UCL Computer Security Newsletter - December 2005

The purpose of this newsletter is to keep all security reps and other
interested parties informed about what is happening around UCL
regarding computer security. Further information from the Computer
Security Team is always available at http://www.ucl.ac.uk/cert.

1. Updates

Microsoft again, please ensure everything gets patched before the
holidays. There are 2 patches, one of which is critical, for IE and
itself addresses 4 issues, 2 of which are deemed critical.

2. Institutional Firewall

It is UCL policy that all departments will be protected by the
institutional firewall. In the New Year, we will contact all
departments not yet behind the Institutional Firewall with a schedule
for moving them.

3. New advisory website at www.getsafeonline.org

Get Safe Online will help you protect yourself against internet
threats. The site is sponsored by government and leading businesses
working together to provide a free, public service.

4. Wireless Access Points

In accordance with UCL policy, all wireless access points must be
registered. There is a web form for departments to register non-
RoamNet Access Points - it can be found at http://www.ucl.ac.uk/is/
network/registration.htm

When submitted it sends an email with all the details to is-
roamnet@ucl.ac.uk and cert@ucl.ac.uk.

5. Seasonal Competition

For those of you that have read this far, thank you for all your hard
work over the year and we are going to give you a chance to win a
fabulous hamper full of lovely food and wine. The closing date is
*midday* on Tuesday 10th January 2006. The winner will be the first
correct entry pulled out of a hat after this time and will be
announced in the January newsletter. Send your answers to
cert@ucl.ac.uk (those on the cert list i.e. CST and a few people in
IS, are regrettably disallowed from entering the competition) - all
answers can be found on or from the CST website.

Questions follow:

Q1 UCL currently has site licences for which anti-virus products?

Q2 Where would you find the UCL Information Security Policy (please
give URL)?

Q3 What form do we require to be completed if there is a pressing
business need to access stored information?

Q4 What specific algorithm do we (CST) recommend for secure deletion
of particularly sensitive data?

Q5 What are the default settings for the Institutional Firewall?

Q6 What is MBSA?

Q7 What does MBSA do?

Q8 Where would you find PGP details for CST?

Q9 According to Simon's document on dealing with Windows intrusions,
what is the first step in recovering from a compromise?

Q10 What is the only safe way of recovering from a system-level
compromise such as a rootkit?

6. General

Please note all correspondence from the UCL Computer Security Team is
digitally signed either with personal PGP keys or the CERT team key
(public keys available from http://www.ucl.ac.uk/cert/contacts.html).

This newsletter and previous ones are available at http://
www.ucl.ac.uk/cert/cst-newsletters/index.html.

We welcome feedback on the content and organisation of documents on
our web page.