InfoSec Bulletin #2 - June 29, 2006

Why Should I Worry About Information Security?

Personal relationships are not always what they seem. It is easy to believe it is O.K. to share my password or computer access with my co-worker, significant other, best friend or child, after all, I trust them. Right? Well... sharing such information is against University policy and industry best practice for well founded reasons. Below are some real life examples (all identifying information removed) of why this policy is in place and why all of us should take it seriously:

• Why I Should Worry About Security - A Case of Peer Jealousy?
  
  A student had just been chosen to serve as a student government representative to the faculty senate at the university. After she announced it to the people in her office, she left for a few minutes.
  
  In the short time that she was absent from her desk, someone apparently sat down at her computer, accessed her email and sent an insulting note to each member of the faculty senate.
  
  She had to write to each member afterwards, explaining that someone else had sent the note and apologizing. This was a very poor way to begin her service.
  
  Moral: Always lock your computer when you leave.
  
  

• Why I Should Worry About Security - Ex-boyfriend shows determination in a bad way!
  
  A student experienced a very nasty break-up with her boyfriend. Because she had shared her password with him, he retaliated by logging into her email account and sending inappropriate email to everyone in her graduate class, including her professor. When she found out, she didn't do anything, thinking that he would be satisfied. He did it again a week later.
  
  She changed her password to the name of her pet. But the next summer, he guessed her password and repeated the process by sending very inappropriate email to all her classmates and professor in her new graduate class.
  
  Moral: Don't share your password and use strong passwords.
  
  
• WhyI Should Worry About Security - What is your child up to on the computer?
  
  Dad had to work over the weekend and brought his son along, who wanted to use the internet. The son secretly downloaded file-share software onto Dad's business computer and began downloading copyrighted files. The son did not set up the file sharing software well, so it continued to allow file sharing after the son went home.
  
  The industry discovered the illegal file sharing activity and reported it to the university. The university shut down the port temporarily and the employee had to explain why he couldn't work to his boss.
  
  Moral: Don't let other people use your computer.
  
  Note: The above three examples were contributed by Alice Radmacher.

If you have similar real life stories you are willing to share, to help us all remember why we should be concerned about information security, please send them to the University Information Security Officer (contact information below). No identifying information will be used.

Questions?

For more information on information security, you are welcome to contact the University Information Security Officer:

Bruce W. Edwards
Information Security Officer
University of Louisville
MedCenter One Building
501 East Broadway, Suite 320
Louisville, KY 40202

e-mail: bruce.edwardsjr @ louisville.edu (Remove spaces in email address, there to minimize spam)
Web: http://security.louisville.edu