August 18, 2005 4:00 AM PDT

Schooled in security

(continued from previous page)

stance of keeping everything out unless there's a need to let it in. William Boni, a vice president of information security and protection at Motorola who has been looking into campus security methods, likens the academic approach to a cellular membrane.

"Firewalls are a wall and keep things out," Boni said. "But a cellular membrane allows things to pass while keeping the bad things out."

Academic break-ins

Some recent security incidents at universities and colleges in the United States.

University of Colorado at Boulder
August
Hackers accessed a server containing names and Social Security numbers used for ID cards of students, professors and researchers.
Sonoma State University
August
Intruders broke into seven campus workstations containing the personal information of approximately 62,000 students, alumni, applicants and employees, then used the breach to gain unauthorized access to workstations outside the campus.
California State Polytechnic University at Pomona
August
School notified 31,077 students, faculty, employees and alumni of a security breach in two servers that contained names and Social Security numbers.
University of Southern California
June
Online application database hacked, exposing the Social Security numbers and other sensitive information of approximately 270,000 candidates.
Stanford University
May
Network hacked by an outsider, putting personal information of about 10,000 people at risk.
George Mason University
January
More than 30,000 of its students, faculty and staff were put at risk of ID theft after hackers broke into one of its servers.

Rather than block the whole network off with a firewall, some universities create "zones of trust." A university's network would have different levels of security and required authorization, depending on the sensitivity of the campus information. That approach could let someone see course information, but stop them from looking at student records.

"There are situations where people segregate into different zones...and there is dynamic control of the access between the zones," said David Ladd, senior program manager at Microsoft's External Research Programs for Trustworthy Computing. "This is more an advancement in policy than a technological advance."

Trust zones call for good authentication, and the security of passwords and identifiers is being looked at closely by some bodies.

Caltech has stopped using social security numbers as unique identifiers, Bevier said. In addition, a number of universities are testing out federation, in which authenticated users at one school can use their ID or password to access libraries, computer labs or other systems at another school belonging to the group, said Rodney Petersen, the security task force product coordinator at Educause, a nonprofit organization that focuses on IT in higher education. In Maryland, for example, a student can have access to online resource information from any of the 13 state university libraries through the use of a bar code, he noted.

Institutions are also taking steps to separate their residential and campus networks. The measure was originally introduced to free up bandwidth on campus networks, but it's since been found to also improve security, Petersen said.

Another approach is to quarantine all PCs until they've been checked out. The Massachusetts Institute of Technology has 50,000 computers on the network that have no firewalls. Like many universities, it places all computers in isolation when they first try to log on to its system, said Jeff Schiller, MIT's network manager. The machines are automatically scanned for the appropriate security updates on the machines, and once cleared, are able to get on to the network.

A number of institutions used to report spending $100,000 to $200,000 to troubleshoot IT security issues at the start of the school year, but the cost has fallen by more than half since the quarantine technique has been put into play, Educause's Petersen said.

Without firewalls in place, MIT has to focus on taking care of security

Previous page | CONTINUED:
Page 1 | 2 | 3

18 comments

Join the conversation!
Add your comment
Share This, Comrade
Corporate America is not socialist laboratory nor a democracy.
There are valid reasons to keep valuable information out of the
hands of competitors. There can be no open door policy without
wide eyed watch dogs.

To paint universities, our great bastions of anarchistic chaos, as
having the right idea when is comes to information sharing is
absurd. Just ask the music and software companies how they
feel about "information" sharing on campus. They have several
instances where nuclear information has been so shared they
can't remember where they left it.
Posted by cjohn17 (268 comments )
Reply Link Flag
Share This, Comrade
Corporate America is not socialist laboratory nor a democracy.
There are valid reasons to keep valuable information out of the
hands of competitors. There can be no open door policy without
wide eyed watch dogs.

To paint universities, our great bastions of anarchistic chaos, as
having the right idea when is comes to information sharing is
absurd. Just ask the music and software companies how they
feel about "information" sharing on campus. They have several
instances where nuclear information has been so shared they
can't remember where they left it.
Posted by cjohn17 (268 comments )
Reply Link Flag
How hard...
...would it be for these schools to protect business-critical information while allowing access to stuff to which everyone *should* have access?
Posted by sjsobol (115 comments )
Reply Link Flag
But Steve, You Know...
It is apparently extremely hard considering the students and faculty
in leftist universities believe there should be no such thing a
corporate secret.

