Higher Ed Information Security

Security experts have proposed a simple way for websites to better secure highly sensitive databases used to store user passwords: the creation of false "honeyword" passcodes that when entered would trigger alarms that account hijacking attacks are underway.

The suggestion builds on the already established practice of creating dummy accounts known as honeypot accounts. It comes as dozens of high-profile sites watched user data become jeopardized—including LivingSocial, dating site Zoosk, Evernote, Twitter, LinkedIn, and eHarmony to name just a few from the past year. Because these dummy accounts don't belong to legitimate users of the service and are normally never accessed, they can be used to send a warning to site administrators when attackers are able to log in to them. The new, complementary honeyword measure—proposed in a research paper titled "Honeywords: Making Password-Cracking Detectable—was devised by RSA Labs researcher Ari Juels and MIT cryptography professor Ronald Rivest, the latter who is the "R" in the RSA cryptography scheme.

Facebook Thursday announced a new security tool called Trusted Contacts for users who suspect they've been hacked.

It was hard to believe, but the student insisted it was true. He had discovered that compact discs from a major record company, Sony BMG, were installing dangerous software on people’s computers, without notice.

The graduate student, Alex Halderman (now a professor at the University of Michigan), was a wizard in the lab. As experienced computer security researchers, Alex and I knew what we should do: First, go back to the lab and triple-check everything. Second, warn the public.

But by this point, in 2005, the real second step was to call a lawyer. Security research was increasingly becoming a legal minefield, and we wanted to make sure we wouldn’t run afoul of the Digital Millennium Copyright Act. We weren’t afraid that our research results were wrong. What scared us was having to admit in public that we had done the research at all.

Meanwhile, hundreds of thousands of people were inserting tainted music CDs into their computers and receiving spyware. In fact, the CDs went beyond installing unauthorized software on the user’s computer... 

Don't wait until you decide to leave your current job to update your LinkedIn profile. Take a few minutes now to make sure your profile showcases your accomplishments and skills. Here are some common mistakes to avoid, as well.

The US National Institute of Standards and Technology (NIST) is planning to sponsor a federally funded research and development center (FFRDC), a nonprofit organization that will act in support the National Cybersecurity Center of Excellence (NCCoE).

NIST announced that this is the first FFRDC solely dedicated to enhancing the security of the nation's information systems. It will work in conjunction with NCCoE, a public-private information-sharing collaboration that brings together experts from industry, government and academia – it was established in partnership with the state of Maryland and Montgomery County in February 2012. 

Will BYOD lead to a rash of lawsuits from employees who feel violated? Or maybe a headline-grabbing, class-action lawsuit? Your company better make sure it has an explicit terms-of-use BYOD agreement.

IT has gone from managing a highly controlled base of tools to trying to manage a far more heterogeneous mix of devices (smartphones, tablet computers, 3G/4G data cards, netbooks, tablets) running on any number of operating systems. Trying to control all these tools is becoming unnecessary: Cloud services and applications make most data accessible from any device running any OS. The mandate for IT? Shifting from old-school device management to the far more critical and strategic discipline of user management.

This new mandate — managing, enabling, and securing users’ mobile behavior — is now beginning to require its own suite of tools. However, as young and fractured as the market still is, most vendors still offer products and features that address just one part of a company’s mobile needs, rather than all of them. This à la carte approach to managing mobility means IT managers must piece together a complete stack that works for their company.

It’s a complex undertaking, given that no two companies manage mobility the same way. Companies may embrace bring-your-own-device programs, for instance, in a spectrum of ways — or not at all. Each company has its own unique approach to acquiring, distributing, funding, managing, and outfitting its employees’ mobile devices. And every company needs different apps and levels of security.

The best higher ed information technology blogs on MOOCs, cloud computing, mobile learning, social media, digital pedagogy and more. (Submitted and voted on by EdTech readers.)

Facebook's recently launched Facebook Home app makes using the social network on Android smartphones much easier and smoother — but might also open up some important security holes.