interacted with over the years, are the most wonderful professionals, actively opening their collections to resource sharing with us, inviting us in 1975 to become MDMLG and MHSLA members, and sharing CE opportunities with us as equals.  My hospital staff and physicians have been the recipients of better library service, including ILL, and therefore have had the information they needed to provide the best patient care because of my interactions with the librarians of MDMLG and MHSLA.  MDMLG has provided a strong support mechanism for our institutional information needs and in return we have modeled your reciprocal resource sharing policy and have promoted it through our interactions with libraries in Ontario and throughout Canada.

MEB: I haven’t experienced any problems.  Our American neighbors are very generous with interlibrary loans and are particularly efficient when filling an urgent patient care request.  We are very grateful for their assistance and hope that we can reciprocate more in the future.

MC: The support I've received from US libraries has been wonderful.  The people I've contacted have all been very friendly and helpful.  The only drawback I see is the problem of mailing items to Canada.  Often, ILL's take a long time (2-3 weeks) to arrive due to postage problems. Envelopes have been returned to the sender for insufficient postage.  Some hospitals are not permitted to mail to Canada. In earlier times, some hospitals could not fax to Canada.  I have never understood this but have accepted it as a reality and have managed to work around it.  I participate on Backmed and some of your members use creative ways to beat the post office battle (watch me get a journal delivery at the June meeting!).  Librarians will always find a way!

How is border crossing these days?

TJ: Slow at peak travel times - average wait is 15 to 30 minutes.  Having the correct change ready and your birth certificate and driver's license ready really speeds up the process of getting through the tunnel and customs. These days the tunnel is much faster than the bridge due to the truck traffic.

MEB: I don’t have to cross very often, but according to my new Library Technician who also works at Wayne State, it is usually pretty good (15 minutes to half an hour).  Of course when a code orange is called, everything really slows down.

What is your favorite Windsor area dining spot? 

TJ: New York Steak and Seafood.  Wonderful dining and the seafood is superb.

MEB:  Eat in Thailand (I LOVE Thai food) and Chatham Street Grill (fine dining)

Juliet Mullenmeister 
St. Joseph Mercy of Macomb

BACK TO THE TOP

DALNET's Health Calendar  

A new hyperlink to www.healthcalendar.org is temporarily available on the MDMLG web site, so that members can explore this new community information resource. The health calendar was created by librarians in the DALNET consortium, as part of their ongoing effort to become an “information gateway for southeastern Michigan.” 

The libraries that make up DALNET are a varied group, which now includes public, special, and college libraries in addition to the medical libraries.  In meetings which began a couple of years ago, DALNET librarians discussed the various ways in which they might cooperatively provide useful information to southeastern Michigan residents, and determined that there was a need for a calendar of events for health-related organizations.  A cooperative calendar, it was felt, would publicize scheduled events, assist organizations in scheduling new events, and reduce the likelihood of meeting conflicts. 

The development of the healthcalendar.org website was primarily funded by the Friends of the Detroit Public Library and by the Ameritech Foundation, with its ongoing expenses covered by the DALNET libraries.  Cathy Eames, Library Manager of Children’s Hospital of Michigan, explains that, since the group now owns the software required to maintain the calendar, the project requires little ongoing staff time or expense.  Thus, she does not anticipate that the calendar will be affected in any adverse way by ongoing financial difficulties of the member libraries of DALNET. 

There are several practical uses for the calendar.  Events can be searched by keyword or by county, so that an individual looking for a health-related educational experience can search within his/her own county – Livingston, Macomb, Monroe, Oakland, St. Clair, Washtenaw and Wayne - as well as by subject.   Clicking on an event will link to a map showing its location, and, in an effort to assist handicapped individuals, the site also includes transportation links with bus schedules, etc.  The calendar of an organization’s events can be displayed by day, week, two weeks, a month, or an entire year.  Once an organization registers, using an online form, its events can be added to the calendar at no cost.

A particularly interesting link on this website is to the Detroit Public Library’s “TIP” service via an “Ask a Librarian” hyperlink.  Other helpful DPL links are also included, such as a link to the online library catalog and to various online newspapers.  MeL, the Michigan eLibrary, is represented by a link to its Internet health resources, but not, as yet, to its electronic books or databases. 

Carol Attar
Attar Associates

BACK TO THE TOP

Election Results

The results for the 2003 election are as follows:

Congratulations to our successful candidates.  Also, thank you to all who ran for office.

Gina Hug
Chair, Nominating Committee

BACK TO THE TOP

MDMLG Summer Luncheon Meeting

The annual summer luncheon meeting will be held June 19^th at the Best Western Sterling Inn Banquet & Conference Center in Sterling Heights .  Registration and hors d'oeuvres begins at 11:30 a.m. , followed by a fabulous buffet lunch and program. Thanks to a generous contribution from Swets Blackwell, the luncheon is free to MDMLG members.  The price is $25.00 for nonmembers.

There will be some great door prizes as well, thanks to contributions received from Rittenhouse Book Distributors, Up-to-Date, and Wallaceburg Bookbinding.  Bring some business cards to enter for the drawings.

The speaker this year is Barbara K. Redman, Dean and Professor at Wayne State University 's College of Nursing .  Many of us have at least one of her books on patient education in our library.  Dr. Redman will be discussing consumer health, patient education, and the role of the medical librarian.

More details, including a map to the facility, are available on the MDMLG website.  Registration forms were due by May 30^th to Toni Janik at Hotel Dieu Grace Hospital in Windsor .

Sue Skoglund
Henry Ford Wyandotte Hospital

BACK TO THE TOP

  Pat Vinson is the new librarian at The Orthopaedic Specialty Hospital in Madison Heights .  You can contact Pat by phone at 248/733-2357 or e-mail her at pvinson@dmc.org.  

  Ken Nelson began his new position as senior information research specialist at William Beaumont Hospital on May 12th.  His new phone number is 248/551-1748.  His new e-mail address is knelson@beaumont.edu.  

  Elizabeth Siporin is the new librarian at Pontiac Osteopathic Hospital .  Her phone number is 248/338-5000 ext. 3155. 

  Windsor Regional Hospital is delighted to announce the addition of Christina Wallace to their staff.   She is a recent M.L.I.S. graduate of Wayne State University and brings both an impressive academic background and work-related experience to this position.  Christina is now also a new member of MDMLG.  Please feel free to welcome Christina at cwallace@wrh.on.ca.

  Toni Janik is still interviewing for a part-time medical library technician at Hotel Dieu Grace Hospital in Windsor .

  Congratulations to Carol Vandenberg on receiving the Women of Wayne Service Award,  presented to her at the annual Women of Wayne Headliners Luncheon on May 24th.  Women of Wayne is a constituent group of the Wayne State University Alumni Association.  The service award is presented annually to a Women of Wayne member for outstanding service to the organization.

  Congratulations to the following MDMLG members who have won the Medical Library Association/Hospital Library Section awards:

Catch a Rising Star
Misa Mi

HLS Scroll of Exemplary Service 2002/2003
Carole M. Gilbert
Misa Mi
Barbara A. Platts
Karen Tubolino

  Don't forget MDMLG membership renewal is due August 8^th.

Upcoming Dates:

Sue Skoglund
Henry Ford Wyandotte Hospital

BACK TO THE TOP

Communications Committee 2002-2003

BACK TO THE TOP