1. IT Security Essentials Ian Lazerwitz, Information Security Officer

2. Trends in Email, Web, and Malware Threats Mail/Spam Volume Mail volumes increased dramatically during the month of August, eclipsing even the record highs established last December, with spam making up 89% of all email. The increase was largely caused by the huge number of fake greeting card and YouTube video emails with links to malicious websites sent by the Storm worm, as well as large amount of PDF spam also distributed by Storm. At the end of the month, Storm had ceased to distribute PDF spam, most likely due to a lower response rate from users for this type of spam

3. Spam Statistics

4. Trends in Email, Web, and Malware Threats II Malware Trojans accounted for over 78% of all newly discovered malware in August, followed by Adware and Spyware that made up almost 14%. 97% of all new malware came in the form of Windows Executable files. Zombies An average of 264,133 new zombies were detected daily in August, many associated with the new infections caused by the Storm worm.

5. Trends in Email, Web, and Malware Threats III Web Threats An average of 11,906 total new malicious websites were detected daily in August. Over 30,000 of them had been used by the Storm worm to host the Mpack exploit toolkit that it uses to infect victim machines.

6. Fundamentals of Security Confidentiality Integrity Availability Confidentiality IntegrityAvailability

7. Why all the concern about security? Computer hacking has become a big business We store large amounts of personal data in our systems on students and employees We need that data to be accurate and available in order to do our jobs We must comply with state and federal regulations

8. What are we doing about it? Constantly monitoring our systems and threats to keep our servers and our network secure Implementing policies, procedures and practices to assure only authorized users have access to data Educating users

9. What can you do? Security is everyone’s responsibility Contact the IT Security Office with any questions or if you suspect there has been a security breach Follow some basic guidelines:

10. Be aware Make information security a regular practice Recognize poor security practices in your own habits and in your office Remain vigilant where information security is concerned

11. Passwords Never share a password –If more than one person needs access work with DoIT to create a network share so each can use their own password –Even the DoIT Helpdesk should never ask for your password

12. Passwords Choose a strong password –We recommend that you change your password regularly –Use a phase that’s easy to remember but hard to guess –Your password must contain 3 of 4 Uppercase letters Lowercase letters Numbers Special Characters

13. Password Examples Weak Passwords –Fluffy –Password3 –Lazerwitz Strong Passwords –str0ngPa55 –3plus3=Six –myc@tisf!uffy

14. Passwords Never post your password –On your computer monitor –Under your keyboard –In a desk drawer –Anyplace that someone might look

15. Passwords Never save passwords in applications –E-mail, Web Authoring, Dialup, VPN –Anyone who site at your computer has access to those applications –Equally important at home

16. Personally Identifiable Information (PII) is information that can be used to steal identities, disrupt University operations and damage Pace’s reputation includes: –Social Security Numbers (SSNs) –Health Information – including immunization information, FMLA information and –Credit Card information –Non public directory information – including student grades

17. PII Date Handling Best Practices Assign a complex password and change it regularly; Don’t use Internet files sharing software such as Kazaa or BitTorrent.; It is important to treat other people’s information as if it was your own!!!!

18. PII Date Handling Best Practices Delete files from ALL locations (hard drive and network drive) when no longer valid. Do not hold on to old queries or reports that contain personal information. Empty your computer’s recycle bin and clear temporary file folders

19. PII Date Handling Best Practices Never share passwords; Avoid emailing sensitive files. If email is absolutely necessary, use password protection; Use a password protected screen saver; Shut down or turn off the computer when not in use;

20. PII Printing Best Practices Printed reports with PII data must contain the creator’s name, date and time, data source and a confidential notice. Limit display of personal information. Do not leave paper containing personal information on desks or in open view; avoid printing SSN unless required by law.

21. PII Printing Best Practices Always store paper reports containing PII in a secure location such as a locked filing cabinet and know who has access to the location. Avoid taking PII reports with you to unsecured locations such as your home or car.

22. PII Printing Best Practices Limit distribution of documents with PII and know who is receiving the documents and how it will be used.

23. Physical Security Always lock your computer when you leave it unattended (ctrl-alt-del) Never leave hard copies with sensitive date in plain view Always log out of web applications (Banner, e-mail, calendar) and close the browser

24. Laptops and Mobile Devices Theft Access on unsecure networks Strong passwords Encryption

25. Did you know? (Antivirus) Pace University has a site license to install Symantec Antivirus on all Pace computer We also provide Antivirus software for staff, faculty, and student home use

26. Did you know? It is a violation of University policy to share your password You should keep your computer operating system and applications patched to protect against unwanted intrusions

27. Did you know? You should make backups of critical files At home use a personal firewall Do not open unexpected emails

28. Information Security Office Ian Lazerwitz –Information Security Officer ilazerwitz@pace.edu itsecurity@pace.edu Http://www.pace.edu/safecomputing