TechTalks Event
Pandora's Box: Firewalls and Campus Security
with guest experts Randy Marchany, of Virginia Tech, and Clair W. Goldsmith, of the University of Alabama-Birmingham
May 3, 2001
Audio
• Streaming
MP3
• Download
MP3 (Download
Tips)
2001, it's no longer just the protection of students' or patients' personal or medical information, our institutions are heavily engaged in e-commerce and e-business. Failure to secure WWW based applications and servers could do more than embarrass your institution's leadership, they leave it open to liability lawsuits and cause significant monetary loss. What kinds of attacks can occur? What are some of the simple solutions and not-so-simple solutions for campus security, and their implications/consequences?
Questions during the event indicated that many listeners wanted a direct link to SANS' How To Eliminate The Ten Most Critical Internet Security Threats: The Experts� Consensus .
Guest Experts
Randy Marchany has been involved in the computer industry
since 1972. He is currently the senior member of the VA Tech Computing
Center's Unix system management group. He is the coordinator of
VA-CIRT, an incident response team comprising of IRT's from various
VA state Universities. He is the author of VA Tech's Acceptable
Use Statement which has become a model for the VA state university
system. He has been a frequent speaker at national and international
conferences such as SANS, IIA, ISACA, Network Security, IEEE Symposium
on Systems Management, DECUS, Computer Security Conference. DECUS-Canada.
The SANS Institute has described him as the "best storyteller in the computer security field." He has taught professional development seminars on Unix System Management, Forming Incident Response Teams, Auditing Unix Systems, Auditing Internet Security for various professional groups such as ISACA, IIA, Ernst & Young and the SANS Institute. He is a co-author of the SANS Institute's "Top 10 Internet Security Vulnerabilities" document that has become a standard for most computer security and auditing software. He is also co-author of the SANS Institute's "Computer Security- Incident Handling - Step by Step" which has been recognized as one of the foremost publications on Incident Response. He is currently working on a new SANS publication which describes how to design Internet Security audit programs.
Clair W. Goldsmith came to the University of Alabama at Birmingham
in August of 1999 as the Vice President for Information Technology
and Chief Information Officer. Dr. Goldsmith oversees units including
Communications Services, The University Computer Center (TUCC),
the Call Center, Academic Computing, Instructional Technology and
Web Services. He was employed with the University of Texas at Austin
from 1991 through 1999 as Deputy Director of Academic Computing
and Instructional Technology Services. From 1991 until 1994, he
was Director of Strategy and Planning for Management Information
Systems for the University of Texas System Administration in Austin.
Prior to joining U.T. Austin, Dr. Goldsmith was the Vice President
of Technology for Advanced Software Technologies, Inc. Beginning
in 1976, he spent 13 years at the University of Texas Health Science
Center at San Antonio as Director of Computing Resources and Executive
Director of Information Technology with responsibility for academic
and administrative computing as well as telecommunications. He concurrently
served as Adjunct Associate Professor at the University of Texas
at Austin and the University of Texas at San Antonio.
Clair has served on numerous committees. He currently is Co-Chair of the Educause Net@EDU PKI working group. He is a member of the University of Alabama CIO Council. Dr. Goldsmith serves as an elected member of the Southeastern University Research Association (SURA) CIO Steering Committee. He served on the U.T. System Strategic Leadership Council and the U.T. System Copyright Compliance Committee. He was the Chair of the EDUCOM'98 program committee.
Co-Hosts
Howard Strauss (above, left), Manager of Academic Applications
at Princeton University, is TechTalk's Technology Anchor.
Judith Boettcher is the Executive Director of CREN.
Together, Howard and Judith will ask the really tough questions—and relay the questions you email to them at expert@cren.net.
Background & Resources
One of the very best ways to get background on an issue is by reviewing the audio, transcript, and resource list from any related Tech Talks which have been previously broadcast and are now fully archived. Two fairly recent archived Tech Talks are germane as background for this discussion:
- February 22, 2001: Web Access Management/Security with guest expert Phil Schacter of the Burton Group
- November 2, 2000: The Top Ten User Mistakes that Make Security Tough! with guest expert Mark Bruhn, of Indiana University
Judith shared some pertinent resources at one of her favorite online publications, Network Magazine:
- Quantifying Risk;
- Top Ten Security Tips; and
- this article, which reviews what we've learned since those nasty Denial of Service attacks: DDoS Is Neither Dead Nor Forgotten.
Discussion about firewalls is really a discussion about security policy. Here are some resources about security plan development:
- The Internet Engineering Task Force (IETF) Site Security Handbook RFC (Request for Comment):
- Internet Security Policy - A Technical Guide
- Building Effective, Tailored Information Security Policy
