Information Security
Awareness
for
Systems Administrators
Why Us?
• Institutions of Higher Education are far
more tantalizing targets
• Exploit vulnerabilities and weaknesses
• Publicity/recognition for hacking
• Profitability a key motivator
• The threat from within
• *Over 44% of incidents in 2007
targeted Education and Government
*per Web Application Security Consortium
Roles and Responsibilities
•
•
•
•
•
•
•
•
Strong Passwords
Data Backups
Physical Security
Daily Log Reviews
Software Licensing
User Access
P2P File Sharing
Avoid Disclosure/Compromise
Minimum Security Standards for
Systems – Backups (Cat I)
• Establish/follow regular system
backups
• Monthly verification of backups
through customer/trial restores
• System administrator must maintain
documented restoration procedures
for systems and the data on those
systems
Minimum Security Standards for
Systems – Change Mgmt (Cat I)
• System configuration/documented
change control process
• Evaluation of system changes prior to
application in production environment
- test patches
- if no test environment, communicate
to data customer
- communicate change in environment
due to patches
Minimum Security Standards for
Systems–Virus Protection (Cat I)
• Install & enable Antivirus software
• Recommend installation of Antispyware software if browsing
• Must be configured to update daily
• Maintain/make available a description
of the standard configuration of
antivirus software
Minimum Security Standards for
Systems – Physical Access (CatI)
• Physically secure systems in
racks/areas with restricted access
• Physically secure portable devices if
left unattended
• Secure backup media from
unauthorized physical access
• Encrypt backup media if stored offsite OR document process to prevent
unauthorized access
Minimum Security Standards for
Systems – Hardening Checklist
• System is set up in a protected
network environment
• Install OS and application services
security patches expediently
• Enable automatic notification of new
patches
• Disable/uninstall services/apps/user
accounts not being used
Hardening Checklist
(continued)
• Limit connections to services running
on host to authorized users only
• Encrypt commo & storage of services/
apps for systems using Cat I data
(confidentiality-integrity-availability)
• Integrity checks of critical OS files &
system accounts (user least privilege)
• University warning banner required
• Use of strong passwords
Minimum Security Standards for
Systems – Security Monitoring
• Enable and test log activities
• Document and routinely monitor/
analyze OS/service logs
• Follow a documented backup strategy
for security logs (e.g., acct mgmt,
access control, data integrity, etc.)
• Retain security logs 14-days minimum
• Admin/Root Access must be logged
Minimum Security Standards for
Systems
• For more information please visit the
Information Security Office website at
http://admin.utep.edu/Default.aspx?alias=
admin.utep.edu/securityawareness
Password Security
• At Least 17-characters in length
• Do not share or disclose
• Use complex or pass phrases
containing letters, numbers and
special characters
• Change at least every 6-months or if a
suspected compromise exists
• Change anytime Team Member leaves
Safe Practices
•
•
•
•
•
•
•
Browsing and downloading
Privacy
Misuse of domain credentials
Remote access
New users and folder shares
Disable “Remember Password” features
Report suspected compromise of
account(s) or password(s) to ISO
Safe Practices (cont)
• Antivirus – run weekly scans
• User Access – check for appropriate
approvals
• Disaster Recovery
• Business Continuity
• Don’t give away the
“Keys to the Kingdom”
• *Use of SQL Injection was 20% in 2007
*according to Web Application Security Consortium
Statistics
Attack Goal
Stealing
Sensitive
Information
Defacement
Planting
Malware
Unknown
Deceit
Blackmail
Link Spam
Worm
Phishing
Information
Warfare
The Web Hacking Incidents Database 2007 Annual Report
Prepared by O fer Shezaf and Breach Security Labs team
http://www.webappsec.org/projects/whid/statistics.shtml
%
42%
23%
15%
8%
3%
3%
3%
1%
1%
1%
Questions & Answers
Information Security Office web page
http://admin.utep.edu/securityawareness
2007 Statistics:
http://www.webappsec.org/projects/whid/sta
tistics.shtml from Web Application Security Consortium