1. IT Audit 2006 Deborah Joyner, Marjorie Tucker, Kay Simpson, Dawn Rountree, Kathy Jones

2. What This Is  Report of Draft Findings from schools that have been audited so far  The names of the schools have been changed to protect the innocent!

3. What this is NOT  Recommendations on how to fix any of these issues  That would take way more than 15 minutes!

4. Draft Report  Sensitive Security Letter  Public Letter  Minor Findings

5. Sensitive Security Letter  Access Controls World Writable Files. Users with the ability to add programs to the job scheduler and batch functions User profiles not set up appropriately, specifically the PATH statement. Password aging for the root account is not appropriate

6. Access Controls, cont. The system did not have any /.profiles for our sample of users. Therefore, there is no PATH statement to direct the users to the /.coll.menu prior to logging into the Colleague application. The system did not have any /.profiles for our sample of users. Therefore, there is no PATH statement to direct the users to the /.coll.menu prior to logging into the Colleague application. The Users' actual home directories do not agree with the listing in the /etc/passwd file. Therefore, the users without home directories could directly login at the root level by default.

7. Access Controls, cont.  College provides too much information about the operating system by providing the version and vendor name of the operating system in its welcome banner. This weakness allows an unauthorized user to easily research known vulnerabilities that can affect the operating system.  College has not configured the system to expire passwords.

8. Network Access Controls  Configuration files were not appropriately configured to secure the operating system from common Network attacks, such as Ping floods, and SYN floods.  The FTP service has not been configured appropriately to restrict access to only authorized users.  The operating system can act as a router, which poses a security risk.

9. Security and Maintenance of the Operating System  Solaris security patches should be installed in a timely matter.

10. Public Letter  NCCCS has not provided Community Colleges with a baseline configuration for securing the critical operating system. The critical operating systems may not be secure from commonly known vulnerabilities.  Risk Assessment  Test of Disaster Recover Plan

11. Minor Findings  UPS had not been tested within the past twelve months.  Various unnecessary services (ports) were running on the operating system.  Fire extinguisher is not equipped for use around computer equipment.