Security Policy Review

I looked at the Fox Valley Tech website and noticed that it was rather easy to navigate to the schools policy page. The schools Policies & Procedures have been laid out into three groups.

1. Emergency Closings

2. Affirmative Action/ EOE

3. College Policies

The Policies & Procedures page can be found by navigating the link bar tabs that run along the bottom of the Fox Valley Tech websites header, located at www.fvtc.edu . Hoover over the about FVTC tab and you will notice the Policies tab that has an arrow pointing to the three groups. I clicked directly onto the tab that said Policies. (Disregarding the arrow altogether) Clicking on the tab in the manner described, quickly brought me to the Policies & Procedures page.
For even a quicker way to reach the page, use this URL. (http://www.fvtc.edu/public/content.aspx?ID=1450&PID=24)

The Emergency Closings Policies are not as crucial to the security of the school as is the many other Administration Policies.
I think that the Emergency Closing Policies have been grouped separate from the other policies in order to create ease of navigation.

The Affirmative Action/EOE Policies are nothing more than the schools disclaimer stating that they are in full compliance with the articles and Acts, required by law.

The College Policies really turn out to be Administrative Policies. However they still seem to be created fairly and just to the best of my knowledge. Policies have been created for anything you can possibly think of. It really appears as if the writers of the Fox Valley Tech Policies and Procedures took many different things into consideration.

 It is to the best of my imagination, that when the school policy is written, it becomes the ultimate rule unless the policy has reason for review.  There is even a web page set aside just in case a policy is up for review.

The Administrative Policies cover areas with Academic Appeals and everything in between ending with Workplace Threats or Violence. There are many school policies that have security and the health of the student and faculty in mind. I feel that the Fox Valley Technical College has a well thought out and written policies.

WEP Weakness

Wired Equivalent Privacy is a security protocol for wireless networks that encrypts transmitted data WEP is used to provide wireless LAN users protection against casual eavesdropping.

Security weaknesses were found in WEP and have since been exploited. It is now possible to crack a WEP-protected wireless network in a few minutes using easily available software tools.

Choosing WEP as your wireless network's security method will deter the casual user from gaining access to your network (and broadband connection) but not someone who knows what they are doing.

By downloading a WEP cracking tool someone can gain access to your wireless router within a few minutes.

Phishing Test

I was surprised at how much I had learned by taking the phishing test. (http://survey.mailfrontier.com/survey/quiztest.cgi)

The first time I took the test I noticed that I had incorrectly answered some of the questions. I followed up on these questions and learned that you may avoid most phishing attacks by going directly to the trusted website by opening up a browser and then type in the correct url.

The second test that I took I got 9 out of 10. (90%, not bad at all.)

E-mail security settings

I feel as though all of the following e-mail settings are just as important as the other and I will be looking for these types of security settings within my email client.

Read e-mail messages using a reading pane:        Allows you to read an e-mail message without actually opening it. Even though you can read the e-mail without opening the actual e-mail document you should still be aware of messages and attachments from unknown senders.

Block external content:    Prevents the user's computer from downloading the images and external links that are present in an e-mail. Spammers use the external content to note which e-mail addresses are actually in use, allowing them to add the e-mail address to their spam list, they can then sale your e-mail address to other spammers.

Preview attachments:    Some e-mail clients will allow a user to preview an attachment without saving it or opening it. To preview the attachment, the user must have the required application installed in order to view the attachment.     For example: You must have Microsoft Word installed on your computer in order to view an attachment that is a Microsoft Word attachment.

Use an e-mail postmark:    Some e-mail clients will allow for a legit e-mail that could otherwise look as if it were a spam e-mail, to have a postmark into the e-mails header, this postmark can be read by compatible e-mail clients on the receiving end. The compatible e-mail client will recognize the postmark and allow it thru.

