University Business - November/December 2010 - (Page 54)

friend or foe? Just consider the number of RIAA subpoenas colleges and uni- User Education versities have received and a clear picture of how difficult it is to Getting users to self-monitor is that final layer of network proteccontrol students’ online activity emerges. But that doesn’t mean IT tion. “There are conduct policies about not surfing to sites that administrators can’t keep an eye on them. would create a hostile environment,” says Seybold. “I’m proud to say we don’t block sites. We try to educate and Users are finally getting the message not to open e-mail attachhelp people make good decisions,” says Marty Peterman, an IT se- ments from people they don’t know. The new message: Don’t click curity analyst at the University of Virginia. “If you put in security on unknown links. But that doesn’t apply to social media sites. “It’s controls that are just too harsh, users will just do an end run.” not working,” says Seybold. “The bad guys go out of their way to Also, with the rise in using social media for recruiting purposes, make those links attractive.” Bertone explains, “The nature of sothere are legitimate reasons to be on Facebook and Twitter during cial media lends itself to social engineering. People are accustomed the work day. (While what they share is another matter, solutions are to divulging personal information and making new connections. available to ensure no one is posting Social Security Numbers to pub- Once you trust who you think they are your guard is down.” lic websites.) “Be selective about blocking or alerting,” Bertone says. Another hacker tactic is embedding a virus in a fake site about a “Our policies are technology agnostic. We don’t try to enumer- hot topic, says Feinman, who saw such sites when Michael Jackson ate new technologies that come into use. It would be an endless list. died and when Tiger Woods’ mistresses were in the media. “FaceWe just say, ‘If you have sensitive data, this is where it must be se- book doesn’t go through all links on the site checking for a virus.” cured,’ ” explains Peterman, who uses an Identity Finder solution for So schools should continue to hammer home the safe computthat purpose. Each department determines how frequently employ- ing message. “As a new student, you can’t get on the network unees run the program based on how much sensitive data they store. less you’ve taken a cyber security tutorial,” says Peterman. “If people Higher ed administrators are good about being proactive and would go ahead and hold to a few basic tenets of cyber security learning from peers’ mistakes, says Todd Feinman, CEO at Identity awareness, the vast majority of our issues would vanish.” But the Finder. Instead of just blocking social media sites campuswide, he’s issue is a human nature question, not a matter of students having seeing institutions selectively blocking access on certain computers unsafe computer practices. “When I talk to people I point out that where the ability to tweet isn’t necessary. Pushing out antivirus soft- even I am one click away from making the same mistake,” he says. ware to students protects the network and can save cleanup time and Distraction can be as much of a danger as curiosity. costs if a virus does break through. “But if they get a malware infection, that one time is definitive “We find people aren’t updating their machines and are getting for changing their behavior,” he adds. hit by something patched last year,” says Peterman—despite UVa “Define a policy, notify users, and have the teeth to enforce it,” providing antivirus software. “We figure that if you are a student at advises Leclerc, who points out that every campus should have an UVa you have the wherewithal to know you have to be up to date. acceptable use policy in place and shouldn’t worry about pushback. We provide it but we don’t push it. Our respect for privacy extends “We’ve seen it from faculty and staff as well; if you are doing legitito what is installed on their computer.” mate research why would you care if someone sees what websites As students are working to get around the network security mea- you’re visiting?” sures meant to protect them so their devices have the best access Reminding people to be careful is only a piece of the puzzle. possible, they’ll still be first to complain if the network goes down. “User education can only go so far,” says Bertone. “You can’t put all The pressure to maintain internet speed while students are pushing the onus on your users to not do anything dangerous.” the envelope on capabilities is a big issue in higher ed, says Shalita. “Any assumption that starts with the idea that a handful of IT “If things work out, our total bandpeople will be able to protect all these width would be 400MB, and the bulk people is that it’s impossible,” says Seyof that is being tied to what we’re seebold. “The truth is the technologists ing from social media,” especially video Alcatel-Lucent, www.alcatel-lucent.com can do their best, but it’s not as effecviewing, says Seybold at Old Westbury. Bradford Networks, www.bradfordnetworks.com tive as people taking responsibility for “That is going to force policy issues. Are Cisco, www.cisco.com their own actions. you going to keep throwing money at Cyveillance Cyber Intelligence Report, “The two need to work together, www.cyveillance.com/cyberintelreport-1H10 bandwidth or change policies?” Bandbut they are usually fighting,” SeyFidelis Security Systems, www.fidelissecurity.com width was much more manageable and bold continues, adding that there is GFI Software, www.gfi.com affordable before the proliferation of a silver lining. “The conversations are IBM, www.ibm.com sites that encourage the distribution of just beginning. The negative conseIdentity Finder, www.identityfinder.com video, he adds. He suggests providing quences are just getting bad enough NetScout Systems, www.netscout.com users with a bucket of network access that people are realizing we all have to Palo Alto Networks, www.paloaltonetworks.com to use at will. The first time they use all work together.” Reputation Defender, www.reputationdefender.com their access for recreation and can’t get And that teamwork will be anResponsible Computing at UVa., their homework done, they’ll be better other layer of protection keeping the http://itc.virginia.edu/pubs/docs/RespComp about monitoring their usage, he says. campus network safe. Resources 54 | November/December 2010 universitybusiness.com http://www.alcatel-lucent.com http://www.bradfordnetworks.com http://www.cisco.com http://www.cyveillance.com/cyberintelreport-1H10 http://www.fidelissecurity.com http://www.gfi.com http://www.ibm.com http://www.identityfinder.com http://www.netscout.com http://www.paloaltonetworks.com http://www.reputationdefender.com http://itc.virginia.edu/pubs/docs/RespComp http://www.universitybusiness.com

Table of Contents for the Digital Edition of University Business - November/December 2010

University Business - November/December 2010
Contents
Editor's Note
College Index
Company Index
Advisory Board
Behind the News
Viewpoint
Financial Aid
Models of Efficiency
An Edible Arrangement
Friend or Foe?
Sense of Place
Independent Outlook
Internet Technology
What's New
End Note

University Business - November/December 2010