Main Navigation:

Welcome to the University of Tennessee's resource for information technology security. The Information Security Office (ISO) is charged with the responsibility of network and systems security at the University of Tennessee.

The ISO works with members of the UT community, including system administrators, students, staff and faculty, to protect the UT network and connected hosts. The ISO cooperates with administrators at other sites, as well as law enforcement entities, in response to security incidents.

Security Overview

Introduction

System security is a cyclical process. Steps have to be taken daily to ensure the integrity of data and security of a system. The process of system hardening is not a one-time event; it is a dynamic and reiterative process. Security holes are discovered daily in operating systems and programs. A secure system today may not be secure tomorrow.

System security cannot be considered inconsequential. "Who would want to break into this system or why would they want to?" The how and where of this line of questioning can fill volumes. The "who" could be anyone whether they have legitimate access or not. The "why" is simple: free computing resources to be used by an intruder in any way they see fit. A compromised system can quickly become a liability as the compromised machine begins to affect the network or operations on other machines locally and remotely.

A system can be compromised via non-patched or insecure network applications. However, there are many more ways that a system can be compromised via a local account. Because of this fact, every aspect of the system and its maintenance must be considered when securing it. Because there is no "magic bullet" for securing a system, securing in layers while adding granularity at each level is the best approach. For example, physical security is one layer. An example of adding granularity to physical security is to use badge access to the area where a machine is located. Host security could be considered at the top layer. An example of granularity at this layer is securing the kernel.

Security in Layers

Security in layers is the preferred approach to securing a system. The template below offers a basic level of granularity. It should not be taken as an absolute; rather it is a base that should be extended upon by each system administrator:

Host
Application--Web, Mail, File sharing, shared programs (e.g. word processing)
OS--Kernel, system binaries, system network parameters, file system, file and directory security

User
Passwords, Permissions, Accounting, User programs

Physical
Console access, System in protected area (locked and/or badge access)

One single mechanism cannot be relied upon for the security of a system. It should be looked at from every angle with all the pieces and parts taken into consideration.

Physical Security

All systems analyst, support personnel, and system users need to be aware that physical security plays an equally important role in the overall protection of each system attached to the University's networks. Restrict access to each machine with a minimum requirement being establishment of a hardened screen saver password. BIOS passwords should be used for systems that handle sensitive and/or business critical information. Use of these passwords (screensaver and BIOS) by all Windows users on the campus is an excellent protection mechanism from unauthorized physical access. It should also be noted that a system that is allowed unrestricted and unmonitored access to the University population is vulnerable even if these passwords (screensaver and BIOS) are set.

A simple but invaluable rule of thumb in the reiterative process of system security is to know your machine: be familiar with its users, processes, and files.

IT Security Awareness