You may
be aware of the heightened alerts for computer security measures
from recent press reports. Hackers are using all sorts of
sophisticated means in order to illegally gain access to computer
systems, to capture electronic ID and passwords, to steal
electronic data, and/or launch denial of service attacks on
a particular system. In our University, extensive services
and information are now available electronically. It is thus
of paramount importance that effective security measures and
practice must be applied regularly, and a holistic approach
to the problem must be taken, taking into consideration of
all kinds of threats, both established and novel, and all
the defenses, whether technical, organizational, or human.
It must be emphasized that security is the responsibility
of the organization as a whole, not just a single department
or individual staff. It requires coordination from the whole
community, and everyone must follow well defined security
processes.
Risks
arise from threats, vulnerabilities and their potential impact
upon the organization. Security threats can come from a variety
of sources - criminals, hackers and users are the obvious
ones. In general, there are five kinds of threats: Improper
behavior, fraud and theft of information, damage to systems
and data, access control, and legal threats. To address these
threats and mitigate the risks they represent to the organization,
an effective and robust security program is needed.
As part
of this security program, the Computing Services Centre (CSC)
will proactively and periodically review and assess the CityU
IT infrastructure, the security policies and processes, and
the configurations of the systems and networking equipments
that are connecting to our campus network, CTNET. This Security
Assessment Service (the "Service") will evaluate
the effectiveness of technical controls in protecting the
information assets of the whole organization as well as individual
departments.
The Service
will comprise of an overall and complete low-level security
assessment of the current technical environment, including
the perimeter and internet environment and the internal network
and systems in order to identify potential vulnerabilities
that would allow an unauthorized attacker to gain access to
the systems or otherwise cause financial or reputable damage
to the University. In general, the following Security Areas
will be dealt with: security documentation, physical security,
IT infrastructure design, authentication, authorization, auditing,
data privacy, change management, and people management. To
effectively collect information on these areas, the following
approaches will be taken throughout the Service:
