Penn Computing
Computing Menu Computing A-Z
Computing Home Information Systems & Computing Penn

Simple Best Practices Deter Cyber/Computer Threats

May 15, 2013 :: Shirely Ross, ISC

Computer (or cyber) security is in the popular press almost every day, from "Advanced Persistent Threats" to Chinese espionage to hacked Twitter accounts affecting the stock market. While the media coverage can be dramatic, most of the attacks rely on common tactics, such as phishing, vulnerabilities in vendor software, or malware delivered to an unpatched machine. The good news: these threats can be deterred by following relatively simple best practices and by implementing currently available technologies, according to Information Systems & Computing. ISC is excited about several information security initiatives taking place in FY14.

These initiatives complement the variety of information security tools and products already in place across campus (such as intrusion detection and prevention systems, firewalls, access control lists, private networks, policy, etc.):

  • Two Factor pilot: Passwords are the most common way to protect resources from unauthorized access. However, hackers are increasingly targeting passwords through phishing, key-stroke loggers in malware, or simple guessing. Pennís Two Factor pilot project (which is "opt-in") will provide a second code to users when they authenticate with their PennKey. This code - created and displayed on their smartphone - changes constantly, limiting the usefulness of the individualís password and therefore the likelihood of an attack using compromised credentials.
  • Central Logging: In FY14, ISC will establish a service that will allow event logs of Penn's critical hosts to be centrally aggregated and analyzed, greatly improving our ability to monitor these systems for signs of attack or compromise.
  • Desktop Management: Many organizations at Penn struggle to effectively manage widely-deployed University-owned computers, resulting in unpatched software and insecure configurations. These are the primary cause of computer vulnerabilities, which in turn can lead to compromise and data loss. In FY14 ISC will offer all Schools/Centers a central tool to register, maintain, and monitor these computers to enhance their security.
  • SafeDNS: SafeDNS service prevents users from visiting malicious websites in real-time and instead displays a warning. SafeDNS has been extremely successful even beyond Penn, with great interest from other colleges and universities. Developed as a small pilot project, SafeDNS will be transitioned into a campus-wide service in FY14.

For more information about these and other information security projects in FY14 please contact security@isc.upenn.edu.



News & Announcements
Computing Newsroom
Client Care Pilot Begins October 6
Penn Continues with Cyber-Attack Initiatives
New Tier 1 Data Center Now Open
BusinessObjects Webi Classes Announced for October 2nd & 3rd
Apple Announces iPhone 6, iPhone 6 Plus
top

Information Systems and Computing
University of Pennsylvania
Comments & Questions


University of Pennsylvania Penn Computing University of Pennsylvania Information Systems & Computing (ISC)
Information Systems and Computing, University of Pennsylvania