IT Security and Education

[free780]

In the last few years I've dealt with Conficker, ransom ware and phishing.

 

Most of these could have been avoided with some proactive approaches. Applocker, Disable Auto run, Disable legacy auth, force 2FA for all users.

 

The thing is in education our IT Teams were never put together with this as a focus. Many of us are doing this on our own or in small teams.

 

My question is.

 

Is it possible to have a truly secure environment in education?

 

Bearing in mind the learning environment (curriculum network etc) needs to be segregated some how. Is this where we will be in a few years?

[Steve21]

I mean to me yes it's possible (ignoring 0 days). 99% of the common issues come from either bad planning/legacy work not fixed or people (IT) being too "yes sir" imho. (I know some will think that's harsh).

 

But for example, no-one needs local admin rights (ignore the odd one/weird software/setup). If they want software installed/tested, you can do it. No-one shouldn't have AppLocker setup, you adjust a rule as you install a program if needed. Auto run etc isn't an issue if admin rights aren't there etc. Port 3389? Nope nope. Firewalls disabled just to make software installs easier etc etc, all commonly seen

 

It just seems that the majority of issues are things that shouldn't be there in the first place. Even if 1 user gets infected it should only be able to affect what they have access to directly. If you have a shared area, and permissions for departments and a maths teacher gets infected, all they should be able to break is maths etc (Out comes backups etc)

 

None of what you mentioned there (apart from 2FA) is stuff that even a single tech shouldn't be able to configure/sort out with time spent on it even if they've never touched it before

 

Steve

Edited June 23, 2020 by Steve21

[ITGURU]

Even the most secure network can be targeted , you can only put in preventative measures or mitigate attacks to prevent from ransomware and other attacks.

I've seen quite a few posts where schools/organisations have cloud backups that have also been infected/targeted and yet that is meant to be secure, reliable and there for when it's needed.

[Steve21]

I've seen quite a few posts where schools/organisations have cloud backups that have also been infected/targeted and yet that is meant to be secure, reliable and there for when it's needed.

 

I mean I'd argue very much that if the cloud backup is infected, there was something that went wrong miles before that. How did the virus (insert other) even get access to the server locally in the first place?

 

Normally one of 4 routes:

 

a) Permissions being too lacking

b) Someone with permissions who did a booboo

c) lacking of said av etc

d) Zero-day

 

Steve

[computer_expert]

You'll never have a totally secure network whatever industry you work in. You can mitigate threats by keeping software up to date (as well as firmware/bios - see the spectre/meltdown vulnerability from a few years ago) and reviewing the system hardening guidance that Microsoft and the UK government, amongst others, publish.

 

I think separate domains for curric/admin are a relic from the past. With the things that microsoft suggest (PAW and the Active Directory administrative tier model) you should be able to keep one domain and save the headache of managing two domains and the assocated infrastructure.

 

User education is pretty important too. Rather than using technical terms, break it down into simple things that users will understand e.g. Would you leave your house/car key in a visible space in your garden whilst popping to the shops? This is the same as leaving a book full of username/passwords on your teachers desk. You'll get people who won't listen/take note, but what can you do if they are set in their ways and refuse to change?

 

Then you've got the poorly coded software that relies on a prehistoric version of flash with more holes than swiss cheese (despite being released last week) to deal with as well.

Edited June 23, 2020 by computer_expert

[ITGURU]

https://www.bleepingcomputer.com/news/security/ransomware-attackers-use-your-cloud-backups-against-you/

[ITGURU]

The biggest issue I find is that with cloud backups, you can create a different username/password for backup agents, but they still need local administrator access to the machines, so even if it's not the domain admin credentials, it's still going to be an admin user on the server .

[Steve21]

The biggest issue I find is that with cloud backups, you can create a different username/password for backup agents, but they still need local administrator access to the machines, so even if it's not the domain admin credentials, it's still going to be an admin user on the server .

 

I'm guessing that was meant for the other thread

 

But again, that link says exactly what I mentioned previously.

 

Backups are one the most, if not the most, important defense against ransomware, but if not configured properly, attackers will use it against you.

 

First they need access to a host either with malware etc that needs higher permissions, or via RDP configured incorrectly etc

 

It then relies on you using an admin account (via AD dump) to install/run Veeam rather than separate logins etc

 

Steve

Edited June 23, 2020 by Steve21