Login
uiso@iu.edu
Copyright 2009
The Trustees of Indiana University

Best Practices For Securing IT Resources

This material is meant as a guide for department administrators and technicians working to minimize the chance of an IT security breach on Indiana University computer systems, telecommunications, or other information technology systems. This document is not meant to be comprehensive -- there are other resources and actions administrators and technicians must take to maximize the appropriate protections afforded to these IT systems.

Document and understand the local technical environment

Each organizational unit of Indiana University must create and maintain documents describing the systems that are hosting functions and databases that support their local operations.

Technicians assigned to systems supporting critical applications and/or hosting sensitive data can't begin to protect those systems or data without first knowing what technologies they have deployed, how they are interconnected and how they communicate. In order for senior department managers and technicians to assess risks associated with their operation, and to allocate appropriate resources to mitigate those risks, they must collect and maintain information about their technical environment, including information concerning:

Here's an Example Technical Architecture Document for your reference.

Provide technicians adequate resources to enable them to secure IT resources

It is extremely important that technicians be provided adequate resources to secure the IT systems that they maintain. Incorrect system configuration settings by insufficiently trained and/or over-extended technicians will lead to breaches of security. Managers should provide technicians:

Apply vendor-supplied fixes necessary to repair security vulnerabilities

It is imperative that vendor-supplied security fixes (patches) be applied to protect against system compromise. Almost all security breaches occur because of inadequately patched systems. Technicians must:

Scan computers for security vulnerabilities using available technical tools

Crackers use readily available automated scanners to scan entire networks for vulnerable systems and services. These scans, often referred to as probes, occur daily and originate from network addresses throughout the world. It is a fact that your IT systems are probed several times a day by these crackers. To ensure that you know as much about your systems as these miscreants, technicians should:

Install and maintain anti-virus software

Viruses represent a significant threat to the security of University systems. Malware has been developed that can: record all keystrokes (usernames and passwords, institutional data, etc.) entered by a user, initiate Distributed Denial of Service (DDoS) attacks against sites on the Internet, and even inflict significant damage to the infected computer. Worms (similar to ILOVEYOU and Melissa) use e-mail quite effectively to carry their damaging payloads. To combat the threat of viruses, technicians should:

Remove unneeded services and software

All services and software installed on a system serve as possible entry points for crackers. For this reason, technicians should:

Stay abreast of technology security issues

New security vulnerabilities, exploits, and issues are discovered daily. To stay informed of these newly discovered issues as well as older ones, technicians should:

Encrypt sensitive data where possible

Unencrypted data, whether it be stored in a file or transmitted across the network, is vulnerable to disclosure. There are several technologies that can be used to protect sensitive data:

For a broader discussion of secure data transmission, see Secure File Transfer Alternatives.

Replace insecure software and systems with secure alternatives

Communication protocols such as TELNET and FTP transmit information across the network in clear text, making it possible for attackers to intercept network transmissions. In addition, certain operating systems (e.g., Windows 95, 98, and ME) are not designed with enterprise level security controls in place. To help eliminate such insecure technologies at the University, technicians should:

Follow adequate procedures for user accounts and access

Access to University systems and data should only be provided to those who legitimately require it. In providing this access, adequate procedures should be followed to ensure that university policy and guidelines are adhered to. Managers and technicians should:

Follow adequate procedures for user passwords

Inadequate password procedures are a common source of system and account intrusions. Technicians should:

Maintain adequate system logs

System logs are critical in performing troubleshooting. They also play a key role in detecting intrusion attempts and performing forensics on a compromised machine. To ensure that adequate logs are maintained, technicians should:

Maintain adequate system backups

System backups are important in recovering from a system compromise. In addition, they provide key timing information when performing forensics on a compromised machine. Technicians should ensure that all critical servers are routinely backed up.

Provide adequate physical protection

Physical protection of IT systems is an often overlooked but critical component to any IT security plan. If someone has physical access to your machines, (s)he would have the ability to bypass most logical protection methods described elsewhere in this document. Technicians should:

Limit access to IT resources to local network addresses where possible

In order to reduce our exposure to outside cracking attempts, technicians should, where feasible, restrict access to IT resources so that only IU network addresses can connect. TCP Wrappers is an example of a product that provides such features.

Securely remove data from storage media

All traces of personal and business data should be securely removed from storage media (e.g., hard drives, floppy disks) before reassigning the equipment or before sending the equipment to surplus.

Attention: Deleting files and reformatting a hard drive does not remove the data stored on the hard drive. To securely remove all remnants of data, technicians should review and understand the alternatives described in the Securely Removing Data guide.

Immediately report any successful or attempted security breach to the ITSO

In order to adequately respond to successful or attempted security breaches at the university, managers and technicians should immediately report such events to the ITSO. Upon receiving a report of a successful breach, the ITSO will: