Securing Your Computer Network -- THE Journal

SecurityPrivacy

Securing Your Computer Network

09/01/03

##AUTHORSPLIT##<--->

Consider this a pop quiz.
Question 1: What would happen to your instructional program if you could not access your computer system due to intrusion?

Question 2: What would happen to your administrative offices if your computer network was breached?

You may have answered Question 1 with responses such as:

Students wouldn't be able to retrieve their work or start new projects.
No one could search resources on the Internet or in our library.
Teachers couldn't even take attendance.

You may have answered Question 2 with responses such as:

Scheduling changes, college applications and paycheck generation would all come to a halt.
We couldn't access any information about our students or staff.
We would be paying our entire administrative staff to come to work and have nothing for them to do.

In short, your entire district could be brought to its knees by a hacker's assault, and the costs of reviving the network could be astronomical. This would include the costs for restoring damaged data, re-securing the network, and repairing or replacing damaged hardware. Even more devastating would be the public embarrassment your district would suffer if your network were breached; not to mention the potential lawsuits you might face if sensitive information was exposed by a hacker.

Network Vulnerability

While district administrators may have devised plans for securing the physical plant of the school, they rarely consider the vulnerability of their computer networks. Some confuse their Internet filtering system with a security system, while others believe that the presence of an off-the-shelf firewall and virus protection software are enough to keep malicious individuals away.

The truth is that attacks on school networks are increasing exponentially. Systems are regularly "sniffed" for holes because most hackers know that school networks typically are not well secured. Aware of these vulnerabilities, enterprising hackers can commandeer a district's network and use it to launch assaults on larger computer systems. Therefore, schools should never believe that they are flying under hackers' radars.

Attacks can come from all kinds of individuals: students whose intentions are malicious or who may be trying out a newly learned skill, disgruntled staff members who are looking for revenge, or individuals from around the world who have no connection with the school at all. According to a recent FBI report on cyber crime, system attacks rose from 50,000 in 2001 to 150,000 in 2002, and are expected to reach 350,000 this year. Damage can also be caused by ignorance rather than malice through instant messaging, e-mail attachments and software downloads that can potentially destroy your system.

Schools experience many different types of attacks, including denial of service in which no one can use the system. Unauthorized intrusions into the system can come from "sniffer" programs that determine passwords and use them to take over authorized users' accounts. The entire system also can be brought down by the introduction of viruses, worms and spam. In addition, there are parasitic attacks, including the appropriation of the district's entire bandwidth, which essentially chokes the network.

System Audits

Computer systems should be audited annually to determine vulnerabilities, and technology budgets should include funds for this purpose. An audit should include regularly examining the state of the firewall, the servers and the computers. In addition, make sure that all components are properly configured and that the latest virus protection programs and software patches are in place. The use of intrusion-detection software is a must as well.

Remember that since budgeting constraints usually make investing in network security a low priority, this is not a reflection on the quality of your technology staff. Think of it as money spent on something you can't really see and don't know that you need until it's too late. Also, keep in mind that it's inappropriate to ask a school to audit itself. "Hiring a qualified security specialist to perform a formal security audit is the only way to specifically get a top-to-bottom assessment of your network's security weaknesses and needs" (Rist 2000).

Reference

Rist, O. 2000. "A Case for a Network Security Audit." InternetWeek. 13 Nov.

E-Mail this page

Printable Format

Featured

OpenAI Launching AI-Powered Search Engine

OpenAI has unveiled SearchGPT, a new AI-powered search engine designed to access information from across the internet in real time. The much-anticipated prototype will provide more organized and meaningful search results by summarizing and contextualizing information rather than returning lists of links.
3 in 4 Education Institutions Have Uncovered a Cyber Attack on Their Infrastructure in the Past Year

Seventy-seven percent of institutions across K-12 and higher education have identified a cyber attack on their infrastructure within the past 12 months, according to a new survey from cybersecurity company Netwrix.
FCC Cybersecurity Pilot Update: Administrative Window Opens Aug. 26

The Universal Service Administrative Co. (USAC) has just released information on how to begin making administrative updates to prepare the user permissions necessary for the Federal Communications Commission Schools and Libraries Cybersecurity Pilot Program.
FCC Reports Strong Interest in Schools and Libraries Cybersecurity Pilot Program

The Federal Communications Commission has received 2,734 applications totaling $3.7 billion in funding requests from schools, libraries, and consortia for its Schools and Libraries Cybersecurity Pilot Program, the agency reported in a recent announcement.