Securing Your Computer Network

• 09/01/03

Consider this a pop quiz.
Question 1: What would happen to your instructional program if you could not access your computer system due to intrusion?

Question 2: What would happen to your administrative offices if your computer network was breached?

You may have answered Question 1 with responses such as:

• Students wouldn't be able to retrieve their work or start new projects.
• No one could search resources on the Internet or in our library.
• Teachers couldn't even take attendance.

You may have answered Question 2 with responses such as:

• Scheduling changes, college applications and paycheck generation would all come to a halt.
• We couldn't access any information about our students or staff.
• We would be paying our entire administrative staff to come to work and have nothing for them to do.

In short, your entire district could be brought to its knees by a hacker's assault, and the costs of reviving the network could be astronomical. This would include the costs for restoring damaged data, re-securing the network, and repairing or replacing damaged hardware. Even more devastating would be the public embarrassment your district would suffer if your network were breached; not to mention the potential lawsuits you might face if sensitive information was exposed by a hacker.

Network Vulnerability

While district administrators may have devised plans for securing the physical plant of the school, they rarely consider the vulnerability of their computer networks. Some confuse their Internet filtering system with a security system, while others believe that the presence of an off-the-shelf firewall and virus protection software are enough to keep malicious individuals away.

The truth is that attacks on school networks are increasing exponentially. Systems are regularly "sniffed" for holes because most hackers know that school networks typically are not well secured. Aware of these vulnerabilities, enterprising hackers can commandeer a district's network and use it to launch assaults on larger computer systems. Therefore, schools should never believe that they are flying under hackers' radars.

Attacks can come from all kinds of individuals: students whose intentions are malicious or who may be trying out a newly learned skill, disgruntled staff members who are looking for revenge, or individuals from around the world who have no connection with the school at all. According to a recent FBI report on cyber crime, system attacks rose from 50,000 in 2001 to 150,000 in 2002, and are expected to reach 350,000 this year. Damage can also be caused by ignorance rather than malice through instant messaging, e-mail attachments and software downloads that can potentially destroy your system.

Schools experience many different types of attacks, including denial of service in which no one can use the system. Unauthorized intrusions into the system can come from "sniffer" programs that determine passwords and use them to take over authorized users' accounts. The entire system also can be brought down by the introduction of viruses, worms and spam. In addition, there are parasitic attacks, including the appropriation of the district's entire bandwidth, which essentially chokes the network.

System Audits

Computer systems should be audited annually to determine vulnerabilities, and technology budgets should include funds for this purpose. An audit should include regularly examining the state of the firewall, the servers and the computers. In addition, make sure that all components are properly configured and that the latest virus protection programs and software patches are in place. The use of intrusion-detection software is a must as well.

Remember that since budgeting constraints usually make investing in network security a low priority, this is not a reflection on the quality of your technology staff. Think of it as money spent on something you can't really see and don't know that you need until it's too late. Also, keep in mind that it's inappropriate to ask a school to audit itself. "Hiring a qualified security specialist to perform a formal security audit is the only way to specifically get a top-to-bottom assessment of your network's security weaknesses and needs" (Rist 2000).

Reference

Rist, O. 2000. "A Case for a Network Security Audit." InternetWeek. 13 Nov.