Leaders’ Forum, March 16, 2006 The Invisible Risk: Leaders’ Role in Protecting Western’s Electronic Information

Leaders’ Forum – March 16, 2006 The Invisible Risk: Leaders’ Role in Protecting Western’s Electronic Information Today’s Speakers: Arni Stinnissen, Detective Staff Sergeant, Electronic Crimes Section OPP Debbie Jones, Director of Information Technology, Western

The Internet: Friend or Foe? Arni Stinnissen

e-Crime Mandate  provide technology investigative expertise in the areas of conducting forensic computer searches  conduct traditional investigations in which computers are being used as a tool  investigate computer crime as defined in the Criminal Code  and act as consultants in investigations where technology is being used to further a crime.

New Challenges to Courts  Speed of the Internet/no borders  Mass storage  Understanding digital technology  Non-Internet Specific laws

The Computer as the Suspect, Victim and Witness  Where computer has documents, records, or pictures that are evidence of an offence  Murder/Suicide journals, letters, s kept on a computer  Drug Trafficking debt lists, customer lists, suppliers  Child Pornography pictures stored on computer

Privacy on the Internet

E-Commerce  E-Banking based on 128 bit encryption via Internet  Vulnerable when dormant  Trojan horse intrusion

ON-LINE Identity theft  What do you need for identity?  Dumpster diving/Recycling bins  The Web Birth Certificates SIN#’s

Identity theft  Anti-Phishing.org December reportDecember report  Real Site Real Site  Phished Site Phished Site  Sample

Virtual Communities  Myspace.com

Safety and Security  Firewalls  Viruses  Software Patches

Questions? D/S/Sgt. A.K. Stinnissen (705)

IT Western is a shared responsibility Debbie Jones Director, Information Technology Services

Photos courtesy Flickr.com

Western’s Layered Security

Gateway Routers Provides routing and denial of routing by IP or port Block certain Denial of Service attacks Block port based scans –Blocks attacks against specific ports such as , some microsoft ports and sql database ports

Gateway Intrusion Protection Can block or log traffic by IP, port, pattern or protocol First line of defense against new viruses Identifies certain traffic patterns and automatically blocks Detects and automatically blocks on-campus and off-campus scanning or network problems

Firewall Registered Services –Restrict what machines on campus receive special traffic ( , ftp, http, database requests..) Ensure protocol integrity Allows for fine grained rules for accepting or rejecting specific types of traffic Customizable for different networks on campus

Trend Antivirus Scanner Rejects certain types of attachments that are high risk of carrying malicious code Detects viruses in incoming s and strips the virus attachment off

Anti Spam Technology Spam can be a nuisance (like junk mail), or a threat laced with viruses, malware, phishing or links to unsavoury web sites Western’s spam control –Of the 8.3 million connections per week, 68% were rejected and a further 5% were tagged as SPAM

Spam Tagging

Ramp Provides locking and unlocking of infected systems on campus Provides the setting of service specific protection Provides systems administrators with a quarantined network for new or infected machines Provides systems administrators access to security scans

Trend Antivirus Anti-Spyware Campus wide license Protects PC’s from known viruses and malware ITS Server automatically updates 4,800 PCs at Western 8 servers in other areas update another 3,000 PCs PC-cillin is on 7,000 home computers and 5,000 residence computers

Operating System Patches Operating Systems are vulnerable and hackers continually find new ways of ‘sneaking in’ Patches close the vulnerabilities to prevent them from being exploited by hackers and worms ITS server automatically sends patches to over 5,000 desktops on campus

Protecting Western ITS Network Security office –Responsible for maintaining a secure and stable network and data infrastructure for campus. –Implements and supports the ‘many layers’ of protection –Monitors network activity for anomalies and deals with problems –Responds to security incidents or calls for help –Makes new tools available to campus ITS Computer Wellness Clinics –Laptops and computers may be brought to the clinic to be cleaned of viruses and malware (by appointment, weekdays 8:30-4:30) –Book an appointment by ing System Administrators all around campus –All of the heros across campus that maintain and protect computers with appropriate anti-virus software and security patches.

Working Group on Information Security (WGIS) Members provide broad expertise and input into IT Security Issues Graduate studentsCampus system administrators Faculty members Information Technology Services USCPeopleSoft Resource Group Office of the RegistrarsHousing Internal AuditCampus Police General Counsel Research Services Human Resources Communications and Public Affairs Terms of reference include: –Responsibility for drafting and recommending IT security policies –Responsibility for IT security awareness on campus started “ Computer Wellness Campaign” last September

Western Policies Provides structure Establishes campus wide practices and understanding Clarifies roles Assigns responsibility Empowers Information Technology Services, Unit Heads and Systems Administrators to protect the network integrity and security

Excerpts - Computing Resources Policy Information Technology Services shall be responsible for establishing, maintaining, implementing, administering, and interpreting organization-wide information systems security standards, guidelines, and procedures. Unit Heads, including Directors, are responsible for ensuring that security policy is implemented within the unit. System Administrators will work closely with ITS and ensure that systems they administer are operated in accordance with all applicable Information Security Standards and Policies Any person, group, or custodian accessing University information must recognize the responsibility to preserve the security and confidentiality of this information.

