1. May 18, 2005 2005 User Forum Lynda McGinley UCAR Security Security Awareness UCAR Security Lynda McGinley mcginley@ucar.edu 303.497.1821 UCAR Security Lynda McGinley mcginley@ucar.edu 303.497.1821

2. May 18, 2005 2005 User Forum Lynda McGinley UCAR Security Security Awareness Expectations of a Compromise Notification Communication Forensics Patch or rebuild? Notification Communication Forensics Patch or rebuild?

3. May 18, 2005 2005 User Forum Lynda McGinley UCAR Security Security Awareness Our Expectations Servers OS current? Security patches applied? Unnecessary services turned off? No unused accounts? No telnet or r-services? Dangerous applications patched? Servers OS current? Security patches applied? Unnecessary services turned off? No unused accounts? No telnet or r-services? Dangerous applications patched?

4. May 18, 2005 2005 User Forum Lynda McGinley UCAR Security Security Awareness Our Expectations Clients OS current Security patches Communication applications current no autologins Clients OS current Security patches Communication applications current no autologins

5. May 18, 2005 2005 User Forum Lynda McGinley UCAR Security Security Awareness Protect your workstation/laptop Credentials (pass-phrases, pgp keys, etc.) Set your browser cache to low or zero Disallow pop-up windows Unknown source of CD’s/usbdrives (just say no) Protect your workstation/laptop Credentials (pass-phrases, pgp keys, etc.) Set your browser cache to low or zero Disallow pop-up windows Unknown source of CD’s/usbdrives (just say no)

6. May 18, 2005 2005 User Forum Lynda McGinley UCAR Security Security Awareness User best practices Passwords: 6-14 characters alpha/numeric/punctuation mix no dictionary words no names of children/pets/spouses change every 3 months UCAR has a password policy Do you know it? Passwords: 6-14 characters alpha/numeric/punctuation mix no dictionary words no names of children/pets/spouses change every 3 months UCAR has a password policy Do you know it?

7. May 18, 2005 2005 User Forum Lynda McGinley UCAR Security Security Awareness User best practices Danger ahead Account sharing Unknown applications (md5 checksums) Media you get in the mail Email viruses Social engineering Danger ahead Account sharing Unknown applications (md5 checksums) Media you get in the mail Email viruses Social engineering

8. May 18, 2005 2005 User Forum Lynda McGinley UCAR Security Security Awareness User best practices Helpful information: CSAC policies (www.ucar.edu/csac) Appropriate Use policy Legislation Helpful information: CSAC policies (www.ucar.edu/csac) Appropriate Use policy Legislation

9. May 18, 2005 2005 User Forum Lynda McGinley UCAR Security Security Awareness What’s next in UCAR security One time passwords for everyone Store and forward gateway Kerberos PGP for email? What’s next in UCAR security One time passwords for everyone Store and forward gateway Kerberos PGP for email?

10. May 18, 2005 2005 User Forum Lynda McGinley UCAR Security Security Awareness Questions?