The only thing corporate secret I'm interested in is the Colonel's
chicken recipe.
Posted by cjohn17 (268 comments )
Link Flag
How hard...
...would it be for these schools to protect business-critical information while allowing access to stuff to which everyone *should* have access?
Posted by sjsobol (115 comments )
Reply Link Flag
But Steve, You Know...
It is apparently extremely hard considering the students and faculty
in leftist universities believe there should be no such thing a
corporate secret.

The only thing corporate secret I'm interested in is the Colonel's
chicken recipe.
Posted by cjohn17 (268 comments )
Link Flag
Lessons to protect ID
Lessons to protect ID


Mr. AT Alishtari, POA and Founder EDI Secure LLLP, finds schools that are training the next generation of IT, IP and encryption experts are woefully inadequate at protecting the parents and the students ID from intrusion, theft and fraud. It was not seen as important however cyberthieves have borrowed from or stolen property alledging they were this or that person from property stolen online. Schools in their financial aid process collect enough information to be a scammer's paradise.

Schools will have to go with data offline as a platform approach at some point using Company technology or they will not have to keep it online in their database that is the same thing. Regardless, the future belongs to Company type technologies us U.S. Commerce Department NIST level 4 authentication. U.S. authentication and encryption standards were submitted to U.S. Congress Privacy Bill and U.S. Senate Cybercrime Treaty.
Posted by (66 comments )
Reply Link Flag
I agree with and add to the statement the below
A year ago, January 2006, EDI Secure LLLP was purchased by IDPixie LLC which owns the patent US 6,598,031 B1 granted on July 22, 2003 for APPARATUS AND METHOD FOR ROUTING ENCRYPTED TRANSACTION CARD IDENTIFYING DATA THROUGH A PUBLIC TELEPHONE NETWORK from inventor Jeffrey Ice. So to update EDI Secure LLLP's place in the marketplace, I add the above and below data.

My Pledge

I, Mr. Abdul Tawala Ibn Ali Alishtari, pledge my Foundation to halt child slavery activities including his Global Peace Film Festival, Inc., at www.peacefilmfest.org. I pledge moral support of legal, peaceful activities and my non-profit gifts offshore, onshore and globally, primarily with philantrophy from my personal investment to help halt all fraud, violence and scams hurting innocent children, women and families so help me God.
Posted by Abdul Tawala Ibn Ali Ali (53 comments )
Link Flag
To update comments, I must add the below...
This is so the data makes sense from anyone looking it up on my company...

A year ago, January 2006, EDI Secure LLLP was purchased by IDPixie LLC which owns the patent US 6,598,031 B1 granted on July 22, 2003 for APPARATUS AND METHOD FOR ROUTING ENCRYPTED TRANSACTION CARD IDENTIFYING DATA THROUGH A PUBLIC TELEPHONE NETWORK from inventor Mr. Jeffrey Ice. So to update EDI Secure LLLP's place in the marketplace, I add the above and below data.

My Pledge

I, Mr. Abdul Tawala Ibn Ali Alishtari, pledge my Foundation to halt child slavery activities including his Global Peace Film Festival, Inc., at www.peacefilmfest.org. I pledge moral support of legal, peaceful activities and my non-profit gifts offshore, onshore and globally, primarily with philantrophy from my personal investment to help halt all fraud, violence and scams hurting innocent children, women and families so help me God.
Posted by Abdul Tawala Ibn Ali Ali (53 comments )
Link Flag
In order to have this data be relevant the below update is added...
A year ago, January 2006, EDI Secure LLLP was purchased by IDPixie LLC which owns the patent US 6,598,031 B1 granted on July 22, 2003 for APPARATUS AND METHOD FOR ROUTING ENCRYPTED TRANSACTION CARD IDENTIFYING DATA THROUGH A PUBLIC TELEPHONE NETWORK from inventor Mr. Jeffrey Ice. So to update EDI Secure LLLP's place in the marketplace, I add the above and below data.

