 |
|
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
 |
|
Creative Techniques in User Education The front line in information security is moving away from software and towards users themselves. Writing exploits is difficult, but outsmarting users is easy. As the bad guys expand their repertoire of social engineering techniques, we have to respond with innovative approaches to user education. In the online world, our control over campus networks puts us in a unique position to insert our own content into popular sites and services. In the physical world, we must develop techniques that don't rely on voluntary attendence and are targetted at specific segments of the user base - students, staff, and faculty. Security and Middleware Security and Middleware share common goals. Security services traditionally focus on preventing badness through protective, defensive and reactive tools and techniques. Middleware is responsible for providing security infrastructure services including identification, authentication, and authorization. A comprehensive security architecture is necessary to align these services to meet an organization's security needs. This session will explore the intersections and challenges of providing these complementary technologies. Digital Forensic Considerations
for IT Administrators This talk will cover forensics concepts and issues that arise as part of regulatory and organizational security compliance. Incident Management with Request Tracker Boston University has an enormous number of users, a correspondingly enormous number of security incidents, and far too few IT staff. This discussion will focus on the College of Engineering's implementation of the open-source Request Tracker system, including integration with Kerberos authentication, FAQ management, and voice mail services, and how it has simplified our handling of security issues from discovery, to reporting, to department handoff, to user handholding, to resolution, and back again. We will discuss existing enhancements we have made to this highly-customizable system, as well as ways to further increase efficiency, transparency, and adoption by departments and users. Small School InfoSec Strategies This discussion will offer a community college (2 year college) perspective on Information Security. Holyoke Community College has developed distance learning programs, wireless access presence, unfettered internet access and 23 computer labs as well as moving to a VOIP system. This discussion plans on providing a wealth of knowledge to anyone involved in higher education but will be focusing on the shorter turn over of these community/junior/2yr colleges and the inherent security concerns as a result. What does it take secure services while simultaneously allowing growth and learning to take place? These are just a few of the topics this speaker will cover and offer from the two year college perspective. Correlating and Reporting
Multiple Security Data Sources Security systems are great at pumping out data. The question is what to do with it. SIM/SEM devices consolidate data across multiple sources, but their focus tends to be storage/data warehousing and making data fit into their format. Boston College has developed a system which focuses on developing reports which incorporate data from myriad data sources. The system uses existing databases, directory services, and log files, and presents consolidated reports based on events, users, ip addresses or subnets, etc. The talk will demo the system, discuss its configuration via XML, its customizable web page output, and its extensibility via Java Servlets and Java Server Pages. BC is seeking beta program users from outside Boston College who might be interested in using the system at their schools. Grand Unified Logging
Project (GULP) The GULP system (Grand Unified Logging Program) is Columbia University's answer to registration. GULP was created primarily to assist security in conducting investigations and to allow for contact lookup in a freelove DHCP environment. In any type of security investigation, information is the key to solving the case, GULP turned out to be a very powerful tool that can answer questions way beyond the ability of simple network registration. |
|
 |
 |
 |
 |