Information Security resources for Local Support Providers

Security Responsibilities of Local Support Providers

1. Ensure that your users' desktop computers are properly secured.
2. Make sure that your users understand the basics of computer security: Desktop Security 101.
   Give them a copy of Information Security at Penn (write security@isc.upenn.edu to request printed copies.)
3. Ensure that your servers are properly secured.
4. Ensure that your web applications follow Penn's security standards.
5. Familiarize yourself with all of Penn's information security, networking and privacy policies.
6. Identify, register with Information Security and bring into compliance, any Critical Hosts for which you are responsible.
7. Subscribe to the appropriate Penn security mailing lists.
8. Subscribe to your operating system vendor and application software vendors' security advisories email list.
9. Report all critical security incidents to information security.

Alerts & Advisories

• CERT: The CERT Coordination Center (at Carnegie Mellon) has up-to-date security alerts, as well as general security advice and research resources
• SANS: Internet Storm Center™monitoring and reporting on global internet traffic
• Microsoft: Security Bulletins from MS TechNet
• Apple: Security updates from AppleCare's KnowledgeBase
• Linux: Advisories and information from LinuxSecurity
• Virus alerts from Penn's virus information center

Security Guides & Checklists

• In recent years Penn Information Security has provided site-licensed copies of the "Step-By-Step" Guides from the SANS Institute for securing the major operating systems, however, we no longer are licensing them. In their place we are recommending that support providers and system administrators make use of the excellent tools and checklists (most of them free) available from the Center for Internet Security at their website: www.cisecurity.org.

  Even though the SANS Step-By-Step Guides are no longer available at Penn, the SANS website www.sans.org remains an excellent source of information, white papers, etc.
• Selling/Donating Old Computers: How to prevent private or sensitive information from accidentally being given to the recipients of donated or discarded equipment.
  

Resources

• PGP for Secure Email
• DNS Sinkhole Setup (Security SIG presentation): PowerPoint PDF
• Tips For Securing Public and Unmanaged Apple Machines (Word doc)

Last updated: Friday, December 23, 2011