Why you should ban USB drives at school

After spending hours restoring desktops recently, which a clever student had booted from a rogue USB flash drive loaded with Malware, it dawned on me that the convenience of these handy little gadgets might just be overrated. And when combined with the benefits of the cloud, specifically the free cloud available to students via the Office 365 (live@edu) service, the risks vs. benefit ratio has clearly tipped towards risk.

I know it seems like such a simple way to transport data like homework, projects, photos, etc, but it also just as easy to transport utilities that can destroy the hard drives on your computers, take direct control of the underlying computer hardware, or modify computer registry errors in a way that is nearly impossible to repair.

You may have the very best security practices in place, such as a perimeter Unified Threat Management (UTM) device, endpoint Anti-Virus protection, and separate VLans (network isolation), and yet be vulnerable to a meltdown caused by a free download from the Internet attached directly onto a PC in your school. It is nearly impossible to guarantee computer security if there is physical access to the device.

Banning USB devices is one of the simplest and most effective ways to reduce the cost of network administration in your school.

But aside from the security aspects, there are also some real practical benefits of tossing those USB drives. Let’s take a look at the advantages to see if they don’t, in your specific circumstance, outweigh the benefits.

Here are the top 10 reasons why you should ban USB drives at your school, in favor of the cloud:

• 10) Eliminate the cost of purchasing the hardware. At $5.00 - $75.00 ea. (depending on capacity), you could save a bundle of money.
• 9) Reduce the cost of managing the devices – tracking these identical (presumably) looking devices and accounting for them can be burdensome.
• 8) Avoid the cost of replacing the devices – responsibility for replacing the drives when they are lost; placing identity (ownership) upon them is difficult.
• 7) Reduce plagiarism - unauthorized sharing of work is nearly impossible to detect and prevent while using a flash drive.
• 6) Improve collaboration – accountable sharing of work is possible in the cloud, impossible on a flash drive.
• 5) Reduce support costs – time spent unnecessarily managing infected or otherwise misconfigured hardware is a real cost.
• 4) Lower the cost of your infrastructure – spending money on student servers can in most cases be completely eliminated.
• 3) Improving teacher to student interaction – with cloud based services, teachers can simultaneously push information to an entire class of students.
• 2) Increase student access to teachers – individual work can be made available to teachers with no extra effort by the student other than saving the work to their private cloud space.
• 1) Eliminating the excuse of “I forgot my homework, it's on my flash drive!” Homework is always a device away (computer, tablet, phone, etc). Presuming it is done, of course!

There you have it, ten solid reasons to ban flash drives from your school.

Now if you are more gently persuaded, have plenty of resources, and don’t want to offend anyone’s sensitivities, you could adopt a more persuasive approach to the matter by making cloud services available to your students and making flash drives subject to inspection if used on school computers.

Given the chance, smart students will quickly realize the tremendous advantages of using their own private cloud and soon leave their flash drives at home.

Desktop Security - How to avoid getting the latest bug

I was raised on a small farm in Idaho, where, believe it or not, one of my daily chores was to milk a cow – by hand. It was not a particularly difficult task, but did require a few essential pieces of equipment (aside from the cow), that being a bucket, cleaning supplies, and a wooden stool. The stool had three legs and was crucial to a successful outcome of the task.

Think about that 3 legged stool as we address the topic of desktop security; there is a lesson.

You should understand three important components to adequately address desktop security, trying to provide security with less can be a problem. They are:

1. A Firewall to block all of the ports into and out of your computer’s resources
2. Antivirus software to detect and destroy malicious code that arrives on your computer
3. Spyware/malware protection to avoid being tracked, hijacked, or otherwise taken for a ride

Although possible, it was rather hazardous to milk the cow using a one or even a two legged stool. And no stool at all was a real show stopper.Keep this corollary in mind as you consider how to protect your desktop from intrusions, virus’, and malware. Optimally you need all three, having none of them will eventually stop your computer from working – unless you have no connection to the outside world whatsoever.

What about one of the popular Security Suites?

A number of software companies provide security suites for PC’s. They attempt to combine all of the aforementioned security services into one package, and sometimes throw in some extras. Are these a good use of your resources? Generally, they are not and here is why.