Computer Wellness Campaign 1.Website 2.Posters in Middlesex College, USC, Office of the Registrar, Libraries, Genlabs, all Food Services Areas & Residences 3.Poster set as background in the Genlabs & the Sun Rays in the Western Libraries. 4.Film Western airing the poster at the beginning of each film. 5.CHRW Audiozine and advertisements 6.Mass Mailer sent to all Western Students, Staff & Faculty 7.Articles in the Western News and Gazette 8.Links off

Western’s Layered Security

How can you protect Western?

Understand the policies and best practices Read the Security related policies and best practices at –MAPP 1.13 Code of Behaviour for use of Computing Resources –MAPP 1.20 Computing Resources Security –MAPP 1.21 Wireless Networking Policy Visit the Computer Wellness Site at for more information

How can you protect Western? Ensure your system is protected Your system should always be protected with the latest anti- virus software and security patches. Think of it as a seatbelt and…. Buckle up! Know who is responsible and can help you if the system is not protected or has been compromised (or locked off the network)

How can you protect Western? Don’t download freeware at work It may not be as ‘free’ as you think. Spyware, malware, trojans & keystroke loggers are often hidden within ‘freeware’. Remember Don’t take gifts from strangers! If you need additional software installed, contact your Systems Administrator for assistance

How can you protect Western? Don’t surf suspicious websites Limit your web surfing to known University or commercial websites. Always X out, don’t click ‘OK’ or ‘NO’ or ‘unsubscribe’ Practice safe and responsible surfing

How can you protect Western? Use strong passwords Keep your passwords in a secure place Avoid common words: hackers can crack dictionary passwords Passwords are like underwear –They protect privacy –They should never be shared –The longer, the better

How can you protect Western? Protect the data you use Think before storing, publishing or sharing data –Is the data sensitive? –Does it need to be portable? –Who should see it? –How have you protected it so that only those that should see it have access? Mobile data on laptops and USB keys is at risk - Leave it, Lose it.

How can you protect YOUR information? Recognize phishing and don’t fall for it Phishing can come through s or web sites Phishers are getting better, scams are getting trickier to detect Be suspicious when personal or private information is involved and Don’t Get Phished When in doubt, ask

And let’s not forget your Home Computer!

What’s next? It’s the Internet - Expect the unexpected

Thank you! Arni Stinnissen - Debbie Jones - Questions?

Leaders’ Forum – March 16, 2006 The Invisible Risk: Leaders’ Role in Protecting Western’s Electronic Information Table Dialogue: Take 15 minutes to 1.Discuss what stood out for you 2.Formulate a question to pose to Arni or Debbie

Leaders’ Forum – March 16, 2006 The Invisible Risk: Leaders’ Role in Protecting Western’s Electronic Information Paul Davenport (President and ViceChancellor) - Reflections…

Leaders’ Forum – March 16, 2006 The Invisible Risk: Leaders’ Role in Protecting Western’s Electronic Information Leaders’ Role: Inform staff Establish safeguards Approve data access Deal with security violations Communicate to HR, ITS, etc. any staff changes that affect access Create a contact list of people responsible for all computers in your area Identify to ITS your technical contact (System Administrator) and a supervisory contact

Leaders’ Forum – March 16, 2006 The Invisible Risk: Leaders’ Role in Protecting Western’s Electronic Information …Next Steps To Support Your Leadership Role: See your “Meeting in a Bag” kit -- some resources for ensuring your unit teams know about the risks, ways to minimize them, and their accountabilities. Thank you for your leadership in keeping Western’s data, Western’s work, and Western’s people safe!

Leaders’ Forum – March 16, 2006 Thank You… Computer Wellness Committee Elgin Austen Jim Dunkin Wendy Kennedy Scott May Geoff Pimlatt Peggy Roffey Ellen Smout

Leaders’ Forum – March 16, 2006 Thank you… Forum Facilitators: Carol AbrahamStephanie Hayne Jennifer AshendenBrian Jeffs Krys ChelchowskiRuta Lawrence Chris CostelloScott May Debra DawsonGraham Newbigging Frank DeGursePeggy Roffey Andrew FullerMalcolm Ruddock Paul GreenwoodNancy Stewart Lori GribbonGlen Tigert Nancy GriffithsPeggy Wakabayashi

Leaders’ Forum – March 16, 2006 Next Leaders’ Forum April 27, 2006, 12:00-2:00 p.m Great Hall