My Pledge

I, Mr. Abdul Tawala Ibn Ali Alishtari, pledge my Foundation to halt child slavery activities including his Global Peace Film Festival, Inc., at www.peacefilmfest.org. I pledge moral support of legal, peaceful activities and my non-profit gifts offshore, onshore and globally, primarily with philantrophy from my personal investment to help halt all fraud, violence and scams hurting innocent children, women and families so help me God.
Posted by Abdul Tawala Ibn Ali Ali (53 comments )
Link Flag
In order to have this data be relevant the below update is added...
A year ago, January 2006, EDI Secure LLLP was purchased by IDPixie LLC which owns the patent US 6,598,031 B1 granted on July 22, 2003 for APPARATUS AND METHOD FOR ROUTING ENCRYPTED TRANSACTION CARD IDENTIFYING DATA THROUGH A PUBLIC TELEPHONE NETWORK from inventor Mr. Jeffrey Ice. So to update EDI Secure LLLP's place in the marketplace, I add the above and below data.

My Pledge

I, Mr. Abdul Tawala Ibn Ali Alishtari, pledge my Foundation to halt child slavery activities including his Global Peace Film Festival, Inc., at www.peacefilmfest.org. I pledge moral support of legal, peaceful activities and my non-profit gifts offshore, onshore and globally, primarily with philantrophy from my personal investment to help halt all fraud, violence and scams hurting innocent children, women and families so help me God.
Posted by Abdul Tawala Ibn Ali Ali (53 comments )
Link Flag
Do adjust Mr. Alishtari's comments to the buyout of EDI Secure LLLP
Do adjust Mr. Alishtari's comments to the buyout of EDI Secure LLLP


A year ago, January 2006, EDI Secure LLLP was purchased by IDPixie LLC which owns the patent US 6,598,031 B1 granted on July 22, 2003 for APPARATUS AND METHOD FOR ROUTING ENCRYPTED TRANSACTION CARD IDENTIFYING DATA THROUGH A PUBLIC TELEPHONE NETWORK from inventor Jeffrey Ice. So to update EDI Secure LLLP's place in the marketplace, I add the above and below data.

My Pledge

I, Mr. Abdul Tawala Ibn Ali Alishtari, pledge my Foundation to halt child slavery activities including his Global Peace Film Festival, Inc., at www.peacefilmfest.org. I pledge moral support of legal, peaceful activities and my non-profit gifts offshore, onshore and globally, primarily with philantrophy from my personal investment to help halt all fraud, violence and scams hurting innocent children, women and families so help me God.
Posted by Abdul Tawala Ibn Ali Ali (53 comments )
Link Flag
Lessons to protect ID
Lessons to protect ID


Mr. AT Alishtari, POA and Founder EDI Secure LLLP, finds schools that are training the next generation of IT, IP and encryption experts are woefully inadequate at protecting the parents and the students ID from intrusion, theft and fraud. It was not seen as important however cyberthieves have borrowed from or stolen property alledging they were this or that person from property stolen online. Schools in their financial aid process collect enough information to be a scammer's paradise.

Schools will have to go with data offline as a platform approach at some point using Company technology or they will not have to keep it online in their database that is the same thing. Regardless, the future belongs to Company type technologies us U.S. Commerce Department NIST level 4 authentication. U.S. authentication and encryption standards were submitted to U.S. Congress Privacy Bill and U.S. Senate Cybercrime Treaty.
Posted by (66 comments )
Reply Link Flag
I agree with and add to the statement the below
A year ago, January 2006, EDI Secure LLLP was purchased by IDPixie LLC which owns the patent US 6,598,031 B1 granted on July 22, 2003 for APPARATUS AND METHOD FOR ROUTING ENCRYPTED TRANSACTION CARD IDENTIFYING DATA THROUGH A PUBLIC TELEPHONE NETWORK from inventor Jeffrey Ice. So to update EDI Secure LLLP's place in the marketplace, I add the above and below data.

My Pledge

I, Mr. Abdul Tawala Ibn Ali Alishtari, pledge my Foundation to halt child slavery activities including his Global Peace Film Festival, Inc., at www.peacefilmfest.org. I pledge moral support of legal, peaceful activities and my non-profit gifts offshore, onshore and globally, primarily with philantrophy from my personal investment to help halt all fraud, violence and scams hurting innocent children, women and families so help me God.
Posted by Abdul Tawala Ibn Ali Ali (53 comments )
Link Flag
To update comments, I must add the below...
This is so the data makes sense from anyone looking it up on my company...

