Colleges Wrestle With Thumb Drives 127
Lucas123 writes "IT managers at colleges and universities are grappling with the problem of finding ways to better secure removable storage media in an environment that encourages information sharing. Draconian security mandates 'may be common in the corporate world, but "we don't have the flexibility to simply say all inbound traffic is locked down," said Jason Pufahl, information security team lead for IT services at the University of Connecticut.'"
What the hell is this about? (Score:5, Insightful)
You're worried about the university computers? Then use a secure system that doesn't allow a user to bring along any kind of software to infect it.
You're worried about the student's data? Then teach them to use encryption and require them to use it.
Both things neither require a lot of examination nor a lot of money. What's the big deal?
Re:What the hell is this about? (Score:5, Informative)
We had a situation at work where we had to lock down the floppy drives on machines because people might steal stuff. The fact that they also had email and web access didn't make any difference to the people making the policy.
Re:What the hell is this about? (Score:5, Insightful)
Especially at a University, where you want people to take and share information. Seriously, deniable makes a great point. I taught a series of workshops at a small college that took the "no removable storage" approach to keeping themselves "secure". The IT Director eventually got fired and now they're being a little more reasonable.
Re:What the hell is this about? (Score:5, Insightful)
I spent a good deal of my life in an university. As a student, a tutor, and finally I briefly also worked there. If anything, an university is a place where information is flowing. Yes, usually only after publishing (because, well... nobody wants to tempt a colleague to crib), but then whatever you want, whatever you need, it's there. Mostly because you DO need it.
Try to write any kind of scientific report without quoting sources.
Not to mention that it is virtually impossible to (re)create everything on your own. You have to build on the foundation laid down by someone else. I cannot start a math paper by proving that inverting a matrix is possible.
I also cannot do all on my own because I do need the expertise of other people with different knowledge. It's humanly impossible to learn everything, especially at the depth and detail required today when you want to create something "new". I could not design the hardware layout for an integrated circuit that I need. I'm not a hardware developer. But I know someone who can. He can probably not create the microcode for it, but that's no problem because that's what I can do.
Cooperation has always (well, at least since the day when it became impossible to know everything that's necessary yourself) and will always be the corner stone of research. If there is something college and university should teach, it's the only cooperation and not egoism leads to success and results.
Re:What the hell is this about? (Score:5, Funny)
lol
Re: (Score:1, Funny)
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Under today's better "rules" you think
Re: (Score:2)
Re: (Score:2)
This is basic separation of fu
Re:What the hell is this about? (Score:4, Insightful)
If they don't want viruses coming in, install virus scanners or don't allow executables to be run from user drives... and have the machines re-image on a regular basis.
If they don't want sensitive data going out, banning media isn't going to stop some bonehead from using a floppy or emailing it to himself (or putting it on a "secret" part of his webpage).
Re:What the hell is this about? (Score:4, Interesting)
Or, as the GP suggested, use a more secure system.
Of course, no system is absolutely secure, but I feel that here we're dealing with stupidity, not malice - dumping Windows and Windows viruses seems like a foolproof plan to me. (Of course, nothing ever is foolproof.)
Or using the camera on his mobile phone to make some screenshots. (I still can't believe that somebody took the time to take pictures of and then post the whole of Harry Potter.)
Re:What the hell is this about? (Score:4, Interesting)
Re: (Score:2)
Re:What the hell is this about? (Score:5, Informative)
Universities really CAN'T lock systems down in the kind of way a workplace can. I'm doing a Master's degree in Information Technology (basically a one year conversion course Computing Science for those with different first degrees). We have to write software for our dissertations and this often involves making use of other people's software, sometimes libraries, sometimes compiled programs. We wouldn't be able to do our dissertations if we couldn't install more software. It's not practical to have to have to get permission for every peice of software every student needs. I'm sure many of the academic staff also need to do these things in order to do their own research.
University networks are not like work networks. You can't enforce a standard set of tools and be sure that no one needs to run anything else
Well, even that is false (Score:5, Interesting)
Re: (Score:2)
I don't know why you're even talking about windows. It's not even relevant.
Plus it's as easy to bypass lockdown on default installs of typical Linux distros as it is for default installs of Windows. With the distros you usually get access to stuff like scp, perl, crypto and lots of other fun stuff preinstalled for you.
If you're going to allow users to have usb music players and camera
Re: (Score:2)
Imagine you're a corporate spy. Your job: Infiltrate a competing company and copy their secrets. What do you do? You try to get hired, grab what you can and bail. I get fired for breaking policy? Here's my cell, call someone who cares.