The problem with most of the security suites on the market today is that they are akin to using a Lazyboy recliner to milk the cow (think of the above example).   Most of them just get in the way of getting the task at hand accomplished.

Let’s keep this real simple and cost effective to boot, by reviewing the three legs of the stool in more detail and how to construct them.

Desktop Firewall

Every Windows Operating System today has a built in firewall. It is more than adequate, especially now that most networks are protected by a gateway or perimeter firewall device. Even most consumer class DSL /Cable Modems, which connects you to the Internet now have this functionality.

So, rarely do you need to buy additional firewall software. In fact, part of the problems associated with added firewall software is the inevitable conflict with the Microsoft Windows firewall.  It either turns it off, tries overriding it, or attempts to co-exist with it.

Some of these third party firewalls are so obtrusive, they may actually block current programs or programs you are attempting to install. This in turn requires you to configure the firewall to allow access to these programs. And if you are installing one brand of security software that competes with the security software of another provider, the problem can even get worse.

As conflicts and performance issues arise, the firewall often gets turned off to accommodate running a particular program, defeating the entire purpose of the firewall in the first place.

My recommendation is to turn on the Windows Firewall and use it alone. If you have already purchased one of the Security Suites, simply uninstall or turn off the Firewall portion of that duplicate Firewall.

Antivirus Protection

Antivirus software is an essential part of securing your desktop or laptop. But having tried just about every brand out there, it is my opinion that few difference exists between them. No doubt there are minor differences in function and form, but most provide the same basic protection and nearly all Antivirus Software manufactures share Virus Signatures with each other in a cooperative manner, especially true during a new Virus outbreak.

It really boils down to price, and I mean total price.

Manually installing 100 copies of a free Antivirus solution in your school may be much more expensive that doing a centralized “push” type of installation from a server or management console, using a commercial antivirus solution. In other words, the hidden cost of labor could far outweigh the savings of “free” software.

My recommendation for organizations of 10 or less PC’s is to use one of the free antivirus programs available. My favorite is Microsoft Security Essentials. It is free (currently), reasonably light weight (meaning it is not a resource hog), and effective.

You can obtain a copy at the following URL: www.microsoft.com/security_essentials (don’t miss the underscore if you type that url) If you have a Microsoft school agreement, you can buy anti-virus, (end point ) protection for a few dollars per computer per year.

Spyware/Malware

The difference between a Virus, Spyware, or Malware infection can be very slight, indeed there is significant overlap in the two areas. And while much of the spyware or malware software is relatively harmless, it is a great idea to understand what software on your system may be running in the background without your knowledge or consent.

Common purposes of more serious Spyware/Malware programs are to harvest information from your system, utilize your system for unsavory purposes (such as sending out SPAM), track your browsing habits, and/or taking control of your computer.

There are all types of clever ways you can become infected with these programs, so you do need protection.  A common trick used to infect your system convincing you to install a free “Antivirus Program” or click on “Free Malware Scan”. This is usually accompanied by an unsolicited  pop-up telling you that your computer is infected.

I won’t even try to list the good, the bad, or the ugly when it comes to the enormous variety of programs in this category. I like to keep things real simple and cost effective.

My recommendation, again, for organizations of 10 or less PC’s is to use Microsoft Security Essentials. If you are still running Windows XP, then you'll need to look for Windows Defender, instead; it is still available for computers running earlier versions of Microsoft Windows. For a larger numbers of computers, please consider adding the software for your Microsoft School agreement.

Summary

I am quite aware these are all Microsoft solutions, but I make no apologies. In education, particularly, Microsoft provides a compelling value for software of all kinds. And who better is capable of understanding the real security issue of the Windows operating system than the company that created it.

And in spite of problems that are common to any mega Corporation, Microsoft has a wide variety of software solutions for education that perform as good or better than most other companies (especially in light of the wide variety of solutions they offer),and you can trust a genuine Microsoft product to actually work as specified.

Best of all - the programs mentioned above are free, or very close to it, and work quite happily together; or in larger quantities can be bundled with your School agreement at a fraction of the cost of buying antivirus software commercially.

One final note. You can dramatically improve desktop and laptop security by keeping your operating system up to date. Optimally, that would include a Windows 7 upgrade. As a minimum, be sure your installed operating system has all of the latest security patches. All versions on Windows have an update facility built right into the main menu.

Stay safe out there!