Date post: | 12-Jan-2016 |
Category: |
Documents |
Upload: | charla-hensley |
View: | 218 times |
Download: | 0 times |
IT Security and Policy Issues
Mark Bruhn
University IT Policy Officer
Office of the Vice President for Information Technology
Indiana University
Security Issues Distributed servers, data, authentication, authority. Wireless, mobile computing. Library authentication. Administrative systems reengineering. Probes. Viruses. To firewall or not to firewall. Intrusion detection. Desktop power. “System Administrator” fuzzy. Technician training. “Dictating” standards into departments. Security Officer (or lack thereof). Security staff (or lack thereof).
Data Distribution/Server Proliferation
At our institutions, thousands of users in departments have formal authorization to extract confidential information from central databases.
At large institutions, there are 10s-of-thousands of computers that are configured to provide access to files and programs.
Servers are being managed by wide variety of individuals, from poorly trained undergraduates (“out of high school all day”) to veteran professional administrators.
Servers are being maintained in a wide variety of facilities, from small dedicated machine rooms to beneath a staff member’s desk.
Wireless/Mobile Computing
Laptop stations.Wireless zones.Current capabilities not scaleable: e.g., “CSG”
for 40 people may work, but not for 1000.Is a big VLAN enough? A bunch of VLANs?Unauthenticated accesses remain a problem. To VPN or not to VPN (yes, at IU).
Library Authentication (or not)
Differing opinions about what level of service our libraries must provide to the community.
That doesn’t matter: permitting access to the public does not mean without authentication.
University Counsel now concerned about this.Temporary credentials.
Admin System Reengineering
Peoplesoft.
Reported Probes Against All IU Systems
0
10
20
30
40
50
60
70
80
Year/Month
Reported ProbesPer Month
Viruses
0
5
10
15
20
25
30
35
1997-0
9
1997-1
1
1998-0
1
1998-0
3
1998-0
5
1998-0
7
1998-0
9
1998-1
1
1999-0
1
1999-0
3
1999-0
5
1999-0
7
1999-0
9
1999-1
1
2000-0
1
2000-0
3
2000-0
5
2000-0
7
2000-0
9
2000-1
1
2001-0
1
Year/Month
Re
po
rte
d V
iru
se
s o
n IU
Sy
ste
ms
General Technology Misuse IncidentsTotal Reported Technology Misuse Incidents Against or By IU Users
050
100150200250300350400
1997
-09
1997
-11
1998
-01
1998
-03
1998
-05
1998
-07
1998
-09
1998
-11
1999
-01
1999
-03
1999
-05
1999
-07
1999
-09
1999
-11
2000
-01
2000
-03
2000
-05
2000
-07
2000
-09
2000
-11
2001
-01
Year/Month
ReportedIncidents
Intrusions Into IU Systems
0
1
2
3
4
5
6
7
8
1997-1
0
1998-0
1
1998-0
2
1998-0
3
1998-0
4
1998-0
6
1998-0
7
1998-0
8
1998-0
9
1998-1
0
1998-1
1
1998-1
2
1999-0
1
1999-0
2
1999-0
3
1999-0
4
1999-0
5
1999-0
6
1999-0
7
1999-0
8
1999-0
9
1999-1
1
1999-1
2
2000-0
1
2000-0
2
2000-0
3
2000-0
4
2000-0
5
2000-0
7
2000-0
8
2000-0
9
2000-1
0
2000-1
1
2000-1
2
2001-0
1
2001-0
2
2001-0
3
2001-0
4
Year/Month
Breakins on IU
Systems
Breakins Per Month
Trend
Security Organization
Security Officers must be:– Technically savvy, with broad technical knowledge.– Able to cultivate trustworthy technical contacts.– Diplomats.– Negotiators.– Translators.– Able to talk others into accepting responsibility when
appropriate.– Able to relinquish responsibility when appropriate.– Reasonable when risk is low.– Hardcases when risk is high.
Organizational Issues Issues related to conflict of interest dictate that Security Officers
report to the CIO. Issues related to conflict of interest and consistency of approach
dictate that dedicated security staff report to the Security Officer.Security Officers must have the visible support of the CIO.Security Officers can be more technical and less schmoozy if
there is also a Policy Officer.Security Officers/staff should not be seen as the “police”.Security offices should be a resource for technicians. They
should be helpful and interactions should be non-contentious.The “police” role should be reserved for an Internal Audit
function or for the IT Policy Officer…
ResponsibilitiesService managers and technicians must retain primary
responsibility for security of systems.Data “owners” or “stewards” must retain responsibility for
security of data.Security Officers are responsible for adequately translating
technical vulnerabilities to risk factors for data owners.Security Officers provide security toolkits and specialized
knowledge in risk assessment. CIOs must be interested, and must have a sense of the
overall security climate of their campus. (“Sleeplessness factor”).
