Issue

You are contacted by IT with regards to securing your computer due to an OIT (Office of Information Technology) report with regards to vulnerability.

Cause

Majority of the systems on campus are on a Public Addressable IP.  This means the computer is available to be directly accessed based on what software that may be running on the computer.

The Campus Network will block some Network Ports, however, the Campus Network is configured to allow reasonable access for most computer network activity and relies on users of the network to secure their computer.

Resolution

Here is a list of what you can do to secure your computer (or device) for the Campus Network...

Use Strong Passwords

Any user account that is on the machine that is used to access the machine should use strong passwords, as define here What is a 'strong' password?

No outside (Non-university) users access

Computers on campus are strictly for use of University purposes only.

While you maybe collaborating with off-campus people, computers on campus is strictly for University users and should only be accessed with supervision by on campus users.

It is highly recommended that each user have their own account and said accounts be deleted when users no longer need access or leave UCSB. It is also highly recommend that users not be given administrative privileges if they do not actively need to install software.

Use a Firewall

Most computers will have firewall capability.

If there are services on the computer that you need to access remotely (i.e. Access the computer from home), it may be wisest to have the computer's firewall configured to block the service you need to a very specific IP Range.

Given the various kinds of Operating Systems and Firewall Software that is available, we will not be able to go into detail on how to set it up, but we can recommend the IP range you will want to define to secure the system a bit better.

For computers on the wired Campus Network or VPN only (most secure):

• 128.111.0.0/16 (128.111.0.0-128.111.254.254)

For computers on the Campus Wireless (Wireless web/UCSB Secure/Eduroam)

For computers using the UCSB wireless, Facilities, ResNet and other internal non-wired non-VPN UCSB ranges (largest range, hence least secure):

• 169.231.0.0/16 (169.231.0.0-169.231.254.254)

We recommend that devices use the Campus VPN service, even if they are on the Campus Wireless Network. This allows you to drop all ranges except for 128.111.0.0/16.

The smaller the allowed in range, the less chances of allowing in people you don't want.

We encourage people not to use 169.231.0.0/16 as a generic rule to cover all UCSB non wired networks, unfortunately some devices only allow a limited number of rules for their firewall. 

If you have a Linux or Ubuntu based system, you may want to consider installing fail2ban to allow your firewall to adaptively block bad actors from using multiple login attempts via script to try to guess your password.

Install the campus provided free Trellix/FireEye antivirus to make sure your system has some level of protection.

Download links and install instructions for Mac, Windows and Linux are posted at: https://it.ucsb.edu/it-security-it-professionals/unified-security-posture-management under the EDR tab. 

Disable or uninstall the service reported to you

If you aren't really using the service or application that is being reported to you, perhaps it is best to remove/uninstall the service.

Services such as:

• Bonjour

• Avahi (Linux version of Bonjour)

• Printer Sharing

• File Sharing

• Remote Desktop

If you are planning on Using Printer/File Sharing or even Remote Desktop, please configure the firewall to restrict the access to the Campus Network and use the Campus VPN if you need to access the computer from off campus.

Keep your software and operating system updated

Always make sure your operating system is still getting security updates. Windows users should upgrade to Windows 11 or newer and Mac users should upgrade to Sequoia or newer. Similarly, using the latest version of your operating system greatly reduces the number of security issues even for Unix/Linux/Ubuntu/ChromeOS/etc… operating systems.

Once on a supported operating system, be sure to apply updates. For example, if you update Windows 10 to 11, but are still on the version that came out 2 years ago, you still have security vulnerabilities that can easily be solved by updating.

Always make sure your software is up to date. Updates are not just for your operating system, but for each application and program as well.

If it is a service or application you use, there is a chance that it has been updated to deal with the vulnerability.

If it is older software or hardware and has no update, or something you cannot get an update for it...  You may have to consider either replacing it or make arrangements with your IT Staff on possible alternatives or means to isolate the computer/device for network security.

For more information

Please refer to UC Santa Barbara IT Website

• IT Security for Students

• IT Security for Faculty and Staff

Related articles