webmaster@vul.edu +1-434-528-5276

Information Security

VUL Information Security

The VUL Information Technology department is committed to ensuring the privacy of your information during and after your tenure here at VUL. But we need your help. By staying up-to-date on the latest techniques for information security, you will protect yourself and others against fraud, theft, and worse.

Password Security

What is Password Security?

In simplest terms, Password Security is the process of choosing a difficult to guess password, then keeping it a secret. Since your password/s are the primary protection mechanism for your accounts, a poorly chosen (weak) password may result in compromise of personal user information and possibly confidential Virginia University of Lynchburg information. As such, all Virginia University of Lynchburg faculty, staff, and students (including visitors, contractors, and vendors with access to Virginia University of Lynchburg systems) are responsible for taking appropriate measures to select and secure their passwords.

Why should I change my password?

Attackers can use programs to compromise easily guessed passwords. When an attacker has access to your accounts, then he/she may inherit access to your private information and/or confidential Virginia University of Lynchburg information. Because of this, the IT department has adopted more strenuous password complexity requirements. Your new password will make it more difficult for an attacker to compromise your accounts. Remember, your password can be super difficult to guess, but if you share it with anyone, you’ve already compromised your accounts. So choose a difficult to guess password, then keep it a secret.

How do I choose a good password?

At VUL, we now have a few new requirements to make sure that our users create what we call ‘Strong Passwords’. These are passwords that an imposter could not easily guess. Your new password must:

Be at least eight characters in length Include one number, one uppercase letter, and one lowercase letter (within the first eight characters) Must NOT include special characters (!@#$%%^&, etc.) Must NOT be a password used within the past 270 days

To create such a password, try to utilize phrases instead of words. In this way, you can control what your password is without having some random string of characters that is difficult to remember. Take the following example for instance.

Phrase: “Virginia University of Lynchburg 2018”

We could certainly break this phrase up into many different usable passwords or use the whole phrase if we so choose. For this example, let’s just take the first letter from each word and make a password from it (don’t forget the complexity requirements).

v U L 2 @ ! 8

Great! It meets all of our requirements. Here are some other examples of strong passwords formed from phrases:

Phrase: “The New Testament” Possible Passwords: N w t 5 7 m n t n w t 5 2 M n t n w T 5 t m n T

Phrase: Peas and Carrots Possible Passwords: P 3 4 s c r t s P e A 5 c r 7 s p e 4 s c R t 5

In each of these examples, the chosen passwords meet the University guidelines for minimum password criteria. Also, each password is not based on a single dictionary word.

Now pick a phrase for yourself. Maybe a Bible verse, famous quote, or anything you like. Remember, don’t use words or phrases that others may think you will use. Don’t make it easy for someone to guess your password!

How can I keep my password secret?

Passwords are personal information that should never be shared with any other person, including, but not limited to, instructors, assistants, technology service staff, or supervisors. Users should not transmit passwords via email, as this is an insecure medium. Moreover, users are recommended against writing down passwords and/or storing them in an insecure place. Users sometimes record passwords in personal data assistants (PDAs) or other electronic means. While this is not entirely secure, users are encouraged to strengthen security by utilizing encryption capability. Users are discouraged from storing passwords in plain-text (non-encrypted) on any electronic media. Finally, Virginia University of Lynchburg recommends that passwords not be shared with external accounts such as AOL, Yahoo!, MSN, or other free or paid services.

I've got so many passwords, how am I supposed to remeber them all?

If you have many different accounts with separate passwords (a good idea by the way), then you probably struggle to remember which password goes with what account. Either that or you just make your password very simple so that you don’t forget. There are many programs available (some for free) that help manage passwords. Password Safe is one of these programs. It will allow you to store all of your passwords in one database. It encrypts the database using a key based on one single password you choose. From here on out, all you need to remember is the one password to let you in, then find whatever password you need to get into your other accounts. If you don’t like this one, look around. There are plenty of other password programs out there. The point is that you are being diligent in protecting information, but won’t have to remember so many passwords.

What happenes if I forgot my password?

Users should contact the VUL IT Help Desk at 434.528.5276 or helpdesk@vul.edu if a password has been forgotten. The IT Help Desk has the ability to reset passwords to temporary values. Once a password has been reset, the user should change the password as soon as they are able to gain access to the system.

How frequently should I change my password?

