Below you will find some selected ITS articles originally published in the Inside Story. The article may have been edited to maintain its accuracy and relevance.
Best Practices for Desktop Computer Workstation Protection
MCC's computers are configured and used as securely as possible. However, the integrity of the computer system, including the operating system, software applications and data files, depend on your help to maintain the security of your computer.
Unauthorized access to your computer could compromise your software and hardware. Information stored on your computer may be sensitive, confidential or proprietary, and it needs to be made available to staff who are authorized to access it.
Access to information on your computer by unauthorized personnel may leave the College vulnerable to liability issues if you cannot demonstrate that you used generally accepted methods to protect that information.
Various federal regulations require the College to protect information regarding students. Most employees are familiar with FERPA (Family Educational Rights and Privacy Act) laws that guide use of such information. If you are not familiar with the FERPA regulations, contact your supervisor.
Here are some guidelines to maximize the security of your computer:
- If your computer is not shared, it should have a screensaver activated that is password protected. The interval for activation should be no more than 10 minutes. This will lessen the possibility of someone accessing your computer when you are away from your desk. Right-click on a blank area of the desktop (do not right click on an icon), choose Properties, and then choose Screen Saver to get to the Screen Saver Settings and enable "On resume, password protect." When you return to your computer, you will need to hit "Control, Alt, Delete" and enter your network password to resume work. If the computer is a shared computer, you should logout before leaving it for any time.
- Do not allow file sharing, or "shares" on your computer. MCC has secure servers for file storage. Shares are a common access point for unauthorized access.
- Do not allow anonymous access to your workstation. This includes FTP, dial-up, PC Anywhere, etc. If you have data to share with others, ITS can arrange to have it available from one of our secure servers.
- Every MCC user that runs Windows 2000 or XP automatically connects to a U: drive when logging on to their computer. You should store all important data here. These files are backed up nightly and can be restored if accidentally deleted or corrupted.
- MCC automatically updates your operating system software using Software Update Services from Microsoft. This service ensures that your operating system is up-to-date with service packs, hot fixes and critical updates.
- Please leave your computers on at night. Before you leave, you should restart your computer (Start, Shutdown, Restart) and turn off your monitor. Do not log back into the network. Restarting your computer once a day allows the computer system resources to be refreshed. Leaving your computer on at night allows for automatic updates to be applied to your computer without jeopardizing the security of your system. When you return the next day, your computer will be ready for your use; you can log into the network and continue with your work.
- MCC has a 120 day policy to change login passwords. Never post your password where people can see it, and never tell anyone what it is. If you forget your password, the Help Desk can reset it for you. They do not have access to see your password at any time. If you believe your network account has been compromised, we encourage you to reset your password as a safety measure.
- Remove any unauthorized software from your computer. It is very common for some applications, especially those downloaded from the Internet, to include hidden programs designed to "spy" on your computer, gathering information about you, your computer and the network.
- Never open a file if you do not know what it is, what it does or do not know who sent you the file. Always question the source. This is especially true for files you receive as e-mail attachments or files you download from the Internet.
- Secure your computer workstation by locking all offices that are publicly accessible when they are not occupied.
- It is equally important that MCC's computers in the technology classrooms are configured and used as securely as possible because they have multiple users. The technology room computers need to be left on during the day and night. When you have finished using a technology room computer do not leave yourself logged into the computer, but restart the computer. To "restart" the computer, left click on the "start button" in the lower left hand corner and left click on "Shutdown". In the dialog box will be "Restart" (as the default). Please left click on "ok".
Security of the desktop computer is the user's responsibility. Your daily work usually requires that protected information resources be accessed, maintained and transmitted via MCC's network. Please understand how important your role is in keeping the information technology you use as secure as possible.
Please review MCC's Acceptable Use Procedures Memorandum (http://www.mccneb.edu/procedures/X-15_Technology_Resources_Use.pdf) for more information.
back to top
Don't Get HOOKED BY E-MAIL Phishing SCHEMES
Although the College has had significant success at blocking email spam, some does get through. One email exploit that has been around for a few years is called phishing. Just like fishing, someone dangles some email bait and hopes to get a bite. In phishing, you may get an email asking to go to a web site that looks official, asking you to update personal and/or financial information. This web site can be a front for illegal activities. Once your information is uploaded, they can withdraw money from your bank account or even steal your identity. Some things you can do to protect yourself include the following:
1. Never click on a web link in an email message unless you are absolutely sure of the sender and where the link is taking you.
