# Presentation: 269414

## Security & Privacy in Student Aid Session 47

**Security & Privacy ****in Student Aid**** *****Session 47***

## Hello Rover, Black Lab 

*“**On the Internet, nobody knows you’re a dog.”*

**Hello Rover, Black Lab **
**who likes Alpo and Milk Bones **
**and who is in a 12-step **
**program for chasing cars.**

## Why Electronic Access

***Why Electronic Access***

-  Cost
-  Less manpower
-  Less paperwork
** **Customer Service
-  It’s what people want and expect
-  Quicker
-  Accommodates change
** **Employee Satisfaction
-  Allows you to provide wanted services
-  Frees time to work other issues

## Who’s Doing What?

***Who’s Doing What?***

-  Schools -- Portals, school-issued electronic ID
-  Financial Inst. -- Portals, lender-issued electronic ID
-  SFA:
- Portals
- SFA-issued electronic ID (Mad-Dog)
- Middleware access to mainframes
- Hardened infrastructure
- Data center
- TIV WAN replacement

## We’re Opening the Doors for Information Sharing by The Good, The Bad, and The Ugly!

***We’re Opening the Doors for Information Sharing by The Good, The Bad, and The Ugly!***

** **The Good
-   Students, Schools, Taxpayers .  .  .
-  The Bad
-   Thieves and Vandals
** **The Ugly

## Thieves and Vandals

***Thieves and Vandals***

** **Thieves
-   Financial Transfers or Credit Card Information
-   For personal use, sale, blackmail
-   Privacy Information
-    For sale, blackmail, discredit
-   Other
-  Vandals
-   Denial of Service
-   Web Page Defacing
-   Data Destruction
-   Other

## Security Statistics

***Security Statistics***

**INCIDENT**

**1996**

**1999**

- Network Penetration

- Unauthorized Insiders

- Financial Losses

**37%**

**55%**

**$97 M**

**59%**

**71%**

**$265M**

- Credit:  Computer Security Institute

## 
In this issue:

* Security Journal: The Confessions Of A White Hat Hacker
* Cyberattack Report: Some Progress Made
* Feds Warn About Rise In Attacks Against E-commerce Sites
* CIA Fires, Reprimands Workers For Unauthorized Computer Use
* NASA Hacker Pleads Guilty
* Report Finds Progress In Cybersecurity In Private Sector
* Researchers Fault Independent Review Of Carnivore
* Rewards May Outweigh Risks Of Peer Networking
* Shockwave Virus Appears To Do Little Damage
* Vendors Propose XML Security Method
* Canada To Use Iris Scans For Customs IDs
* Co-op To Certify Tools To Measure Level Of Security

- In this issue:
- * Security Journal: The Confessions Of A White Hat Hacker
- * Cyberattack Report: Some Progress Made
- * Feds Warn About Rise In Attacks Against E-commerce Sites
- * CIA Fires, Reprimands Workers For Unauthorized Computer Use
- * NASA Hacker Pleads Guilty
- * Report Finds Progress In Cybersecurity In Private Sector
- * Researchers Fault Independent Review Of Carnivore
- * Rewards May Outweigh Risks Of Peer Networking
- * Shockwave Virus Appears To Do Little Damage
- * Vendors Propose XML Security Method
- * Canada To Use Iris Scans For Customs IDs
- * Co-op To Certify Tools To Measure Level Of Security

***Computerworld ******December 7, 2000***

## The Hacker's Manifestoby the Mentor

***The Hacker's Manifesto******by the Mentor***

**     ****This is our world now, the world of the electron and the switch, the beauty of the baud. We make use of a service already existing without paying for what could be dirt-cheap if it weren't run by profiteering gluttons, and you call us animals.  We explore - and you call us criminals.  We seek after knowledge - and you call us criminals. We exist without skin color, without nationality, without religious bias - and you call us criminals. You build atomic bombs, you wage wars, you murder, cheat and lie to us and try to make us believe it is for our own good - yet we are the criminals.  Yes, I am a criminal.  My crime is that of curiousity.  My crime is that of judging people by what they say and think, not what they look like. My crime is that of outsmarting you, something that you will never forgive me for. I am a hacker, and this is my manifesto.**
**	****You may stop me, but you can't stop us all.**
- Credit:  http://disc.cba.uh.edu/%7Erhirsch/fall97u/price/main.htm
- “A Technology Briefing by Group Price”

## Who Cares About Security & Privacy in Student Aid?

***Who Cares About Security ******& Privacy in Student Aid?***

- Students
- Parents
- Borrowers/repayers
- Schools (FAAs and Counsels)
- Financial institutions
- Taxpayers
- Congress/President/Department of ED

##         Protect the Taxpayer and the Student/Borrowers!!!!

*        ****Protect the Taxpayer and the Student/Borrowers!!!!***

- Congress
- IT Development Funding Requests Need                                Security Line Item
- Congressman Horne’s Report Card
- President
- Government OCIO
- PDD-63
- Department of Education
- InfoSec Steering Committee
- Multi-Tier Security Staffing

## CIA

***Security Basics***

***C***onfidentiality
***I***ntegrity
***A***vailability

***CIA***

## Confidentiality

***Confidentiality***

-  Focus -- Customer (student) data
-  Concerns -- Hijacked sessions; impersonation
-  Solutions -- PINs, rules of  behavior, encryption (SSL)
-  Issues -- Big Brother, email

*Private Information ****Stays**** Private*

## Integrity

***Integrity***

-  Focus -- Transactions, balances, personal data
-  Concerns -- Bad data (mistakes/fraud), latency
-  Solutions -- Edits, real-time updates, background checks
-  Issues -- Data synchronization, insider misbehavior

*Information is ****Accurate***

## Availability

***Availability***

-  Focus -- Processing/communications
-  Concerns -- Overloads, malevolent code, crashes
-  Solutions -- Load balancing, intrusion detection,                     resilient infrastructure
-  Issues -- Downtime tolerance, incident response

*Information Is There When You ****Need**** It*

## Discussion?Questions?

***Discussion?******Questions?***

## Thank You!!

***Thank You!!***

- Andy Boots
- Champion for Information Security and Privacy
- 202.260.8636
- andrew_boots@ed.gov
- Robert (Bob) Ingwalson
- SFA Security Services
- 202.205.5316
- robert_ingwalson@ed.gov