Nullify Unneeded Risks
Whether by operator mistakes, attempts at making computers easy to use, or encouraging open access, our computer's software sometimes grants more access to our computers than is needed. We can decrease risk by eliminating unneeded access to our computers.
Nullify Risks From Unneeded Account Privileges
Use a safer account for day to day use.
Nullify Risks From Unneeded Access to Shared Data and Folders
JMU Highly Confidential data (e.g. SSN, banking account numbers, credit cards) about people other than yourself must not be stored on personally owned devices. Unauthorized storage of JMU Highly Confidential or Protected Data is a violation of university policy. Such data must not be stored in a way that it is exposed to unauthorized access physically or electronically.
When ordering Dell laptops from the JMU purchasing pages, be sure to specify the encrypting hard drive option.
- Microsoft file sharing is often misconfigured. If you don't need Microsoft file sharing, disable it. If you only mean to share files in your MP3 or PICS directories, don't share your entire C: drive. Otherwise, your entire computer can be completely controlled (or erased) by someone else, or a virus, in short order.
- The same applies for Appleshare and NFS services. Limit shares to folders you create. Don't share your entire hard drive.
- Operators can prevent Administrator accounts from accessing the machine from the network by removing the "Access this machine from the network" right from these accounts using the User Manager (NT) or Local Security Policies (2000) configuration tools.
- Providing shared space on your computer that others are allowed to write to exposes you to the risk of having illegal or inappropriate material stored on your computer. See below.
Nullify Risks From Unneeded Code Entry Points
- Do not exchange executable email attachments as it promotes unsafe practices. If you need to distribute executables, do so on a web or read-only file server. If you need to collect executables, do so from a web server submission or write-only file server...preferably one where the user is authenticated. Be aware of the risks associated with anonymous, public storage.
Nullify Risks From Unneeded Network Access
- If you don't need all the services installed and started by the default Linux installation, disable them.
- Limit unwanted network communications with a firewall. If your computer is only used to communicate in certain ways, the consequences of mistakes or defects can be decreased by disabling other, unnecessary communication channels. Keep in mind that all desktop firewalls are vulnerable to locally run code. Some viruses disable them.
- It is very useful to know what programs on our computers listen on the network for other computers to connect to them. In effect, it tells us what doors are open. Two tools useful for checking what programs are listening on what network ports are netstat (Windows and linux) and lsof (unix and linux).
Nullify Risks From Unneeded Access to Data in Transit
While we may have control over our own computer's security, we have very little or no control over the security of the path our data may take. As traffic traverses the network, it may pass over and through communications lines and systems which are compromised or poorly maintained. That network traffic may contain passwords and other critical data. To protect the data while it is in transit it should be encrypted.
- At a minimum encourage the encryption of authentication conversations using such technology as SSL, SSH, IMAPS, SMTP-TLS, POPS, and appropriate settings on clients like PC-Anywhere.
- Encourage the encryption of entire sessions when critical data is involved again using technology such as SSL and SSH.
- IPSEC based Virtual Private Networks (VPN) can provide another layer of access control and encryption.
- Do not type sensitive information into untrusted or public computers.
- Follow wireless usage and setup best practices.
Nullify Risks of Anonymous, Public Storage.
Avoid using or providing shares and servers that allow public storage by anonymous users.
Anonymous FTP servers and Microsoft shares that can be written to and shared by anonymous users are easily found and often abused. They can be, and often are, used by others to store illegal materials such as child pornography and pirated software. If the materials are found on your computer....
Another risk associated with these depots is that someone may modify material placed there by others. The original poster of the file may be blamed for something that was later modified and/or the recipients may suffer loss through incorrect information or malicious software.
Finally, in today's environment there are many viruses that look for and spread to open shares. On any large network, there are likely to be a few computers infected with one of these viruses. It is highly likely that any open share on the JMU network will have virus files placed in it by these infected computers. Some of these viruses are tricky. They place themselves in existing files or name themselves in such a way that it is not obvious they are malicious.
If you absolutely must offer anonymous storage, take the following steps:
- Post warnings that the service is completely unsecured and that all materials may be tampered with, lost, or may consist of inappropriate or illegal materials.
- Limit the amount of space that can be used through disk quotas or by putting the shared space on a separate partition.
- Restrict access to the service by IP address when possible.
- Monitor the use of the service to assure yourself that your computer is not being used to store illegal materials and that other users of your service are not being exposed to these materials or malicious software.
- Do not allow others to download material from the upload area. Have a responsible party examine the material and move it to a separate, read-only, download area once the material is deemed appropriate. Note that this imposes a certain amount of responsibility, and probably liability, on this person.
- Search for better ways to provide the service
If you absolutely must use anonymous storage, take the following steps:
- Make sure your anti-virus software is up to date.
- Do not place materials in anonymously accessible shared space that you don't want made public or modified.
- Be aware that anything you download from such space could have been modified by anyone and treat the material accordingly.
- Never, ever double-click a file stored in such space to open it. Instead, open the application associated with the file (Word, Excel, Netscape, Winamp, etc.) and then use the application's File->Open menu to open the file.
- Search for better service providers that don't expose you to these risks
Disable Music and Peer File Sharing Services
Running most music sharing programs allows anyone on the Internet to access files on your computer. There are both security and appropriate use issues related to this.
- Distributing copyright protected materials can result in lawsuits, fines, network privilege suspension, and/or action by JMU Judicial Affairs or Human Resources.
- Inadvertent sharing of sensitive data. This type of software should not be installed under any circumstances on computers handing sensitive constituent data. It should only be installed on JMU owned computers if job related. Others should use caution to make sure more data than intended is not being shared.
- A security defect may be discovered and exploited in the sharing software that allows others unintended access to your computer and data. They may be able to take complete control of it.
- Criminals are increasingly using peer to peer networks to spread viruses and other malicious software that show up in share lists using innocuous names.
- P2P sharing traffic can expand to take up almost all the university's available Internet bandwidth if allowed to do so. This impacts university academic and business functions.
If the software is installed, it should be configured so that it does not allow other computers to access local files. You will still be able to download music and other files but others will not be able to access files on your computer...thus nullifying unneeded risk.
Follow Best Practices Guidelines
Systems providing services over the network (web servers, ftp servers, etc.) should have their configurations tightened to decrease unnecessary access. For example, the services should run under restricted user IDs, be restricted to specific directories, and be very limited in the external programs and system services they are able to access. This type of work is generally best performed by a technician experienced with the particular services and platform being used.