Re: (Score:2)
If you're afraid of corporate spies, there are things you can do. Whether or not you use windows is irrelevant.
While most organizations are clueless and let just about anybody access to the "family jewels" (noobs/temps/outsourcees/contractors get access to backup tapes etc), not all are.
If you're a spy, you'd care ab
Re: (Score:1, Insightful)
Re: (Score:2)
1) What important corporate secrets does root/administrator on a desktop have anyway?
2) Why are you letting people you can't trust have access to secrets? You hired them because they can't read/write or remember stuff or think out of the box?
You can hire "cannonfodder", but you sure don't give them access to important stuff.
Most companies don't really care about security or know anything about it. They just say they do. They hire new people and near immediately put
Re:Well, even that is false (Score:5, Interesting)
I've seen them fire people over it.
however... all the managers have laptops and we go in and out every day with them. Each department have a fleet of burners and scanners. Every single member of R&D has at least 2 USB memory sticks. and I've been using my iPod everyday for over 5 years.
So what's the point? Surly I am not about to steal corporate secrets, and the mechanisms preventing me if I was inclined to do so, have nothing to do with site or IT security. A disgruntled employee who didn't understand the difficulty in marketing such things is in no way going to be able to figure out what to take and how to do so (or even be able to get to the part of the building where he could have access to the data). The segmentation of the network encourages the use external memory to transfer data from the segment containing the devices that create the data to the workstations of the people that analyze data.
Re: (Score:2)
But there is a policy that says "No external USB drives". So there are no external USB drives. Does the policy forbid internal USB drives to be taken home? No. So you can
Re: (Score:1)
Re: (Score:2)
more IT managers need to realize what users want and what the company NEEDS... Users may want data all over PCs, but companies NEED that data in a central place because users NEED that data for their jobs and NEED it backed up. The idea is to keep BOTH sides happy and in most cases it's quite easy if you think about it 5 minutes and are willing to restructure your systems to segment data correc
thin clients ftw! (Score:1)
Re: (Score:2)
CD burners are either not installed or are software disabled on the systems I have seen. Actually it is a major PITA to find a burner when you want to send some data to a vendor for analysis. Ah yes, that gets me to the USB ports. You can superglue them but the
Re: (Score:2)
Re: (Score:2)
I've seen it time and again myself. From both sides. I worked for the internal security of a bank. Told them at least once a month that there are se
Locking down toolsets and competitive advantages (Score:2)
> University networks are not like work networks. You can't enforce
> a standard set of tools and be sure that no one needs to run
> anything else
If by ``work networks'' you mean industrial software development
environments -- well, you also can't enforce a standard set of tools.
Let me put it this way: I really hope management over at my
*competitors* lock down their engineering team's tool set, since
that would give my group, which has no such artificial restrictions
on software tools we
Re:Locking down toolsets and competitive advantage (Score:2)
Myth that businesses needs are any different (Score:2)
Re:What the hell is this about? (Score:5, Insightful)
Never mind that computers are a basic tool of the modern age, computers are magical black box administered by a priestly class, and only nerds should know anything about them. And encryption? That's for the government or terrorists, AND NO ONE ELSE!
Re: (Score:2)
Let's all go down on our knees and pray to blessed and most holy Alan.
Unfortunately, nothing's further than the truth. So far nobody kissed my pinky ring and begged for my blessing.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
When we allow dumbness to succeed, worse, if we make being dumb the get-out-of-jail card while incriminating people with knowledge, we're heading for desaster. And we are!
When Joe Snoozebag gets his machine infected with a trojan, his computer could trash the internet and he isn't liable. He doesn't know jack about computers, and while it may be irresponsible to operate high tech without the foggiest idea about it, his cluelessness saves him from liability.
When I, a professional security researcher, g
Re: (Score:2)
Re: (Score:2)
He doesn't go to bars anymore. Invariably, sooner or later a drunk will approach him and start bothering him for a fight with the "champion". What should he do? He isn't so much concerned that he might hit him in ways that would injure the person (he has absolute perfect body control), but even if he doesn't do jack and that guy stumbles over his own feet and breaks a
Universities shouldn't have to secure data (Score:5, Insightful)
Re: (Score:1)
Re: (Score:2, Interesting)
It's an environment of learning where even circumventing campus computer security should be just regarded as being smarter than most people and considered an acceptable way to impress a girl.
