In looking around for possible research topics for journal articles and presentations or for my dissertation, computer security has kind of caught my eye recently. On a weekly campus vulnerability scan recently, the list of problem computers included about 25 unpatched Macs and a few other random boxes with vulnerable versions of software running or easy to guess passwords. Subsequent network scans have found several hundred more vulnerable Macs. It's nice to see them harassed by the security team occasionally so they don't get sloppy.
One interesting machine that showed up in the to-be-killed list was the server where they post information on the computers that get locked out of the network for security problems. Ironic.
One other machine caught my eye was a student's personal computer that had blank passwords for the Admin and Owner users; critical Windows updates not installed; vulnerable versions of Quicktime, RealPlayer, Flash, iTunes, and Mcafee; and the hard drive publicly shared to be readable and writeable. Ouch. That's almost as bad as the MIS professor who set up a new server just before the Christmas break a few years ago, and came back the next semester to find it had been taken over to serve up pr0n and warez.
Since information on who a computer is registered to is easily available, I got curious and looked up the student's CIL test scores. The student has not taken the Computer Systems CIL test yet, which is the one that talks about the need to keep your OS and applications patched so your computer is protected. I wonder how many students that are contacted by the campus security team have taken that test or prepared for it in any way.
In a completely nonscientific, ad hoc, non-IRB-approved, 5 minute study, I grabbed the IDs of 3 or 4 other students threatened with being disconnected from the network, and none of them had passed the Computer Systems test either. It makes me wonder.
No comments:
Post a Comment