Aurora University Security Essay

At Aurora University there appears to be numerous levels of security put into place. The school tends to block certain websites or programs that they believe would go against their policies. Many of us experienced the issues with downloading Kali Linux on the school's network due to the association the program has with hacking. This may seem pointless, but it is put into place due to the possibility that a student could use it to access sensitive information belonging to the school. Along with the restrictions to certain websites the schools Wifi access is restricted to students only that have the correct login credentials to access the network. For those that do not have the correct login credentials the guest Wifi is available to them. At night all of the buildings the campus require card access in order to get into and the dorm areas require 2 door ID access at all times. One of the newer implementations that the school has started to use is two-factor authentication when accessing the Okta portal. While this can be annoying to have to do, it provides the school as well as its personnel an added level of security to confidential information. I believe the school has taken proper steps to secure its data and its networks. Certain restrictions such as the website blocks can be easily circumvented with the use of a VPN, but that is the case with many similar setups. There are also instances of tailgating when getting into certain buildings, which the school cannot do much to stop due to the fact that it falls into the human error of students. The two-factor authentication is a great addition to the security. There is an agreement that this can be annoying to deal with every day, especially for those who might be in an area with not a great connection on their phones, but it is still worth the extra security. I think you made a good point on the human error of the students; these are great levels of security, but something done by the students on accident or on purpose can be hard to protect against. I do not currently work somewhere, but I still remember the sort of defense that my previous workplace, Arby's, had in place for the employees. If I remember correctly, the amount of time that we used computers was very limited, it was just to log into our work account at the beginning of the shift, and to log out at the end of the shift, mostly just to record our hours every day. The principle of diversity of defense that is employed at the computer login was pretty low, as there was only one level of defense, our login name and password, so it would be easy to login in as someone else with the credentials. Looking at the principle of defense in depth, there really is only one layer of security. There is no type of verification through your phone or email, so the single layer is all there is which makes me think there is no depth of defense. I do not think they have enough layers for either principle of defense or defense in depth, as they have no layers to the security outside of the single layer. This should probably be improved as these logins determine everyone's hours worked. I feel like workplaces could also improve their security when clocking in to work, since it seems to be easy to just look over someone's shoulder and steal their credentials. When I used to work for Under Armour, it too had the same issue. For AU, to clock in your work works, you would have to login through and go through the multi-factor authentication, which I like. At my internship we have many different layers of defense when trying to access almost everything. Some of these include Multi-factor authentication when signing in to our accounts on our devices then a multifactor authentication for each application and web application. We also have multiple layers of security when it comes to blocking certain ports on companies that we manage so that nothing is done incorrectly. Also we have a firewall, email blocking system to protect from certain threats and to block emails coming from known untrusted senders. I believe there is always more you can do to make your security better but in a general overview and comparing to many different companies I would say that these are sufficient. As annoying multi-factor authentication is, I'm glad that a lot more companies are starting to adapt it into other places too. I wonder what newer security options will become available in the future. since i remember captcha used to be a thing, and now multi factored authentication seems to have really taken over. At Aurora university it is required and it does get annoying when you have to do it all the time. However I understand that it is a good security caution and helps out to see when your account may be infiltrated. I would like to see how secure the firewall is and what can make it past that at Aurora university. I worked at my Fathers' nursing home campus over the summer last year and became familiar with its environment. It is called the Holmstad. They had many different layers of protection put into place, and definitely utilized the principle of diversity of defense. A few ways his organization ensured confidentiality and authentication was by purchasing and implementing the use of two-factor authentication for its employees. The company also uses Citrix to enable their use of firewalls and antivirus so that no one can take over their devices. Availability and access control layers are demonstrated with their use of policy, stating that no employee uses their professionally designated devices for their own leisure, especially when they are connected to the campus’s network. A lot of residents' personal information would be at risk if someone was able to break into the network. Thankfully another one of their typical practices is training their employees about phishers, and other signs to look out for in case they are potentially being scammed. Knowledge is power and that is another defense added to a system set in place. Not many workplaces train employees in that manner because they are overconfident (or don't know better) in the defense they have set up. Everything changes and new ways in protection must be updated to defend against new attacks. Every place is a target and each practice they've implemented sounds like a good plan. Using a third party and even going further in their protection with other methods like two-factor-authentication, so if something happens to the information at that third party company the accounts are still safe since they need to access a trusted device of a user. An important thing I liked was training the users as we all know that users are the biggest security threat to the company at most times, because we are human. It is nice to see so many security layers in use and protecting the users.