A year ago, January 2006, EDI Secure LLLP was purchased by IDPixie LLC which owns the patent US 6,598,031 B1 granted on July 22, 2003 for APPARATUS AND METHOD FOR ROUTING ENCRYPTED TRANSACTION CARD IDENTIFYING DATA THROUGH A PUBLIC TELEPHONE NETWORK from inventor Mr. Jeffrey Ice. So to update EDI Secure LLLP's place in the marketplace, I add the above and below data.

My Pledge

I, Mr. Abdul Tawala Ibn Ali Alishtari, pledge my Foundation to halt child slavery activities including his Global Peace Film Festival, Inc., at www.peacefilmfest.org. I pledge moral support of legal, peaceful activities and my non-profit gifts offshore, onshore and globally, primarily with philantrophy from my personal investment to help halt all fraud, violence and scams hurting innocent children, women and families so help me God.
Posted by Abdul Tawala Ibn Ali Ali (53 comments )
Link Flag
In order to have this data be relevant the below update is added...
A year ago, January 2006, EDI Secure LLLP was purchased by IDPixie LLC which owns the patent US 6,598,031 B1 granted on July 22, 2003 for APPARATUS AND METHOD FOR ROUTING ENCRYPTED TRANSACTION CARD IDENTIFYING DATA THROUGH A PUBLIC TELEPHONE NETWORK from inventor Mr. Jeffrey Ice. So to update EDI Secure LLLP's place in the marketplace, I add the above and below data.

My Pledge

I, Mr. Abdul Tawala Ibn Ali Alishtari, pledge my Foundation to halt child slavery activities including his Global Peace Film Festival, Inc., at www.peacefilmfest.org. I pledge moral support of legal, peaceful activities and my non-profit gifts offshore, onshore and globally, primarily with philantrophy from my personal investment to help halt all fraud, violence and scams hurting innocent children, women and families so help me God.
Posted by Abdul Tawala Ibn Ali Ali (53 comments )
Link Flag
In order to have this data be relevant the below update is added...
A year ago, January 2006, EDI Secure LLLP was purchased by IDPixie LLC which owns the patent US 6,598,031 B1 granted on July 22, 2003 for APPARATUS AND METHOD FOR ROUTING ENCRYPTED TRANSACTION CARD IDENTIFYING DATA THROUGH A PUBLIC TELEPHONE NETWORK from inventor Mr. Jeffrey Ice. So to update EDI Secure LLLP's place in the marketplace, I add the above and below data.

My Pledge

I, Mr. Abdul Tawala Ibn Ali Alishtari, pledge my Foundation to halt child slavery activities including his Global Peace Film Festival, Inc., at www.peacefilmfest.org. I pledge moral support of legal, peaceful activities and my non-profit gifts offshore, onshore and globally, primarily with philantrophy from my personal investment to help halt all fraud, violence and scams hurting innocent children, women and families so help me God.
Posted by Abdul Tawala Ibn Ali Ali (53 comments )
Link Flag
Do adjust Mr. Alishtari's comments to the buyout of EDI Secure LLLP
Do adjust Mr. Alishtari's comments to the buyout of EDI Secure LLLP


A year ago, January 2006, EDI Secure LLLP was purchased by IDPixie LLC which owns the patent US 6,598,031 B1 granted on July 22, 2003 for APPARATUS AND METHOD FOR ROUTING ENCRYPTED TRANSACTION CARD IDENTIFYING DATA THROUGH A PUBLIC TELEPHONE NETWORK from inventor Jeffrey Ice. So to update EDI Secure LLLP's place in the marketplace, I add the above and below data.

My Pledge

I, Mr. Abdul Tawala Ibn Ali Alishtari, pledge my Foundation to halt child slavery activities including his Global Peace Film Festival, Inc., at www.peacefilmfest.org. I pledge moral support of legal, peaceful activities and my non-profit gifts offshore, onshore and globally, primarily with philantrophy from my personal investment to help halt all fraud, violence and scams hurting innocent children, women and families so help me God.
Posted by Abdul Tawala Ibn Ali Ali (53 comments )
Link Flag
 

Join the conversation

Add your comment

The posting of advertisements, profanity, or personal attacks is prohibited. Click here to review our Terms of Use.

What's Hot

Discussions

Shared

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.