I use the e-mail that is provided from my user account at peoplestring.com.
I will now examine my e-mail security settings within my peoplestring e-mail:

My e-mail client does offer a preview pane; it offers to hide or display remote inline images (block external content) and allows you to hide or display attached images below the message.
You can adjust the Score threshold. If you choose 1-3, this is the highest setting. (By selecting the highest setting you may miss a few real emails as it could result in them being marked as Spam.) A medium Spam setting would be in the 4-6 range, and low would be 7 or higher. You can adjust these settings according to your preferences. You can also choose a setting to allow or disallow e-mails sent in certain languages. Peoplestring e-mail allows you to set certain address rules; to allow or reject certain email addresses. I have set up to reject a few different e-mail addresses that I have received daily spam emails from yet I still receive them, the spam showed into my inbox daily until I set my score threshold, now it goes into my junk folder.

I did not see any settings for allowing an e-mail postmark so I will give the peoplestring e-mail a security ranking of 3 out of 5.

I will now check my wife's e-mail client G-mail from Google.
Her G-mail account allows for security settings such as allow or disallow external content such as view images. I advised her and changed her setting to disallow the external content.
G-mail allows users to view a snippet of the message (like Google web search!) in my opinion it does not show enough of a preview to make me feel secure.
I did not see anything available to allow for her to preview attachments or create an e-mail postmarks.
I did not see the opportunity to setup and adjust a score threshold like is available at peoplestring.com.
I will give G-mail a security ranking of only 2 out of 5.
If you are interested in joining peoplestring please do so through my affiliate link www.paychecks4life.net

As for me I am going to check into setting up a Microsoft Outlook account, since I have it already installed on my computer. I will do this to see if I can get a better security ranking from Outlook. I have seen Outlook quoted several times in my Security Awareness book that I am learning from in college.

Virus Attacks

There are many types of viruses and other types of threat agents out there. One of the very first signs of any threat comes from zero day attacks.
Once a vulnerability is discovered, technicians start working to create a patch.

These vulnerabilities come in several different forms such as a virus, Trojan virus, or a worm.
Most of the new active threats are of low to medium damage level; mostly doing damage to such things as, modifying files, and causing system instability; or the virus may steal information from the compromised computer. This doesn't mean that at any given time a major threat is not possible.
We want to do our best to safeguard our systems to prevent as many vulnerabilities as possible.

The most vulnerable platforms affected by these viruses are Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, and Windows XP

The current most active new threats:
Source: Norton Symantec

Name

Type

Last Updated

Discovered

W32.Xpiro.C	Virus	02/07/2011	02/06/2011
Trojan.Zbot!gen18	Trojan Virus	02/03/2011	02/03/2011
W32.Changeup!gen10	Trojan Virus	02/03/2011	02/02/2011
Backdoor.Tidserv!gen13	Trojan	02/02/2011	02/02/2011
Downloader.Monkif	Trojan	02/01/2011	02/01/2011
W32.Yimfoca!gen4	Worm	02/01/2011	02/01/2011
Downloader.Lofog!gen2	Trojan Virus	01/31/2011	01/31/2011
Trojan.FakeAV!gen47	Trojan	01/28/2011	01/30/2011
Trojan.Cryect	Trojan	01/28/2011	01/28/2011
W32.Ckbface	Worm	01/27/2011	01/27/2011

There are many research centers around the world that can provide you with information and protection against vulnerabilities, security risk and spam. These types of research centers have websites offering valuable information that can help you with the removal of any threatening viruses or malware.

http://home.mcafee.com/virusinfo/

http://www.zerodayinitiative.com/advisories/upcoming/

http://us.norton.com/security_response/index.jsp?tabid=mostactive

Information Security (The CIA)

To protect the confidentiality, security, and availability of information:

Security is the freedom from any danger or risk. All protection measures are established and maintained.
Information security describes the tasks involved to protect information that is in digital format.

3 Things Information Security is intended to protect

Confidentiality, Security, and Availability of Information:

click image to enlarge