Re: Security Awareness Programs

[Mike Cunningham <mike.cunningham () PCT EDU>]

We do not give VPN access to any students. Some employees use VPN but no students. I do think required changes for 
employees is absolutely essential and would like to see more frequent required changes depending on level of access. 

No student account has access to more than their own data. Same as the level of data I have access to at my bank. 
Students who are also employees get a second account that would need to comply with all employee rules for password 
changes. 

Sent from my iPad

> On Apr 2, 2014, at 5:34 PM, "Flynn, Gary - flynngn" <flynngn () JMU EDU> wrote:
>
> A couple additions to the comments posted by others:
>
> - None of the organizations you mentioned give you VPN access into their
> networks and access to as broad a range of systems as those that exist in a
> university environment.
> - All the services you mentioned affect only you. Unless student employees
> are given different credentials, then they may have access to data or
> services affecting others.
>
>
>
> > -----Original Message-----
> > From: The EDUCAUSE Security Constituent Group Listserv
> > [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Mike
> > Cunningham
> > Sent: Wednesday, April 02, 2014 3:50 PM
> > To: SECURITY () LISTSERV EDUCAUSE EDU
> > Subject: Re: [SECURITY] Security Awareness Programs
> >
> > I have a philosophical question for this group...
> >
> > My bank never requires me, their customer, to ever change my password
> > My credit union never requires me, their customer, to ever change my
> > password My health insurance company never requires me, their customer,
> > to ever change my password My investment web site, my credit card bank,
> > my online prescription site, my hotel rewards account, my airline rewards
> > account, my daughters school district, never requires me to ever change my
> > password
> >
> > Why does Higher Education make students, their customers, change their
> > password?
> > Would it be better to not require it and teach them why they should
> instead?
> > Mike Cunningham
> > VP of Information Technology Services/CIO Pennsylvania College of
> > Technology
> >
> >
> >
> > -----Original Message-----
> > From: The EDUCAUSE Security Constituent Group Listserv
> > [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Flynn, Gary -
> > flynngn
> > Sent: Wednesday, April 02, 2014 3:41 PM
> > To: SECURITY () LISTSERV EDUCAUSE EDU
> > Subject: Re: [SECURITY] Security Awareness Programs
> >
> > JMU policy requires password changes every 90 days.
> >
> > Our password change process includes having to click through captive web
> > pages containing security awareness content.
> >
> > We do not track progress. People may click through without reading it. We
> > know based on feedback that some do. OTOH we know based on feedback
> > that some don't.
> >
> > It is all custom code and content. Content is based on role and whether it
> is
> > the first time through.
> >
> > new applicants (one page on phishing and AUP) new/returning student
> > new/returning employee/affiliate graduate (one page on phishing and AUP)
> >
> > Content for new folks is relatively constant. It hasn't changed much over
> the
> > years.
> >
> > Content for returning folks changes about once a semester.
> >
> > We've been doing this for around ten years.
> >
> > People are sent an email message after the password change indicating the
> > change and providing a link to provide feedback for the security awareness
> > content. Feedback has been mixed. Sometimes, uh, colorful and often
> > associated with  the requirement to change passwords. Sometimes quite
> > positive and/or constructive.
> >
> > Gary Flynn
> > Security Engineer
> > James Madison University
> > Don't Be A PHISH!
> > IsItReal?
> > http://www.jmu.edu/computing/ittraining/SIGUCCS/story.html
> >
> >
> >
> >
> > > -----Original Message-----
> > > From: The EDUCAUSE Security Constituent Group Listserv
> > > [mailto:SECURITY () LISTSERV EDUCAUSE EDU] On Behalf Of Peter
> > Lundstedt
> > > Sent: Wednesday, April 02, 2014 3:33 PM
> > > To: SECURITY () LISTSERV EDUCAUSE EDU
> > > Subject: [SECURITY] Security Awareness Programs
> > >
> > > Hi All,
> > >
> > >
> > >
> > > Curious on what others are doing to 'get the word out' on their
> campuses.
> > > What approaches seem to work best from both an initial push out on a
> > > new subject or with a new program, to keeping things up to date with
> > > acknowledgements, visibility, &c?
> > >
> > >
> > >
> > > From a product point of view, we've explored the SANS Securing the
> > > Human series among a few others, but the lack of customization and
> > > integration
> > into
> > > HR training modules is steering us away.  Experiences there?
> > >
> > >
> > >
> > > Peter Lundstedt
> > >
> > > SECURITY ANALYST 2, INFRASTRUCTURE & SECURITY SERVICES
> > >
> > >
> > >
> > > oit