While I agree with you in principal, at least one part of the story related to staff at the university losing a USB drive with 199 Social Security numbers on it. Staff should be required to use encryption as a minimum. Where I went to college, the admin network was segregated from the student network; and had stricter rules. It just makes sense; there is far too much sensitive information in that network to allow it to be connected to the outside world without controls. In a sense, the admin network is a corporate network. While I don't believe they need to be as draconian as some government agencies (swapping hard drives for internal/public networks), certainly they do need to keep tight controls.
Just my 2cents..which in today's world won't even buy me a piece of Double Bubble.
Re: (Score:2)
Breaching Security (Score:2)
There are some schools where circumventing computer security is taught as part of the curriculum.
Deep Freeze (Score:3, Informative)
Re:Deep Freeze (Score:5, Insightful)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Jep, that's indeed the big problem. When the network is down (It rarley is, though), people can't do anything (Which isn't _too_ terrible for a school, but still sucks).
Other than that, it's actually pretty fast (When multiple people boot, the system apparently does some interesting broadcasting type of stuff, I don't know, really). It's reasonably fast, ~3min, even when multiple people are booting (Windows2000, mind you, with oldish PCs), logging in takes ~30sec. Laptops are not using this though, might
Re: (Score:2)
Re: (Score:2)
Our PCs are completely locked down, but everyone's given space on the server and when they log in they get a network drive mounted for them.
Re: (Score:2)
If you do a cypher
Re: (Score:2)
MS also has a free utility for XP (Shared User Computer Toolkit) that does similar, although it does require
High Security leads to a false sense of security. (Score:5, Interesting)
Re: (Score:2)
b. A majority have them anyways...
am I? (Score:5, Funny)
desktops = bad (Score:3, Interesting)
Re: (Score:2)
Re: (Score:2)
You could use computers running JUST a web browser as terminals, or use X terminals. A "terminal" doesn't have to mean a text-only device out of the 70s/80s.
-b.
Re: (Score:2)
1: Using Windows, and having them protected with Deep Freeze, or the Shared Computer User Toolkit, both roll back a machine to a known good state on reboot.
2: Have the machines on a private LAN with the only connections to the outside world are connections to a WSUS server (for windows updates), a domain controller (for being able to log on) and two RDP servers. One RDP ser
Huh? (Score:4, Interesting)
In June, for example, Grand Valley State University was forced to notify 3,000 students of a stolen Zip drive."
The article is all over the map. They are worried about hackers getting into your system and stealing your data in one paragraph, viruses from iPods in the next, and then they have some idiot storing SSN's on an unencrypted flash drive...
I don't know about most universities, but the one I went to didn't give everone admin access. When you logged on it would clear the local temp directories (i.e. everywhere the previous student had write access). Simple, and it makes it very difficult for viruses to propagate or hackers to install a keylogger.
What prof's need your SSN/SIN for is beyond me. We had "student" numbers, which were posted everywhere and didn't hold huge potential for abuse. No doubt the university could translate those to a SIN, but that system was supposedly secure.
Re: (Score:2, Informative)
SSNs (Score:3, Interesting)
Many large universities continued to use SSNs into the nineties, and I have no doubt many continue to use them. And when you'd teach a class, all the forms that came through
Re: (Score:2)
Re: (Score:1)
That said, I think the fact using the student number was the only option made it easier to memorize. If
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Many other colleges used to do this as well, but most (if not all) have switched to a different method for generating a student ID number.
Portable storage blues (Score:5, Insightful)
Desktop wise, a proven conbination of transparent bridging at network level, an antivirus/spyware on the desktop and another anti-virus/spyware on the mail server will filter out most of the traditional ways of infecting systems with malware. Scripts to enforce patching and lock out users that connect to the network might be a big headache, so if you can afford the overhead do that, or switch critical services to a more secure (and yes, I mean that) desktop such as a patched version of Linux.
The issue of data migration to/from portable storage is a head-scratching one. So, where I work, we scratched our head a lot and came up with the following conclusions:
- We can train users to understand the implications of relying on portable storage.
- Encryption could protect the content. In rare cases, it was a big headache, when users lost encryption keys, or when users wanted us to face performance issues on large encrypted filesystems.
- Portable storage will never be secure from the issue of data availability. Whether your data are encrypted or not does not matter if the device gets lost or broken and the user does not sync the data (for whatever reason). Scenarios where people had grant applications on USB keys and then they lost them or miscplaced them inside a warm cup of coffee or had their kids bike going over their laptop in the garden are common.
