RE: Network-Security Expert Says Colleges Should Do More to Protect Their Computers

[Paul Killey]

I wasn't going to reply to this message, but then I saw the recent
announcement on "SANS Flash: Most dangerous flaw found in Windows
workstations, Fix available." also sent to this list and then could no
longer resist.

Re: "One thing that would help is if there was a worldwide awareness of the
danger of opening up unknown attachments to e-mail."  Or the danger of even
getting e-mail and not opening attachments, I guess.  Maybe the problem is
with the security model and implementation of whatever you are using to
access the e-mail?

User awareness is not to be dismissed, but it is a long way from being
sufficient.  Users do not have enough info to make informed decisions about
things.

"And universities are going to increasingly find themselves the targets of
civil liability if they don't start controlling what they do."  Does that
include running vendor software?  Whether MS or CDE?

This idea of universities having different problems w/ security than private
sector outfits I think is nutty.  Also, the combination of Pollyanna-ish
advice like "don't open enclosures" and "everyone can do their bit" and
"this stuff is really hard and universities can't get it it done" is causing
some cognitive dissonance for me.

If anything, I think universities as a class are more aware of and deal with
problems more realistically than the private sector.

Should colleges do more?  Yes.  Which puts them in the same boat as
everybody else.

- --paul