Adapting Enterprise Security to a University Environment Bob Hartland Director of IT Servers and Network Services Jon Allen Coordinator of IT Security Tommy Roberson Manager of Servers And IT Security Southwest Educause 2003 © Baylor University 2003

Overview of Presentation Baylor University IT Security Security through technology/hardware Security through People Putting it all together Southwest Educause 2003 © Baylor University 2003

Baylor University 14,221 Students 1,750 Full Time Employees Waco, Texas 14,221 Students 1,750 Full Time Employees Southwest Educause 2003 © Baylor University 2003

Information Technology Organizational Chart Southwest Educause 2003 © Baylor University 2003

What is IT Security? “…the concepts, techniques, technical measures and administrative measures used to protect information assets from deliberate or inadvertent unauthorized acquisition, damage, disclosure, manipulation, modification, loss, or use…” [McDaniel - IBM Dictionary of Computing 1994] It is more beneficial to focus on good planning then it is to rely solely on fancy technology. Southwest Educause 2003 © Baylor University 2003

Risks of Poor Security Loss of university productivity Public Relations problems Private Information (SSN, CC numbers, grades, etc.) Degradation or loss of client services Southwest Educause 2003 © Baylor University 2003

Security– As Viewed by Industry Security is a priority (proactive) The ROI for security has become highly visible in the past 2-3 years. Compromise or downtime results in lost profits Southwest Educause 2003 © Baylor University 2003

Security – As Viewed in an University Environment Threat to Academic Freedom A hindrance to research and education productivity Contention for funding Southwest Educause 2003 © Baylor University 2003

Baylor’s Approach to IT Security Our security strategy can be divided into two parts Technology People Southwest Educause 2003 © Baylor University 2003

Security through Technology Firewalls Intrusion Detection Systems VPN (encryption technologies) Logs Server Configuration Vulnerability Scanning Southwest Educause 2003 © Baylor University 2003

Firewalls First line of network protection from outside world Must be strategically placed to be effective in universities One size does not fit all for firewall policies Southwest Educause 2003 © Baylor University 2003

Firewall Recommendations Multiple firewalls are necessary in a university environment Firewall policies should be written with port level filtering. Southwest Educause 2003 © Baylor University 2003

Intrusion Detection Systems Deployment must be highly targeted Networks and servers must be understood to limit false positives Not a substitute for good security practices Southwest Educause 2003 © Baylor University 2003

Virtual Private Networks Ideal for limiting access and securing data transmission Great for extending the university network to students and remote campuses Southwest Educause 2003 © Baylor University 2003

Logs Vital to identifying and resolving server and network problems Subtle or well planned attacks may only be seen through log evaluation Raises questions of academic freedom and big brother Southwest Educause 2003 © Baylor University 2003

Server Configuration Servers should only run daemons/services that are necessary Use mailing lists and OS update services to maintain server patches Limit the services on servers that contain critical data Southwest Educause 2003 © Baylor University 2003

Vulnerability Scanning Prioritize scans to focus on critical systems first. Be aware that false positives are common with scanning tools Scanning results can be used to point to weak points in networks and servers before they are abused Southwest Educause 2003 © Baylor University 2003

Security through People Policies Procedures Education Southwest Educause 2003 © Baylor University 2003

Policies-Creation Important to bring in other departments Anticipate problems Try to make policies broad enough to cover many issues Southwest Educause 2003 © Baylor University 2003

Policies-Modification Be flexible Policies are an ongoing work There will always be exceptions to policy Southwest Educause 2003 © Baylor University 2003

Policies-Enforcement Must have administrative backing for policies Helpful to explain this to various departments Must establish consistent method for dealing with student violations Document ALL enforcement actions taken Southwest Educause 2003 © Baylor University 2003

Procedures When done appropriately-procedures can be used to prevent many problems These are very time consuming… …but can eventually save time and headaches by preventing obvious security lapses. Southwest Educause 2003 © Baylor University 2003

Education End-User education Server admin education Support Staff education Southwest Educause 2003 © Baylor University 2003

End-User Education Most important thing is educating end-user on sound password practices. Users are more likely to follow policies and rules if they understand reasons for them Teach users to notice things that don’t seem right Southwest Educause 2003 © Baylor University 2003

Server Admin Education Teach importance of keeping systems up to date Encourage sound local account practices Try to bring other admins in other schools into the security community Southwest Educause 2003 © Baylor University 2003

IT Staff Education Support Staff are many times ignorant of sound security practices Many IT users in general never consider security when doing their jobs. We must also try to bring them into the security community Southwest Educause 2003 © Baylor University 2003

Security is everyone’s job! Southwest Educause 2003 © Baylor University 2003

On the Horizon Proactive and correlative IDS Stricter laws forcing security in universities Probable increase in security incidents Southwest Educause 2003 © Baylor University 2003

Summary Complete security solutions must address both technology and people Technology solutions are only as good as the policies they are enforcing Security strategies must depend upon and encourage cooperation from people in the organization Southwest Educause 2003 © Baylor University 2003

Contributors: Speakers: Bob Hartland Tommy Roberson Director for IT Servers and Network Services Bob_Hartland@Baylor.edu Tommy Roberson Manager of Servers and IT Security Tommy_Roberson@Baylor.edu Jon Allen Coordinator of IT Security Jon_Allen@Baylor.edu Southwest Educause 2003 © Baylor University 2003

Copyright Bob Hartland, Tommy Roberson, and Jon Allen 2003 Copyright Bob Hartland, Tommy Roberson, and Jon Allen 2003.This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author. Southwest Educause 2003 © Baylor University 2003