IT Security Update - May 2003

Greetings All

IT SECURITY UPDATE

-------------------------------------------------------------------------------------------------------------

CONTENTS

1. IT Security Coordinator appointed

2. University IT security policy

3. Latest ISMC papers are up

4. Fizzer virus

5. Other virus reports

6. VAAG

-------------------------------------------------------------------------------------------------------------

1. IT Security Coordinator appointed

On 28 Apr 03, George Ng was appointed as IT Security Coordinator. His responsibilities include:

- Coordinating and providing training programmes (including courses, seminars and text) in IT security and risk analysis.

- Determining good practices in IT security.

- Responding to incident reports and coordinating corrective action as necessary.

- Distributing security alerts received from vendors and security agencies (such as AusCERT) as appropriate and necessary.

- Undertaking Risk Assessments and Business Continuity Planning for important central services.

- Defining standards and guidelines for the secure operation of Local Area Networks and computing systems in departments, including the definition of anti-virus software to be deployed on University work stations.

- Liaising with external security organisations such as AusCERT and the police.

George is contactable at:
Telephone number: 8344 4433
E-mail: georgeng@unimelb.edu.au

To keep abreast of important IT Security information regarding policy, system security, ISMC papers and other related security information, refer to the IT Security web pages at: http://www.infodiv.unimelb.edu.au/it-security/

-------------------------------------------------------------------------------------------------------------

2. University IT security policy

The IT Security Policy has been finalised. This document provides information on the use of IT assets in a secure manner. The responsibilities of the Information Strategy Committee, Vice Principal, IT Security Coordinator, Heads of Departments, Deans, Staff, Students and Internal Audit Department with regard to the establishment and maintenance of IT security are covered. The document is available for viewing at:

http://www.infodiv.unimelb.edu.au/it-security/docs/ITSecPol.pdf

-------------------------------------------------------------------------------------------------------------

3. Latest ISMC papers are up

This paper was approved at the last ISMC meeting. It contains a list of committees and staff members who have responsibilities related to IT security. This dynamic document is aimed at increasing the synergy between the various parties in their work on IT security for the University. The document can be accessed at:

http://www.infodiv.unimelb.edu.au/it-security/InfoSec_Related_Committees-final.pdf

-------------------------------------------------------------------------------------------------------------

4. Fizzer virus

IT Security agencies have noted an increase in the rate of proliferation of this virus. It severely compromises the security of computers running on the common versions of Windows operating systems. For more information, please visit:

- http://vil.mcafee.com/dispVirus.asp?virus_k=100295

- http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=WORM_FIZZER.A

- http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.fizzer@mm.html

- http://www.infodiv.unimelb.edu.au/it-security/fizzer-virus-alert-13may03.html

-------------------------------------------------------------------------------------------------------------

5. Other virus reports

A few variants of the Lovegate virus have appeared. This virus has been detected in the University. Vigilance in keeping all computers patched and virus pattern files updated is required.

http://vil.mcafee.com/dispVirus.asp?virus_k=100304

http://securityresponse.symantec.com/avcenter/venc/data/w32.hllw.lovgate.i@mm.html

-------------------------------------------------------------------------------------------------------------

6. VAAG

The Vulnerability Assessment and Advice Group will be reconvened. The main objective of the group is to identify vulnerabilities in computers systems that are on the University network.

More information on the aims and operations of the group and the application form to join the group can be found at:

http://www.infodiv.unimelb.edu.au/it-security/vaag.html

More information will be communicated soon.

-------------------------------------------------------------------------------------------------------------

END OF BULLETIN