IT Security Bulletin - Apr 2004

It would be appreciated if this information can be communicated
to students and staff through appropriate means, such as notice
boards or linked through web information services. The web address
of this article is:
http://www.infodiv.unimelb.edu.au/it-security/28-04-2004.html

1. Phishing
------------------
There has been a recent spate of emails supposedly from
Australian credit card firms and banks requesting usernames,
passwords or credit card information. These emails look very
authentic, and request for the information by email or at a
website via a given link. Email is inherently insecure and
must never be used to communicate any sensitive information.

If you are using a browser to access sensitive online services,
it is best if you initate connection to the website by typing
in the URL. Reputable firms offering online services offer
encrypted sessions to protect sensitive information. This is
often represented by a "locked padlock" icon in the status bar,
usually located at the bottom of the browser window.

Edgar Ghiocas from Veterinary Science shares a link that explains
phishing in a straightforward way:
http://www.asic.gov.au/fido/fido.nsf/byheadline/Fraudulent+emails:+some+look+genuine?openDocument

2. Debian advisories
-------------------------------
Debian has issued 26 advisories in the first three weeks of
April. AusCERT has published a list at:
http://www.auscert.org.au/render.html?cid=55

Administrators of computers using Debian operating systems are
advised to review the advisories and apply required fixes.

3. Protecting Your Personally Owned Computer
----------------------------------------------------------------------
If you use a computer at home to access the Internet, you
should take steps to protect it from attackers. Microsoft
recommends three defences:
- Use an Internet Firewall
- Apply updates for your computer
- Use up-to-date antivirus software
and has some useful information at:
http://www.microsoft.com/security/protect/default.asp

An article which gives an introduction and rationale behind
firewalls, followed by a brief comparison can be found at:
http://www.microsoft.com/security/articles/fwbenefits.asp

The computer has become an indispensable part of our work
and home use. Protection against loss or theft of information
and damage to your computer is a worthwhile effort.

4. Microsoft Security Summit
-----------------------------------------------
The next Microsoft Security Summit will be held in Melbourne
on Wed 09 Jun 2004. It will feature three tracks:
- Security
- Management
- Developers

There is no charge for the event, but registration is necessary.
Full agenda information and registration are available at:
http://www.microsoft.com/australia/security/summit/default.aspx