2. Banks will never send you an email requesting you to update your financial information. They already have that information on file.
3. If a message looks like it is from your financial institution asking for information, call the bank and verify. Banks have fraud departments that investigate this type of activity.
4. Do not forward these types of messages to family, friends or co-workers.
5. Never give out your social security number.
6. Report any suspicious emails to the College's IT Department; they may be able to block further attempts by the sender.
As always, be vigilant against this type of fraud. If you have any questions about this, please contact the Help Desk at 402-457-2900.
back to top
E-mail spoofing is the forgery of an e-mail header so that the message appears to have originated from someone or somewhere other than the actual source. Distributors of spam often use spoofing in an attempt to get recipients to open, and possibly even respond to, their solicitations. E-mail spoofing is possible because Simple Mail Transfer Protocol (SMTP), the main protocol used in sending e-mail, does not include an authentication mechanism. To send spoofed e-mail, senders insert commands in headers that will alter message information. It is possible to send a message that appears to be from anyone, anywhere, saying whatever the sender wants it to say. Thus, someone could send spoofed e-mail that appears to be from you with a message that you didn't write.
Although most spoofed e-mail falls into the "nuisance" category and requires little action other than deletion, the more malicious varieties can cause serious problems and security risks. For example, spoofed e-mail may purport to be from someone in a position of authority, asking for sensitive data, such as passwords, credit card numbers, or other personal information--any of which can be used for a variety of criminal purposes. The Bank of America, eBay, and Wells Fargo are among the companies recently spoofed in mass spam mailings. One type of e-mail spoofing, self-sending spam, involves messages that appear to be both to and from the recipient.
Please be assured that MCC E-Mail Administrators are fully aware of the possible security risks. In fact, before an e-mail is ever delivered to your account, it is scanned by anti-virus and anti-SPAM software at the College gateway servers and then again at the College inbound e-mail servers. Tens of thousands of e-mail messages are blocked from getting into the College every day. Unfortunately, in order to block e-mail such as undeliverable ones, we would have to block all "undeliverable messages" which is neither practical nor desirable. Additionally, because the spammer's techniques include randomly assigning this "from" information in the messages, it is impossible to determine where it will originate from next and block it.
You can choose to respond to receiving one of these messages in one of two different ways. The first and simplest would be to delete the message and forget about it. The second would be to move the message you received to a folder in Outlook called AbuseMail. It is located in Public Folders--All Public Folders. You will not be able to open this folder, however, you can either drag and drop the message there or you can right-click on the message and select "Move to Folder" and then browse to the AbuseMail folder, select it, then click on the OK button.
back to top
Online Form "Request to Install Instructional Software" Changed
On April 14, 2006, the online form Request to Install Instructional Software found in the FormsBank will be changed to Request to Install Non-Standard Software.
Non-standard software is defined as any software not identified as standard-load software and routinely installed on all College-owned computers. For a current list of the standard-load software, please visit
If you want non-standard software installed on a College-owned computer, you must fill out and submit the new form. Please allow up to five weeks from the time your request is submitted to the time the software can be installed. This lead time is necessary to obtain the licensing and media, ensure the software is compatible with our existing standard-load, and accomplish the installation.
This change will help ensure the College remains in compliance with all software licensing agreements and minimize any liability.
back to top
Only U Can Prevent File Loss
Did you know that all employees with a network login have a personal folder (shared area) created for them on the network?
U didn't? Well, let me fill U in.
When an employee logs in to the network, they're automatically given a personal folder. The drive letter assigned to this folder on the network is U.
The U drive is a safe location to save your documents, because the network is backed up every night. Full-time staff and faculty can store up to 100 megabytes of information on the U drive. Part-time faculty can store up to 50 megabytes of information. If you reach capacity on your U drive, you can send an e-mail to the Help Desk to request a space increase. In your request, please provide a brief explanation of why you need a larger U drive.
If you save files to My Documents on your hard drive (C drive), they are not backed up. If the hard drive crashes, you could lose everything that is in My Documents. However, anything you save to the U drive on the network will be safe since these documents aren't tied to one workstation. This drive can be accessed from any computer in the college, as long as you login as yourself to MCCNET. Also, the files are secure, because the U drive is directly tied to your username and password. No one else can read these files, unless you give out your password.