Virginia University of Lynchburg recommends that users change their password approximately every 180 days. If at any time a user suspects that his/her password has been compromised, the user should immediately change all passwords to protect individual and university confidentiality.

Where do I go to change my password?

Our password change process will check each new password to make sure that it meets our new requirements. If it doesn’t, you’ll have to try again. To help reduce the chances of getting rejected, make sure that you’ve satisfied the following checklist.

-Understand why passwords and secrecy are important
-Understand which kinds of characters your password MUST include
-Understand which kinds of characters your password must NOT include
-Have chosen a good phrase to base your password on
-Make sure your password meets the complexity requirements

Policies

Acceptable Use Policy

View this Policy


Not sure what you may and may not do with your university owned computing systems? Read through this policy to see how you can stay in bounds while using your computer. This policy also provides example of misuse so you can stay on the right path.

Electronic Mail Policy

View this Policy


Virginia University of Lynchburg provides all employees and students with an Electronic Mail (Email) address, we expect our users to abide by this policy. Within it, you will learn what is permissible and what sort of activity you should avoid. It’s true you do have significant leeway when it comes to using your VUL Email account. However, this policy will give you a better perspective regarding appropriate use. Reading and understanding this policy sets you on the right path for sending and receiving Email with your VUL account.

Network Connectivity Policy

View this Policy


So you bring your own laptop to the university? You’ve got temps, contractors, or visitors coming? Be sure you are familiar with the rules that govern who and what may attach to the university’s private networks. We provide a robust wired and wireless public access network for all to use. Make sure that you’re following the guidelines and procedures we recommend so you don’t expose our private network to unnecessary security risks.

Online Safety Notice

View this Policy


The Internet has become a revolutionary tool with regard to social networking and there is no shortage of online brokers that offer a place for all to share information about themselves and become more acquainted with others. Unfortunately, there are predatory individuals on the Internet as well and these persons present a real danger to others. For this reason, Virginia University of Lynchburg offers this notice in an effort to educate its users of the dangers of such information sharing.

Password Policy

View this Policy


More information about password requirements and secrecy guidelines. We can’t stress the importance of your password. It’s the only thing that separates an intruder from your personal account information. If you’re a faculty or staff at VUL, there’s even more on the line. If an intruder were to compromise your account, it could lead to FERPA violations, HIPAA violations, or other legislative infractions. Learn how to prevent these pitfalls by reading this policy.

Peer to Peer & Copyright Policy

View this Policy


Peer to Peer programs are bandwidth hogs and most people don’t even know they have these programs installed. Most peer to peer programs share out copyrighted music and movies which is against the law. This policy breaks down our rules and regulations to protect you and the University.

Workplace Security

What do you mean by Workplace Security?

When we mention this term, we just don’t mean the physical security that our Public Safety Office provides. In this sense, we mean doing your duties with the mindset of protecting private and confidential information. This doesn’t necessarily mean that you are purposely doing things to disclose private data. You could be doing things that aren’t considered responsible use. Think about it. Do you do enough to ensure that the information you handle from day to day does not fall into the wrong hands or get into the view of wandering eyes? Workplace Security is a concept that we should all subscribe to. Be sure that you do your job protecting all of the information as if it were your own private data.

What is Resposible Use?

Well, it’s basically you using the computing systems in the manner for which we provide them to you. When you become a student, faculty, or staff at Virginia University of Lynchburg, you are permitted to use our computing systems to complete your work and for limited personal use. You are required to become familiar with the

Acceptable Use Policy

as it provides guidance for what kind of use is and is not permitted on the university’s information systems. If you are a faculty or staff, you’ve already acknowledged that you’ve read and understand the policy. If you’re a student, this policy is included in your student handbook. Either way, you should become familiar with all of the policies that govern information systems use within the university. This will help you understand how to properly utilize our computers and help you to inform others if they are misusing an information system.

What do you suggest I do to be more secure?

Do’s

Do lock your workstation when you are away from your desk (ctrl + alt + del, then click ‘Lock Computer’)
Do lock your file cabinets and desk drawers
Do clean up the files on your desk and place them in a proper secure container
Do ask questions of those who are seeking information, make sure they really need to know
Do be alert for people who don’t belong in non-public areas
Do provide gentle reminders to coworkers when they may need it
Do double-check your workplace to make sure it is secure before you leave
Don’ts

Don’t store passwords on your monitor, under your keyboard, or where others may easily find them
Don’t walk away from your computer while you are still logged in
Don’t give out more information than is necessary
Don’t install unnecessary programs on your university owned computer
Don’t open Email messages if you don’t recognize the sender or if the subject line is questionable
Don’t log into a computer so that someone else can use it
Don’t let anyone connect their personal laptops to the university network
Don’t leave your portable information assets (laptop, iPod, Palm Pilot, etc.) unattended

Intellectual Property

What is Intellectual Property?