Mark BruhnPolicy OfficerContracts &
Agreements Officer
Jason AbelsSummer Ulrich
Alix SebestaIncident Response
Coordinator
Technical Investigators
University Information Technology Policy Office
Linda McNabb(Admin Asst)
Stacie WiegandData Administrator
Info Mgt Officer
Tammy Grubb Rose Ann HastyMelissa Silvers
Barbara HanesIUPUI Accts Coord
Chris ConklinIUB Accts Coord
Tom DavisSecurity Officer
Michael McRobbieVP/CIO
Information Technology Security
OfficeAllan StriebSasha HaywoodTerry Crowe (UIS)Milan Tasic (UIS)
Laura KleinAndrew KortyBen BoruffMarge Abels*Frank NeversSean Krulewitch
Marge AbelsDisaster
RecoveryProgram Manager
Recovery PlanningTeam
Global Directory Services
IU IT Policy Office Scope is all campuses and all departments. IT policy development, dissemination, education, and interpretation
(coordinating with many University offices and groups). Electronic information policy development and education (in
conjunction with data management committees). Coordinating response to incidents of abuse or misuse use of
information technology. Coordinating response or advising departments engaged in response
to incidents of abuse or inappropriate use of electronic information. Global Directory Services: identification, authentication,
authorization, and enterprise directories. Handles all non-security incidents, so the SO doesn’t have to.’
IU IT Security Office
Scope is all campuses and all departments. IT security awareness and education IT security guidelines and standardSecurity consulting and reviewMaintain production services in support of policy and
security operations (Kerberos, etc.) Investigate and document IT security incidentsSix security engineers/analysts located at IUB and IUPUIStaff knowledgeable in a wide range of technologies
(Unix, Windows, MVS, Networks, Encryption, etc.)
Services - Security Awareness and Education
General education and/or presentations on common security issues– http://www.itso.iu.edu/staff/ajk/
Comprehensive resource for information on security alerts, bulletins, and patches– http://www.itso.iu.edu/– https://www.itso.iu.edu/services/alerts/
Services - Security Guidelines and Standards
Function dedicated to developing and maintaining consistent security standards.
Comprehensive resource for security information, resources, etc.– http://www.itso.iu.edu/howto/
Resource for security related software– https://www.itso.iu.edu/services/– http://iuware.indiana.edu
Services - Security Consulting and Review
Assistance in reviewing specific situations and analyzing exposures.– Technical architecture diagram required– Data flow diagram beneficial
Requires departments and technicians to have a better understanding of their environment.
Services - Production Services
Security scanning in support of system administrators and audit activities– https://www.itso.iu.edu/scanner/
Central Kerberos authentication serversCentral SafeWord token authentication
servers
Services - IT Security Incidents
Assistance in coordinating appropriate technical investigation of security breaches.
Assistance in packaging technical security information for IU governance agencies, IU legal counsel, law enforcement, prosecutors, university administration, etc.
Common and consistent incident response.
Top 10 Security Mistakes(Tom Davis, IU ITSO)
1. Installing unnecessary programs and services.2. Not keeping current on software patches,
especially security related ones.3. Not installing anti-virus software and keeping its
virus patterns current.4. Opening e-mail attachments from unknown
people.5. Bringing up lab (test) machines and forgetting
about them.
Top 10 Security Mistakes (continued)
6. Lack of adequate training to administer the system.
7. Inadequate handling of sensitive data (gathering more than what they need, keying files off of SSN, etc.)
8. Not deploying encryption where available.9. Propagating virus hoax and chain mail.10. Sharing passwords.
Trustees ResolutionRESOLUTION
WHEREAS, the advent of the Internet has significantly transformed the manner in which information is stored on interconnected servers throughout the world; and
WHEREAS, the Internet is an information technology environment in which it is possible to have inadvertent or intentional unauthorized access to Internet sites and related servers; and
WHEREAS, successful intrusions into Internet sites and servers can lead to the disclosure of sensitive personal and institutional information; and
WHEREAS, it is critical that Indiana University protect its institutional information and information technology infrastructure so as to reduce the possibility of unauthorized access to servers holding sensitive information or running mission-critical applications.
NOW THEREFORE BE IT RESOLVED that the Trustees direct the Office of the Vice President for Information Technology and CIO to develop and implement policies necessary to minimize the possibility of unauthorized access to Indiana University's information technology infrastructure regardless of the Indiana University office involved; and
BE IT FURTHER RESOLVED that the Trustees direct the Office of the Vice President for Information Technology and CIO, which may draw upon the experience and expertise and resources of other University offices (including the Office of Internal Audit), to assume leadership, responsibility, and control of responses to unauthorized access to Indiana University's information technology infrastructure, unauthorized disclosure of electronic information and computer security breaches regardless of the Indiana University office involved.
(Passed by the Indiana University Board of Trustees, 4 May, 2001)