If there's one thing the Atos Origin team understands as lead contractor for the Olympic IT infrastructure, it's that you must learn from your mistakes.

One such lesson learned the hard way: Security must be built in from the start, says Claude Philipps, program director of major events at Atos Origin. For the 2002 Olympic Games in Salt Lake City, the company "started embedding the security too late, so it wasn't running well," he says.

The lapse caused nothing serious, aside from a few headaches: "We had a lot of attacks, but we ran the games safely," Philipps says.

The team found the number of alarms generated by security systems can become unmanageable without software help. Based on the number of alarms seen in Salt Lake City, they could expect to see 200,000 per day related to security in Athens, Philipps says -- most of them irrelevant warnings.

"This is not manageable: Screens would be flickering all day long, so we want to reduce it to (the) 10 to 50 that are real," Philipps says.

Information Security Manager Yan Noblot paints a daunting picture of the haystack in which those 10 to 50 needles have to be found.

To begin, he monitors traffic between the 10,500 or so workstations and 900 servers on the network.

"We start with the traffic in the venues, and compare that with known traffic. This includes traffic at the operating system level," he says.

"On top of that we are receiving logs from all the routers and antivirus system." The network is built of 10,000 pieces of equipment.

This year, Atos Origin is using Computer Associates International Inc.'s eTrust to filter the alarms based on a set of rules developed by the team in Athens, Noblot says.

"The amount of information generated every day is massive. You can't put all that on a screen. We have some business intelligence to extract what is really meaningful."

Careful filtering can help in other ways, too, particularly when it comes to Windows 2000 permissions. To prevent power falling into the wrong hands, Noblot uses NetIQ Corp. for security administration.

"It allows us to have a more granular definition of rules," Noblot says, "We don't have to give admin rights to the help desk; we give them only the rights they need."

That precaution might rule out some social engineering attacks, but there are other ways in. In Salt Lake City, miscreants got around application-level locks on public-access PCs by rebooting them and trying to get into the network from there, Noblot says.

This time around, the possibilities for introducing hacking tools or other unauthorized software are greatly reduced. "We have a very small footprint to the Internet. It's almost nonexistent, and we don't send or receive Internet e-mails, so viruses are locked out," he says.

Anyone hoping to introduce a virus or other software directly onto the network in Athens will find the CD-ROM drives, floppy drives, and USB ports on PCs and servers disabled.

According to Philipps, it's cheaper to have the suppliers deliver standard machines then uninstall the drivers and disable the drives and ports at the BIOS level than it is to order special machines.

If any of the PCs later need a last-minute antivirus update or security patch installed, "we distribute it through the network using tools like LANDesk or Symantec Ghost," Philipps says. With the CD-ROM drives out of use, there'd be no point in sending someone running around the 60 or so venues with an update CD, unless they were training for the marathon.