If you didn’t create or think of something first, you should be sure to seek licensure or properly credit the bearer of the Intellectual Property rights. We are all somewhat familiar with plagiarism, copyright infringement, trademark violations, patent infringement, and yes, even digital copyright infringement. Though this list is not comprehensive, you get the point. If you have questions about the origin or ownership of something you plan to use, make sure that it’s not already another’s protected work. Even ideas are protected so take care that you don’t use something without properly licensing use, crediting the true source, or violating another’s legal protections.

Plagiarism and Academic Integrity

The Virginia University of Lynchburg community of teachers and scholars affirms that the biblical principles of truth and honesty are absolutely essential. Indeed, the Bible contains numerous admonitions against false witness, dishonesty and cheating. Upholding the standard of academic integrity with its reliance on honesty is a responsibility of both faculty and students. Conduct that violates academic integrity includes, but is not limited to:

1. Dishonesty. This is lack of integrity exhibited through lying, cheating, defrauding or deceiving. Examples of dishonesty include: copying from the examination paper of another, allowing one’s own examination paper to be copied, reading without the instructor’s consent a copy of the examination prior to the date it is given, giving or receiving unpermitted aid on a take-home examination, class assignment, project and other papers; use of unauthorized aids; submitting the same work product in more than one course without the express permission of the instructor(s); or disclosing or accepting information if one takes a test at a different time than other students in the same course.

2. Plagiarism. This is stealing or using the ideas, writings or images of another as one’s own. It involves failure to acknowledge material copied from others or failure to acknowledge one’s indebtedness to another for the gist of important thoughts in a formal statement, written or oral. Charges of violating academic integrity shall be handled according to established student discipline procedures published in the Catalog and the Student Handbook.

According to Merriam-Webster Online Dictionary, to ‘plagiarize’ means:

to steal and pass off (the ideas or words of another) as one’s own
to use (another’s production) without crediting the source
to commit literary theft
to present as new and original an idea or product derived from an existing source

Is my File Sharing Application downloading Licensed files?

There are many different file sharing applications available for use over the Internet. When you choose to use one of these, be sure that it shares your music, video and other files legally. In most cases, you should be required to pay a fee to ‘swap’ files. An obvious sign that you are violating copyright is if you are not paying to download new files or share files you have already acquired. Examples may include KaZaA, Gnotella, Limewire, and Morpheus.

You should also understand that having these kind of applications on your personal pc may allow other users to connect directly to your pc. This is an extreme security risk. Further, if you install these kind of applications on your University owned workstation or laptop you are violating VUL policy. By allowing others to connect to a VUL workstation or laptop, you expose the University network to unnecessary security risks. As such, violation of this or other University policies may lead.

Where can I learn more about Copyright Protections and Applicable Legistlations?

Unsolicited Emails

Wht are Spam and Phishing?

SPAM
Think of Spam as telemarketing through email. In the same way that you receive those annoying calls at dinner, you can receive those annoying emails at work. Spam runs the full gamut of advertising including home financing, hair loss remedy’s, or even more embarrassing topics. Try as you may, there is no sure fire solution to getting rid of Spam.

PHISHING
Simply put, Phishing is an attempt to defraud the victim. Phishers look to trick users into divulging account information of some sort to gain access and steal what does not belong to them. This is a very creative form of social engineering. Be sure that you really are going to do what you think you’re going to do before you do it.

Anatomy of a Phish

How to Identify a Phish

Useful Links

Some Useful Links

Virginia University of Lynchburg provides Antivirus software to all managed workstations and laptops. If you believe your VUL computer does not have Antivirus software on it or the definitions are out-of-date, call the IT Help Desk immediately.

You should have an Antivirus program running on your personal computers as well. Here is a list of vendors to choose from:

Fee Based Antivirus Programs

Symantec Antivirus

McAfee Antivirus

Free Antivirus Programs

Microsoft Security Essentials

AVG

The Federal Trade Commission provides useful

Consumer Information

on how to protect yourself online.

Symantec Security Response

provides detailed information about current threats and how to protect your computer.