tag:blogger.com,1999:blog-4482521283458453577.post7099374738219727944..comments2008-12-18T09:09:47.852-08:00kevin thompsonhttps://profiles.google.com/107682921975811187169noreply@blogger.comBlogger3125tag:blogger.com,1999:blog-4482521283458453577.post-89065751262211906592008-12-18T09:09:00.000-08:002008-12-18T09:09:00.000-08:00Being a university faculty myself, let me provide my perspective on the subject of faculty being harder to educate and on the need for improved security education/awareness.<BR/><BR/>First of all, faculty members who have tenure (myself included) can be quite stubborn and may as you put it "thick-headed." Some of that may come from an attitude of "if it ain't broke, don't fix it" stemming from years of administration-backed changes that seem to have little positive impact on the primary mission of the university, i.e. teaching.<BR/><BR/>However, I suspect that there's a deeper mechanism at work here, namely that the very "thought leaders" and "lifelong learners" that you have identified focus the subject of their lifelong learning so narrowly as to become unable to absorb new concepts, ideas, or worse change their way of thinking.<BR/><BR/>On a concept like information security in which technology and practices need to adapt to the changes in the threat environment, I find that many of my faculty colleagues are thinking more like dinosaurs rather than "thought leaders." Most security professionals would agree that what worked yesterday (or last month, or last year, or 10 years ago) may not work tomorrow. Yet, many faculty continue to act and think as if what they've come to know and experience in the near or distant past will continue to hold true.<BR/><BR/>On the subject of the phishing emails, the simple act of questioning the validity of an email message, or a message received via more traditional means, goes contrary to the environment of trust and sharing that adorns academia. Faculty may, by the very nature of their training and conditioning, be more susceptible to phishing than the average user.<BR/><BR/>Finally, you are absolutely correct in wanting to ensure better security for ALL the machines within your domain, faculty and lab machines included. I am a firm believer in the validity of the configuration standards that you mention for all publicly visible servers. If a faculty (or staff) doesn't know what TCP, SMTP, or DNS are, then they should not be administering the server, at least not on their own. I see a need for cooperation here, where IT services and others can agree to share the administration of these servers in order to provide a valuable service (the reason that the server is up in the first place) with reasonable security and patching processes (to make security managers happy and keep hackers at bay).DrInfoSechttp://www.blogger.com/profile/04203172703592313484noreply@blogger.comtag:blogger.com,1999:blog-4482521283458453577.post-21816713684221419642008-12-08T07:54:00.000-08:002008-12-08T07:54:00.000-08:00Indeed, this is not an isolated phenomenonMatt and Brandyhttp://www.blogger.com/profile/17729544036391954258noreply@blogger.comtag:blogger.com,1999:blog-4482521283458453577.post-76691121850179119962008-12-06T16:07:00.000-08:002008-12-06T16:07:00.000-08:00I'm not surprised, but unfortunately I have no better insight into this, other than to confirm that it's not just your university.Michael Janke ' or 1=1 --http://www.blogger.com/profile/00357905802460949707noreply@blogger.com