Security Discussion Group

Greetings,

Perhaps like many others, we are continuously adding applications that can be accessed through our single sign on portal.  Some of these applications are administrative and provide access to sensitive data.  We are taking a number of steps to reduce the risks associated with the portal but we are wondering what steps other entities are taking? 

Do any of you have double or separate factor authentication for critical administrative applications provided within the portal?

Below are some of the things that we have/are effecting;

·         An “I have read this checkbox” containing security best practices upon first logon

Yeah, it sounds scary, but don’t most systems protect the password file so that hackers don’t have easy attack access? Or are we to assume that attackers have easy access to our password files?  If that’s the case, then we probably all need to convert to two or three factor authentication, including tokens or biometrics.

We use SCEP with SCCM and it works well. The price is great and its really easy to manage using SCCM. With SCCM you  have good built in reports and it allows you to create custom reports as well if you like to look at reports.

I’m trying to gauge what other institutions are doing regarding clickable links in instant messaging programs.  We currently block links that are sent through our Microsoft Lync implementation but we’d like to determine what other peer institutions are doing.

Does your university block clickable links through technical means? Do you allow clickable links but display a pop-up or warning message?  Or do you deal with this issue strictly from an awareness perspective?

Thanks for any information you can share!

Becky Thurmond Fowler, CISSP

Information Security and Access Management

Division of Information Technology

University of Missouri

(573)...

We have just posted a newly created position here in the System Administration division of the University of Colorado.  This division is similar to what some other multi-campus systems call the Office of the President.  That means we’re small (<400 staff, 100 of which are IT) and have no faculty or students – purely administrative staff.  We are located in our own office building in downtown Denver (1800 Grant St), just a few blocks from the capital. We have a focus on our ERP systems (PeopleSoft) and other multi-campus services (research administration, data warehouse, etc.), as well as the IT services for the division staff (AD, Exchange, SharePoint, etc). 

The position is for a mid-level (or ambitious junior) information security analyst to take the lead on operational security technical work in...