Leaders’ Forum, March 16, 2006 The Invisible Risk: Leaders’ Role in Protecting Western’s Electronic Information

IT Security @ Western is a shared responsibility Debbie Jones Director, Information Technology Services

Photos courtesy Flickr.com

It’s the Internet - Expect the unexpected What’s next? It’s the Internet - Expect the unexpected

Western’s Layered Security

Gateway Routers Provides routing and denial of routing by IP or port Block certain Denial of Service attacks Block port based scans Blocks attacks against specific ports such as email, some microsoft ports and sql database ports

Gateway Intrusion Protection Can block or log traffic by IP, port, pattern or protocol First line of defense against new viruses Identifies certain traffic patterns and automatically blocks Detects and automatically blocks on-campus and off-campus scanning or network problems

Firewall Registered Services Ensure protocol integrity Restrict what machines on campus receive special traffic (email, ftp, http, database requests..) Ensure protocol integrity Allows for fine grained rules for accepting or rejecting specific types of traffic Customizable for different networks on campus

Trend Antivirus Email Scanner Rejects certain types of attachments that are high risk of carrying malicious code Detects viruses in incoming emails and strips the virus attachment off

Anti Spam Technology Spam can be a nuisance (like junk mail), or a threat laced with viruses, malware, phishing or links to unsavoury web sites Western’s spam control Of the 8.3 million email connections per week, 68% were rejected and a further 5% were tagged as SPAM

Ramp Provides locking and unlocking of infected systems on campus Provides the setting of service specific protection Provides systems administrators with a quarantined network for new or infected machines Provides systems administrators access to security scans

Trend Antivirus Anti-Spyware Campus wide license Protects PC’s from known viruses and malware ITS Server automatically updates 4,800 PCs at Western 8 servers in other areas update another 3,000 PCs PC-cillin is on 7,000 home computers and 5,000 residence computers

Operating System Patches Operating Systems are vulnerable and hackers continually find new ways of ‘sneaking in’ Patches close the vulnerabilities to prevent them from being exploited by hackers and worms ITS server automatically sends patches to over 5,000 desktops on campus

Western’s Layered Security

Protecting Western ITS Network Security office nso@uwo.ca Responsible for maintaining a secure and stable network and data infrastructure for campus. Implements and supports the ‘many layers’ of protection Monitors network activity for anomalies and deals with problems Responds to security incidents or calls for help Makes new tools available to campus ITS Computer Wellness Clinics Laptops and computers may be brought to the clinic to be cleaned of viruses and malware (by appointment, weekdays 8:30-4:30) Book an appointment by emailing computer.wellness@uwo.ca System Administrators all around campus All of the heros across campus that maintain and protect computers with appropriate anti-virus software and security patches.

Working Group on Information Security (WGIS) Members provide broad expertise and input into IT Security Issues Graduate students Campus system administrators Faculty members Information Technology Services USC PeopleSoft Resource Group Office of the Registrars Housing Internal Audit Campus Police General Counsel Research Services Human Resources Communications and Public Affairs Terms of reference include: Responsibility for drafting and recommending IT security policies Responsibility for IT security awareness on campus started “ Computer Wellness Campaign” last September

Excerpts - Computing Resources Policy Information Technology Services shall be responsible for establishing, maintaining, implementing, administering, and interpreting organization-wide information systems security standards, guidelines, and procedures. Unit Heads, including Directors, are responsible for ensuring that security policy is implemented within the unit. System Administrators will work closely with ITS and ensure that systems they administer are operated in accordance with all applicable Information Security Standards and Policies Any person, group, or custodian accessing University information must recognize the responsibility to preserve the security and confidentiality of this information.

Computer Wellness Campaign Website http://wellness.uwo.ca Posters in Middlesex College, USC, Office of the Registrar, Libraries, Genlabs, all Food Services Areas & Residences Poster set as background in the Genlabs & the Sun Rays in the Western Libraries. Film Western airing the poster at the beginning of each film. CHRW Audiozine and advertisements Mass Mailer sent to all Western Students, Staff & Faculty Articles in the Western News and Gazette Links off http://www.uwo.ca

How can you protect Western?

How can you protect Western? Understand the policies and best practices Read the Security related policies and best practices at http://www.uwo.ca/univsec/mapp/ MAPP 1.13 Code of Behaviour for use of Computing Resources MAPP 1.20 Computing Resources Security MAPP 1.21 Wireless Networking Policy Visit the Computer Wellness Site at http://wellness.uwo.ca for more information

How can you protect Western? Ensure your system is protected Your system should always be protected with the latest anti-virus software and security patches. Think of it as a seatbelt and…. Buckle up! Know who is responsible and can help you if the system is not protected or has been compromised (or locked off the network)

How can you protect Western? Don’t download freeware at work It may not be as ‘free’ as you think. Spyware, malware, trojans & keystroke loggers are often hidden within ‘freeware’. Remember Don’t take gifts from strangers! If you need additional software installed, contact your Systems Administrator for assistance

How can you protect Western? Don’t surf suspicious websites Limit your web surfing to known University or commercial websites. Always X out, don’t click ‘OK’ or ‘NO’ or ‘unsubscribe’ Practice safe and responsible surfing

How can you protect Western? Use strong passwords Keep your passwords in a secure place Avoid common words: hackers can crack dictionary passwords Passwords are like underwear They protect privacy They should never be shared The longer, the better

How can you protect Western? Protect the data you use Think before storing, publishing or sharing data Is the data sensitive? Does it need to be portable? Who should see it? How have you protected it so that only those that should see it have access? Mobile data on laptops and USB keys is at risk - Leave it, Lose it.

How can you protect YOUR information? Recognize phishing and don’t fall for it Phishing can come through emails or web sites Phishers are getting better, scams are getting trickier to detect Be suspicious when personal or private information is involved and Don’t Get Phished When in doubt, ask

And let’s not forget your Home Computer!