Security: It’s Not All About Hackers

Click here to receive your FREE subscription to Campus Technology

Home > Security: It’s Not All About Hackers

Focus

Security: It’s Not All About Hackers

8/22/2005

By Doug Gale

Ideally, passwords should be long (eight characters or more) and include numbers, upper and lower case letters, special characters such as #, $, and !, and be meaningless gibberish not found in a dictionary. Unfortunately, passwords that meet these criteria are frequently hard to remember, so people write them down, thus defeating the whole idea of robust passwords. A workable compromise: a chain of abbreviated words that an individual can remember, with the addition of some meaningful but unrelated numbers and perhaps a character. For example, “For Secure Access” may help a user remember the password “4SecAcc.”
Encourage or, better yet, require users to change passwords regularly; every 90 days or more often for sensitive applications.
Make clear to campus users that they must never give their passwords to anyone other than security administrators or backup personnel.
Make clear to campus users that they must never copy their actual, unencrypted passwords onto paper, for convenience. Instead, they can track their passwords via “clue” sheets that only they would understand. The clue “DadCarJ'ey” would remind the user of the password “65Blk8” (The user’s father is 65, his car is black, and his dog J'ey is eight.)

Recommendations for Higher Ed

Clearly, there is no one-size-fits-all solution to the demands for physical security on campus. However, the following guidelines can help your institution’s administrators choose the security practice—or combination of practices—that will best suit campus needs.

Two-factor authentication. All points of access to facilities with computers containing sensitive information should be controlled by checkpoints or coded card readers using two-factor authentication that is based on both “something you know” (PIN or password) and “something you have” (token or key), to restrict access to authorized personnel only. Two-factor authentication is a nice compromise between rigorous security and reasonable cost and convenience. (See “Smart Cards,” below) Reserve biometrics for very high-security environments. The cost for this technology will continue to fall as it matures; as that happens, it may be considered for additional locations.

Don’t drop traditional tools; watch for internal problems. Remember that good physical security d'esn’t eliminate the need for firewalls, antiviral protection, or any of the other more traditional cyber-infrastructure security tools. (And don’t forget that disgruntled employees present a much higher threat to your institution than external hackers and thieves.)

Where there’s a will… Finally, remember that any lock can be picked with a big enough hammer.

Get Secure

Think your campus is physically secure? Take this quiz.

Have you performed a risk assessment for the loss of information on your computers, as well as the loss of the computers themselves?
Have you developed and publicized policies governing physical access to your facilities? Your policy is your version of criminal law and serves two vital functions: it outlines the rules and provides a basis for punishing transgressions.
Do you know who has access to your computer room or to staff offices? Do you know why?
Have you installed physical access controls appropriate to the risks?

You passed if you answered “yes” to all questions.

Doug Gale is president of Information Technology Associates, LLC (www.it associates.org) an IT consultancy specializing in higher education. He has more than 30 years of experience in higher education as a faculty member, CIO, and research administrator.

Cite this Site

Doug Gale, "Security: It’s Not All About Hackers," Campus Technology, 8/22/2005, http://www.campustechnology.com/article.aspx?aid=40458

copy text (above) for proper citation

« Prev
1. 1
2. 2
3. 3

Campus Technology

Focus

Security: It’s Not All About Hackers

Recommendations for Higher Ed

Cite this Site

Recommended Reading

Related Articles

Biweekly Poll

Sponsored Links

Solution Centers

Campus Technology

Registered Users

New Users

It only takes a minute

Focus

Security: It’s Not All About Hackers

Recommendations for Higher Ed

Cite this Site

Recommended Reading

Related Articles

Events

Current issue

Biweekly Poll

Sponsored Content

Sponsored Links

Solution Centers