Educause/Internet 2 Computer and Network Security Task Force Copyright Gordon D. Wishon, 2002. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author. Educause/Internet 2 Computer and Network Security Task Force

Higher Ed Computer and Network Security -- The View from the Campus Gordon Wishon University of Notre Dame www.educause.edu/security Educause/Internet 2 Computer and Network Security Task Force

The Challenges of Security in Higher Education Diversity of the Higher Ed Industry Complexity of Service Offerings Drives Complexity of Architectures Cultural Challenges Educause/Internet 2 Computer and Network Security Task Force

Diversity of the Higher Ed Industry 3500+ Colleges and Universities > 1000 Community colleges < 100 major research universities 125+ University Medical Schools 400 Teaching Hospitals 150+ Institutional members of Internet2 Educause/Internet 2 Computer and Network Security Task Force

Complex Service Offerings The University is an Educational and Research Entity The University is a Corporation The University is an ISP Educause/Internet 2 Computer and Network Security Task Force

Educause/Internet 2 Computer and Network Security Task Force Cultural Challenges Loose confederation of autonomous entities Lack of control over users Academic “culture” and tradition of open access to information Complex trust relationships between departments at various Universities for research (e.g. Physics community) Creative Network Anarchy – anyone can attach anything to the network University research lab computers are often insecure and poorly managed Dorm Networking: little adult supervision Educause/Internet 2 Computer and Network Security Task Force

Why US Higher Ed Computer Networks are Attractive Targets Excellent platforms for launching attacks Wired dorms (insecure Linux PCs, PC Trojans) High bandwidth Internet (Fract T3, T3, T3+) Sophisticated computing capacity (scientific computing clusters, even web servers, etc.) Unsophisticated user population “Open” network security environment (no firewalls or only “light” filtering routers on many high bandwidth WANs and LANs) Many college & university networks are insecure Too few security experts; weak tools; most institutions have no InfoSec office. Few policies regarding systems security Dearth of funding Educause/Internet 2 Computer and Network Security Task Force

Targets of Opportunity on US Higher Education Computer Networks Sensitive Data Credit Card #s, ACH (NACHA) bank #s Patient Records (SSN) Student Records (SSN) Institution Financial Records Investment Records Donor Records Research Data & Other Intellectual Property Educause/Internet 2 Computer and Network Security Task Force

Increasing Visibility of Security Issues in Higher Ed Increasing concerns about liability: E-Commerce site recover damages from institutions implicated in future DDoS attacks? Insurance companies begin to rewrite liability policies, separate ‘cyber’ policies to require info security vulnerability assessments & changes? Federal funding agencies to require firewalls, security? HIPAA is a “forcing function” in academic Medical Centers, Campus Health Centers FERPA, COPPA, DMCA, Privacy legislation Threats from terrorist activities, protection of the national infrastructure Recent Incidents: Massive Virus Attacks, Intrusions Leading to Potential for Identity Theft, Liability Educause/Internet 2 Computer and Network Security Task Force

Educause/Internet 2 Computer and Network Security Task Force Five Point Action Statement Endorsed by Higher Ed leadership organizations (ACE, NASULGC, etc.) Evaluating Higher Ed Information Sharing and Analysis Center (ISAC) NSF Grant Commissioning of Papers, Reports, Case Studies Meetings of Security Experts, Policy Experts, and User Community Summit on Computer and Network Security in Higher Education Participating in development of National Strategy to Secure Cyberspace Chapter Devoted to Higher Education Higher Ed Response to “Questions” (http://www.educause.edu/netatedu/groups/security/security-survey.html) Educause/Internet 2 Computer and Network Security Task Force

Educause/Internet 2 Computer and Network Security Task Force Higher Ed ISAC Real time information sharing mechanism Security consulting Vulnerability assessment Emergency notification Internet 911 services for academia? Educause/Internet 2 Computer and Network Security Task Force

Educause/Internet 2 Computer and Network Security Task Force Action Statement Make IT security a higher and more visible priority in higher education Do a better job with existing security tools, including revision of institutional policies Design, develop, and deploy improved security for future research and education networks Raise the level of security collaboration among higher education, industry, and government Integrate higher education work on security into the broader national effort to strengthen critical infrastructure Educause/Internet 2 Computer and Network Security Task Force