All university-owned PCs, servers and network equipment must have some form of authentication system using a strong password or certificate. All users should use authentication when accessing these resources and computing sessions should be closed when not in use. Encryption should be utilized if available.
PCs and servers should be configured and managed so that anonymous and guest access is disabled unless specifically required.
Sharing of usernames/passwords is prohibited and the use of strong passwords is highly encouraged. A strong password should be at least eight (8) characters long. It should not contain a word found in a dictionary and should include numbers and non-alphanumeric characters.
Many vulnerabilities exist in stock/default installations of operating systems such as Windows and Linux. The risk of a system being compromised increases if a newly installed system is placed on the IUP network before it has been properly secured. A compromised system will need to be re-installed and properly secured before placing it back on the IUP network.
All computing media, files, data, and information should be protected by file system security such that access control lists are set for specific accounts that require access to the resource. Encrypting and password protecting files offer an additional layer of protection. If data is to be shared via the network (network share, ftp site, website), access/control should be applied in the same manner.
Unpatched or out-of-date computer software is one of the primary reasons computer viruses, worms, and hackers are able to compromise a system. Update the server or PC regularly and on-demand when a critical vulnerability is announced. Most attacks are performed on known vulnerabilities in situations where a vendor provided patch has not been applied. Information on software vulnerability notification from a variety of vendors can be found in the IT Security Resourcespage. Vendors typically provide instructions on obtaining and installing patches. Some vendors, like Microsoft, provide free tools for end-users to use such as Windows Update. Red Hat Linux also provides a RHN (Red Hat Network) and yum service.
Many exploits use vulnerabilities found in obscure or unused features in various computer software. Most exploits are created to compromise as many systems as possible, relying on systems with default configurations and/or systems with various features turned on by default. Minimizing the default configuration will limit exposure to automated brute-force hacker scripts/kits, worms and attacks on unknown vulnerabilities.
Uninstalling unused software eliminates exposure to vulnerabilities in the unneeded software and is a great technique for helping to secure the server or PC. In addition, disabling unneeded network services will remove those vulnerabilities and is highly encouraged.
Freeware, shareware and public domain software should only be installed when obtained from a reputable source. Open source software should be downloaded from the project website or trusted mirrors.
IUP’s network is routable to the Internet. Systems and networks across the Internet are scanned constantly by potential attackers seeking vulnerabilities. Using a personal firewall can help protect the server or PC. A firewall acts as an interface between two networks, while regulating, isolating, and/or filtering network traffic. Many network operating systems come with a host-based firewall (Windows 7, Red Hat Enterprise Linux, etc.). There are also third-party companies that sell personal firewall packages, and some distribute free versions. Even if a firewall is used, it is still important to maintain local security of the system as firewalls can sometimes be evaded or defeated.
There are over 100,000+ known forms of malware (viruses, worms, bots, and trojans). It is imperative that antivirus software be installed and updated. IUP provides Sophos antivirus software.
Log monitoring can detect malicious activity and/or unauthorized access to the system. Use of an audit trail is recommended. Unexplained unsuccessful log-on attempts found in logs should be reported to the IT Support Center for review.
System backups to removable media are recommended for use in the case of system compromise, accidental deletion of files, hardware failure, theft, etc.
The IT Support Center must be contacted immediately in cases where a system compromise and/or malicious activity is suspected.
Fraud, Waste, and Abuse Hotline
© 2007–15 Indiana University of Pennsylvania
1011 South Drive, Indiana, Pa. 15705 | 724-357-2100