This last point made us re-examine why people use portable devices in academic setups in the first place. Apart from the obvious reasons ( mobility convenience, etc, etc), we found that strong motives for users to use portable storage media in an academic setup exist due to two reasons:
i)Network drive user quotas were extremely low, almost not usable. In fact, I know of faculties that still give a Gig of space per user and find it generous.
ii)Lack of suitable VPN solutions, so people could authenticate and mount their drives securely from remote locations. VPNs are common place, but they were dog slow, especially for large user setups, so faculties tend to serve tenths of thousands of users with only three or four VPN gateways that can handle (together) far fewer sessions than the true average user load. The result, non existing or slow connections, users give up, buy a key or portable drive and hope for the best.
I approached our Director, explained the problem and got funding to buy a storage solution able to a quota of 20 Gigs per user and also upgrade our campus connection and have our own separate VPN gateway, able to handle up to 80% of the average session load with strong crypto. It wasn't easy, and he heard the bill, he changed a few colours. However, if you explain with numbers the cost of loosing a grant, or the research work of the last two years (some experiments are quite expensive to repeat), they can be convinced to approve the budget.
I don't know about the US, but in Europe, the broadband home market is good enough to sustain a good connection rate even with a 1Mbps/384Kbps ADSL setup for direct common file I/O (documents, spreadsheets, etc). Amongst academic networks things are even better. Storage is becoming cheaper, so making a policy decision to allow portable media and empowering your users with adequate amounts of centralized storage that is easily reachable is, in my humble opinion, the best way to combat the portable storage blues.
Re: (Score:1)
physical port lock (Score:3, Interesting)
http://www.lindy.com/us/productfolder/04/40454/in
http://www.lindy.com/us/catalog/07/01a/index.php [lindy.com]
but I don't have the impression that the key is unique, so what's stopping me from buying the product and unlocking someone else using the same product?
Re: (Score:2)
http://support.microsoft.com/default.aspx?scid=kb; en-us;823732 [microsoft.com]
Windows XP Home Edition doesn't let you set ACL security on files, so their directions are incorrect. Furthermore, I tried the change to the USBSTOR registry key they mention, and it had no effect on my USB thumb drive.
Re: (Score:2)
Re: (Score:2)
Of course many motherboards also give you the option to disable usb ports in the bios.
You could also block thumb drives from being used with a group policy [petri.co.il].
Re: (Score:2)
In addition, any scheme like this could be defeated by the user buying their own lock
to get a key.
Re: (Score:2)
Back in the mid 1980's, one of our sys admins once had a cunning plan to stop viruses and worms creeping into early day PC's (8 MHz clones with CGA cards). Every machine would be installed with a lock which disabled the power to the floppy disk drive (communications were a serial line to a SUN server). Anyone who wanted to download or archive their personal files would
Re: (Score:2)
Re: (Score:2, Interesting)
Each system has seperate password requirements. Some require passwords with 15 or more letters, some balk at anything larger than 14. Some require 2 caps, 2 num
I use a small program for this . . . (Score:3, Interesting)
It generates passwords for you, letting you set the length and what
characters are included. Then it stores them all for you.
You can use one password to protect all your other ones.
You can even set expiration in the program to remind you when to change
a password.
I used to re-use the same three or four passwords everywhere. But now
nearly all of mine are quite random.
Give it a try.
Re: (Score:2)
The nice thing is that for staff and faculty, one can give them eTokens, while stud
But the most important question is... (Score:1)
Re: (Score:2)
Really Not Difficult (Score:2)
Password the BIOS, lock out all boot options bar hard disc.
Run everyone as a restricted user using dynamic accounts (ZENworks for example, or deep freeze if you're stuck in the 90's)
Disable all onboard bluetooth, wifi etc
Not all that difficult really.
Huh? What are they smoking? (Score:2)
If the IT admins really want to make their life easy, why don't they just use one of those hardware solutions where if you reboot the PC (or press some button while booting) the PC gets restored to a known state (like a vmware "revert to snapshot"), and then have networked file servers for students to store some of their permanent _uni/college_ related stuff on. If the IT staff aren't totally lazy they might even back up the student's network stuff regularly (haha).
Basically the hardware
Loss of SSN should not be a serious issue. (Score:5, Interesting)
Why should I be held responsible if someone recites my name, rank and serial number correctly and obtains a loan based on that very simple trivial fact? The problem is in the credit industry that wants to lend money at a moments notice to people before their impulse to borrow fades away.
All we need is a very simple change of law about default reporting. Let the companies lend without checks if they want to, it is after all their money. But they should not be able to report a loan as overdue or unpaid or in default without going through due diligence to verify that the person they are accusing of being a deadbeat is really the correct person.
Let us change the burden of proof. Currently the victims of ID theft have to prove that ID theft occurred. Let us change it so that, it is the lender who should prove that ID theft did not take place.
