MYP ICT: Unit-3

UNIT 3 : IT Security

A.O.I : Approaches To Learning

D E S I G N C Y C L E

1.Investigate :-

What is IT Security?

Broadly speaking, IT security is about keeping electronic information private and protected from falling into the hands of those without authorization to see or use that information. To implement IT security, the Institute looks at how to meet requirements of various regulations and laws relating to information protection. To ensure compliance, policies must be implemented and adhered to.

IT security is about protecting the integrity, accessibility, and reliability of electronic information and with the behaviors and actions of computer users as they impact the privacy and safety of all members of the Internet community. IT security works with physical security to ensure protection of information, whether electronic or hardcopy.

Whose Job Involves IT Security?

Computers and the information they hold can be invaluable. Because there is a limit to their built-in protection, it is the responsibility of the individual to ensure the confidentiality, integrity and availability of this technology and information. IT security is everyone's job.

The Situation Today

IT security -- and specifically cyber or internet security -- has become one of the main concerns at businesses and organizations today. Consider these statistics:

112 universities reported a data breach in 2007 alone, an increase of 72.3% over 2006.
48% of data breaches at universities last year were due to employee behavior, including unauthorized disclosure, employee fraud, loss, and a lack of knowing where sensitive data is being stored. Theft, impersonation, and attacks are the other factors leading to exposure.
8.1 million U.S. residents were victims of identity theft in 2007. That represents 3.6% of adults. The total cost of identity theft in 2007 was $45 billion.
The average cost per company suffering a data breach is more than $6.3 million per breach.

Securing Devices

Computer and data security is each person's responsibility. Make sure that your personal computers, the computers you are using or managing on campus, as well as the data they contain are secured at all times when connected to MITnet (learn more about MITnet and its open network).

An unprotected computer is especially vulnerable to cyber attacks, spam, or other threats that can compromise a user's identity or undermine the security of a computer's hardware and data. Even before you arrive on campus, make sure that your computer will be as safe as possible from viruses and other malicious programs that are rampant on the Internet.

Tips and Best Practices
Most of the security problems with computers stem from common mistakes users make or precautions they don't take. Writing down passwords, clicking on links or attachments in shady emails, or walking away from a computer with the screen unlocked are just a few. Prevention can be easy. Start today by applying the top 10 safe computing tips.

Viruses, Spyware & Malware
If you arrive on campus with a computer infected by a virus, or if it becomes infected after arrival, you may lose access to the network or your data may be at risk until the problem is resolved. This can take hours, endanger your personal documents, and require you to reformat your hard drive and reinstall your operating system and all your applications from scratch. Can you recognize the symptoms of malware? Learn what you can do to avoid an infection.

Patches & Updates
Many viruses, worms, and other malware exploit software flaws on your computer in order to do their work. Although you may not think patching is critical when a computer seems to be working fine, over time these flaws can leave the door open for malware to come in. Knowing how to patch your computer automatically while at MIT can prevent major headaches.

Firewalls
Firewalls are built right into a computer's operating system and by default should be turned on. But how the firewall is configured determines the computer's defense against unwanted incoming connections. Do you know how to check your firewall's settings?

Backing Up Important Files
Computers are fragile machines and can be easily destroyed in a fire or other catastrophe. They can also be stolen or lost. To prevent losing your personal or critical data, back it up on a regular basis. MIT offers Tivoli Storage Manager (TSM), which allows you to back up to and restore files from a secure server. Use this option or find out other ways to back up your files.

Loss & Theft
A stolen computer or hard drive containing important or sensitive information can spell disaster for you as an individual, or for the Institute. Learn some important tips about securing your computer physically and what to do if loss has occurred.

Mobile Phones
Mobile phones today have larger flash drives and can contain more data than ever before. Plus, smart phones enable you to store files, emails, and other personal or business information right onto the device. Hundreds of thousands of mobile phones are lost or stolen in the US every year. Here are some best practices for securing mobile phones.

Tips for Traveling
The number of laptops lost or stolen at US airports is reported to be in the hundreds of thousands per year. When you're traveling and taking your computer or smart phone with you, be aware of the risks and the precautions you can take to avoid becoming a statistic.

Password Policy

For a detailed discussion on password management, see the "Green Book" [green].
The combination of username and password define the identity of users on a system. Adopting a good personal password policy is the most important barrier to unauthorised access in current systems.

General Software Policy

Public domain software may be used on class & systems with a TCB (i.e. not DOS/Windows), if the system administrator responsible for the installation is convinced of the integrity of the author / sources.
Public domain software on class systems is to be avoided. However, when necessary, it is only allowed after either a review of the source code, or (if the source is too big) after the software is in general use for at least a year on comparable systems in many other (well known and trusted) companies and the software has been rigorously tested in a protected environment.
Unlicensed software should not be used.
Games are allowed on the system, if the system administrator can ensure that they will not use more that 5% (for example) of resources (disk/memory/CPU) and they are not abused.
Unix: set-user-id (SUID) and set-group-id (SGID) scripts are not allowed on the system. Use tainted perl or compiled programs instead.

Networks

Confidential information:

Confidential data transmitted over public networks shall be encrypted.

Connection to networks:

A User may not connect a machine to any network except the corporate LAN.
Access to external (public & private) networks shall occur over a Firewall. All Firewalls shall be installed and maintained by corporate security.

Modems:

Users may not have modems on their machines.
Dial-in access to the corporate LAN is allowed for certain users. All Dial-in access shall occur via secured Servers with one-time-password mechanisms.

Users should be aware that conventional email systems often guarantee neither privacy or proof of origin or receipt. In many systems the system administrator can read all email.
Class data may be sent internally within the company without encryption. Class should be encrypted. Class data may not be transmitted via email.
Only Class data and information specifically allowed for projects with external entities may be emailed outside the company.
Users should be aware of the risks of opening documents with macros, postscript files, and installing programs received via email.

Internet

Connection to the Internet is almost inevitable in today's commercial environment, especially for research departments. Due to it's lack of structure & controls, the Internet offers many risks such as:

Disclosure of confidential information.
The corporate network may be penetrated by hackers from the Internet.
Information may be changed or deleted.
Access to systems could be denied due to system overload.

If users are to be allowed Internet access, they must be aware of the risks involved and the corporate policy as regards Internet usage => A specific Internet policy should exist, be well known and be enforced.

All outgoing access to the Internet must go over approved company gateways which have been certified as conforming to the corporate security policy.
Who is allowed standard (WWW) Internet access? (e.g. administrators, research units)
Who is allowed Internet email access? (e.g. everyone!)
When is access not allowed? (e.g. not from class servers).
What Internet client software are allowed (e.g. corporate standards)?
What may Internet clients not be used for? (e.g. Pornographic material, downloading dangerous or unlicensed software, excessive private use etc.)
Who may provide Internet services? Under what conditions (e.g. approved Firewall policy, only publicly classified information may be published).

Laptops and portable computers

Portable computers allow personnel to be more productive while "on the road". They offer flexibility as to where one can access information. From the security point of view they can create risks of information disclosure, theft and perhaps offer an unauthorised point of access to the corporate network. The mobile computing population is on the increase, so a special policy is necessary.
Some issues are:

Educate users as to the risks of Laptop usage.
Password protection in office applications such as Winword is not a protection against the informed attacker.
Removable hard disks allow the user to easily protect the most important component by putting it in his pocket. On the other hand, it makes it easier to steal information.