How can you verify that you have a U drive? Double-click My Computer on your Windows desktop. Do you see an icon with: your username on mccdata1\users(U:) or your username on mccdata1\PTFac(U:)? If yes, you can start saving documents to this location. If no, please call the Help Desk at Ext. 2900 for assistance.
back to top
Restart Your PC When Leaving for the Day
For the past year, the ITS department has asked users to log off their computers when they leave for the day. Due to significant software changes and additional activity occurring during log in, ITS asks that you RESTART your computer when you leave for the day. We believe this change will improve performance on the computer and reduce downtime for the user.
To restart your computer:
- Click on the Start button
- Click on Shutdown from the menu
- Select Restart from the drop-down box
- Click Ok
Once the restart has initiated, you may turn off your monitor. When you return in the morning, you should be greeted with the standard login screen.
back to top
Software Helps Minimize SPAM
For over the past year, the Information Technology Services (ITS) department has been running Sybari SPAM Manager software on the College's e-mail system. The SPAM Manager software blocks unsolicited e-mail messages being sent to us from outside the College. During a recent 7-day period, over 100,000 messages out of approximately 150,000 inbound e-mails were blocked by this software.
The ITS department tries to stop as much SPAM as possible using a variety of SPAM filtering methods as well as the SPAM Manager software. Keep in mind, despite our best efforts, SPAM will continue to find its way into your mailbox.
With that said, here are some things you can do if you find SPAM in your mailbox.
- Simply delete the SPAM. Never reply to the sender,
- Have future messages from this sender placed in your 'Junk E-mail' folder
- Right-click on the message
- Point to the 'Junk E-mail' option
- Click on 'Add Sender to Blocked Senders List'
You can manage your Junk E-mail options from the 'Tools|Options|Preferences' menu in Outlook.
Note: If the following dialog box appears, just place a checkmark in front of the option 'Please do not show me this dialog again' and click 'OK'
- For Outlook users only (not Outlook Web Access users), you can move or drag the SPAM into Public Folders\All Public Folders\AbuseMail folder.
- Right-click on the message
- Point to 'Move to Folder…'
- Select the 'AbuseMail' folder and click 'OK'
ITS monitors the AbuseMail Public Folder to determine if there are commonalities between messages that can be programmed into the Sybari Anti-spam filter.
Last but not least. If you have expected, but have not received an e-mail message (you know is not SPAM) that was sent within the past 7 days, please call the Help Desk at 457-2900. The ITS department will check to see if the e-mail message was blocked by the SPAM Manager software and move it to your Inbox.
back to top
Software Purchase Guidelines Established
The Software Review Committee has been reviewing all proposed software purchases since mid-August 2003. This process was developed in a continuing effort to be cost effective, support institutional effectiveness and provide software users with a solid support system.
Prior to August 2003, there was no formal process to review proposed software purchases. This meant that sometimes software was ordered one or two copies at a time, when we could have made a bulk purchase of that software and saved money. Software purchased prior to August 2003 was not always checked to see if it required more memory than the staff member's computer had. Nor was it always evaluated to make sure that it did not negatively affect the network.
The College has seen monetary savings already, because the Committee has been able to inform requesters of some existing software contracts. The College also has become eligible for some software contracts because we were able to pull in several departments. The Adobe contract saves about 90 percent off list prices for its products. As an example of the cost saving, Adobe Creative Suite's list price is $1,229 while the contract price is $170. This substantiates the importance of the Software Review Committee's mission.
Since its inception, the process for ordering software has evolved. The current procedure is defined below:
Staff member, after receiving approval from cost center manager, requests software purchase by completing and submitting the online "Request to Purchase Software Form" this form can be found in the Forms Bank.
The request will be sent to the Software Review Committee for analysis.
If the software request is non-supported/non-approved, the requestor and cost center manager will be notified by e-mail.
If the software request is approved by the Software Review Committee, the requestor and cost center manager will be notified by e-mail. The e-mail will specify the next steps necessary to purchase the software.
It can take from three to five weeks from the time an employee submits a purchase request to the time the software is installed.
Please review and follow the above process when you need to purchase software. If you have any questions, please e-mail Help Desk or call 402-457-2900.
back to top