Then it wont matter if some department loses a hard disk containing million SSNs. Will it?
Re: (Score:2)
Not using an
Re: (Score:2)
A SSN is an identification number. In principle, there's no harm in everyone knowing that Bob Smith from Wichita is person 072-33-1234. The harm comes from being able to obtain credit, medical records, and so on just by saying "I'm Bob Smith, also known as 072-33-1234."
We need some kind of authentication mechanism to ensure that anyone claiming to be Bob Smith r
FTW: One Solution (Score:3, Funny)
Re: (Score:2)
thumb drive early adopter, lessons learned (Score:3, Interesting)
When I first was noticed to have a 1gb flash drive, my manager flipped out. We were not in a hugely secured environment, but he was formerly a branch manager of a bank so he saw this as a huge problem. We did deal with a large amount of customer information, but this never needed to be on my flash drive. I used the drive to assist in maintaining about 110 PCs, mostly loaded it with software tools, text files describing walk throughs to fix common issues, etc. We went round and round a bit and finally just dropped the issue and I was not bothered anymore.
Now I work in an IT department elsewhere, and I do have to carry sensitive materials. With all the switches, routers, server, etc, I have to keep passwords for them all. Having these items available on hand at any time in addition to a large number of software tools to suport > 500 machines of various types necessitates a flash drive - you just can't carry your laptop everywhere nor rely on the availablility of a network connection.
My solution now is to use OS X's "filevault" technology. Among the items I am not worried about, there is a small (10mb) encrypted disk image. Because the data on the image is frequently being changed and updated, I keep the main copy on the flash drive, and periodically (weekly or so) sync it with my laptop. The copy on the laptop is write protected to prevent temptation of editing it instead of the copy on the flash drive. The password to the vault is in the keychain on my laptop, which is encrypted with my login password. So if I plug in the flash drive to my laptop, I just double click to open the vault without any password to type. I can also open the read-only copy of the vault that is synced on my laptop if that's handier.
If I am in the field and either don't have my laptop with me, or it's inconvenient to haul it out, I just get out the flash drive and plug it into the machine and double click the vault. I have to enter the password since it's not on my laptop with its keychain, but that's not a big deal. The filevault is not supported on anything besides OS X, but it's supported directly by the OS and does not require any additional software or setup, it' just works when plugged in.
For the PCs I have a second 4gb flash drive that I use mainly for shuttling information between PCs, and it does not contain any sensitive information.
The biggest problem I have now with the flash drive is the very high risk of forgetting it somewhere. It's really easy to plug it into a machine, start working on something, get distracted by several other issues all at once, and hurredly rush to the next fire, only to leave the flash drive parked in the machine I was working on first. By the time I realize I don't have my flash drive, it can be up to a day later, and it's really hard to figure out where it was left behind. I've put a lot of thought into this problem, including various "phone phone" ideas, use of a lanyard, etc, and the solution I have come up with is working well. I have a small camera bag that I used to keep my powershot camera in. I now have a larger camera, so the bag has been repurposed. It's a LowePro, built well with a belt loop. It nicely holds my palm pilot, iPod, earbuds, an iTrip transmitter, AND a flash drive. How does this help you wonder? The fireflash has a removable clear acrylic cap that securely attaches to the flash drive, and the lanyard loop is on the cap, not on the drive. The drive came with a 5" lanyard, so I attached that to the loop on my Lowepro, and stuff the flash drive in the front pocket of the bag. When I am using the flash drive, I have to remove it from the cap to plug it in (or reach the computer for that matter) This leaves a clear acrylic cap dangling 5" dow
Wrinkle v2.0: Records retention policies (Score:1)
SSN #s? (Score:1)
Solutions? (Score:1)
Our computers use Novell software, and logging in requires knowledge of your Novell username and password. Guests can log in to use the web, but they aren't granted access to any of the Microsoft Office or Macromedia Studio software. If a computer is left alone for 20 minutes, it shuts down/resets. When a computer is shut down/reset, it removes all new files and programs that were installed on the computer during usage. That way they stay clean of all t
As a former uconn alumni (class of 06) (Score:1)
Recycled FUD (Score:2)
Incidents referenced not stated as actually happening: one; malware.
Incidents of "mandates" referenced: zero. Plus, the UConn IT guy says they can't do that anyway, so putting that in the headline makes it worth a -1.
This article seems to be pieces of three different articles that never got finished, thrown together into one big pile of FUD. Any one of them would make a good article if there were enough on-topic material. I'll give the guy a b