{"id":454,"date":"2004-03-17T14:25:06","date_gmt":"2004-03-17T21:25:06","guid":{"rendered":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/?p=454"},"modified":"2004-03-17T14:25:06","modified_gmt":"2004-03-17T21:25:06","slug":"protecting-our-customers","status":"publish","type":"post","link":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/2004\/03\/protecting-our-customers\/","title":{"rendered":"Protecting our Customers"},"content":{"rendered":"<p>2nd talk of the conference is about Information Security.<\/p>\n<p>Information Security is starting to be taken a lot more seriously in HE. We have seen threats increase (e.g. Code Red, Blaster), and we are now seeing more pressure to manage the risks. The speakers (Mike Roch<br \/>\n, University of Reading and Andrew Cormack, UKERNA) suggest that there is a need for a &#8216;toolkit&#8217; for Information security.<\/p>\n<p>One possible framework for this is BS7799. However, this standard has not been widely adopted for accrediation purposes, but it may still be useful as a toolkit. There is now an updated version of the standard (ISO\/IEC17799:2000), which is more descriptive and has more support from the governing bodies.<\/p>\n<p>So &#8211; what is in BS7799-2:2002?<\/p>\n<p>Information Security Policy<br \/>\nOrganisational Security<br \/>\nAsset classification and control<br \/>\nPersonnel security<br \/>\nPhysical and environmental Policy<br \/>\nCommunications and operations management<br \/>\nAccess control<br \/>\nSystem development and maintenance<br \/>\nBusiness continuity management<br \/>\nLegal compliance<\/p>\n<p>However, there are some things missing that perhaps is relevant to HE, which generally relate to the flexibility our users expect (attaching their own equipment to the institutional network, use of the network for social use, etc.)<\/p>\n<p>It took a while to get round to it, but these are the speakers recommendations as to what policy documents are required:<\/p>\n<ul><\/p>\n<li>Information Security\n<li>Operations\n<li>Business continutity plan\n<li>Staff\/student\n<li>Compliance\n<li>Information handling\n<li>Network management\n<li>System design\n<li>System management\n<li>Software management\n<li>User management\n<li>Acceptable use\n<\/ul>\n<\/p>\n<p>There may also be a need for<\/p>\n<ul><\/p>\n<li>Outsourcing\n<li>Mobile computing\n<li>Teleworking\n<li>Cryptography\n<li>Wireless networking\n<\/ul>\n<\/p>\n<p>This all seem very well, and some of these policies we already have, but some suggestions seem completely impractical. It&#8217;s all very well having a policy saying &#8216;if you encrypt information, it must be retrievable&#8217; but pretty much impossible to enforce.<\/p>\n<p>Overall I&#8217;m thinking &#8211; oh god, not more policies. I do see the point, but lets get this done as easily, and painlessly as possible.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>2nd talk of the conference is about Information Security. Information Security is starting to be taken a lot more seriously in HE. We have seen threats increase (e.g. Code Red, Blaster), and we are now seeing more pressure to manage the risks. The speakers (Mike Roch , University of Reading and Andrew Cormack, UKERNA) suggest [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[28],"class_list":["post-454","post","type-post","status-publish","format-standard","hentry","tag-ucisa-2004"],"_links":{"self":[{"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/posts\/454","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/comments?post=454"}],"version-history":[{"count":0,"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/posts\/454\/revisions"}],"wp:attachment":[{"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/media?parent=454"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/categories?post=454"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/www.meanboyfriend.com\/overdue_ideas\/wp-json\/wp\/v2\/tags?post=454"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}