FWD: A possibility of progress on university security; Deadline: July 6

[Paul Howell]

------- Forwarded Message

Date: Fri, 30 Jun 2000 15:56:16 -0400 (EDT)
From: SANS Research Office <sansro@sans.org>
X-Sender: sansro@clark.net
To: unisog@sans.org
Subject: A possibility of progress on university security; Deadline: July 6
Message-ID: <Pine.SOL.4.10.10006301555070.13453-100000@clark.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-unisog@sans.org
Precedence: bulk

Hi,

During the next 30 days, several events are likely (not certain) to happen
that *may* enable universities to set some limits on the computers that
they allow to be connected through them to the Internet.  If this were to
come to pass, one of the most valuable resources would be a consensus
among university security people  (who have experience in cleaning up
after attacks) on the criteria that can be used to decide whether a
university (or for that matter any other organization) should refuse to
allow a system to be connected to the Internet.

Do you have experience cleaning up after attacks?  And if so, do you have
a list of "these have been exploited at my university; they should be
excluded" items for UNIX, Linux, and/or Windows 95/98 and/or Macs?

We'll combine the experience-based recommendations and then build toward a
SANS Consensus document.  There will be readers who feel they are experts
and they simply know what needs to be excluded. For this project, we need
to be able to prove that each of the items that will be proscribed was in
fact the culprit or co-culprit in an actual exploit that was successfully
used in a university (or college).


Deadline for this round: July 6.  

Thanks in advance.

Alan

Alan Paller
Director of Research
The SANS Institute
www.sans.org
T: 301-951-0102



------- End of Forwarded Message