Security Advisory Information

Advisory Distribution Strategy

Security advisories are alerts issued by computer incident response teams, vendors, and others concerning newly discovered threats to computer security and how to protect against them.

One reason that we acquired the Internet Security Scanner is that it can automatically determine whether known security problems have been corrected. Thus, the need for widespread distribution of certain security advisories is reduced.

The frequency of advisories has increased dramatically in recent months, often resulting in several being received per day. At the same time, many of the advisories are of interest only to a relatively small number of people (for example, system administrators of a particular vendor's equipment that are running specific optional software). Furthermore, advisories that do apply to a wide range of people tend to be lost in the noise.

As a result of these considerations and the availability of the security scanning tool, OIT is now much more selective in choosing the advisories we redistribute to the CSR and SNAG mailing lists (see below). We try to sound the alarm only when a large number of users is at risk, or when there is a serious threat to security of our network as a whole. We also try to insure that the information has been validated by a known authority on the subject.

Nonetheless, system administrators (and owners) remain the responsible party for the security of the systems in their care. We suggest the following:

• Visit vendor security web sites. A list of some of these is at: our vendor security site.

• Subscribe to general and/or vendor security mailing lists. A list of some of these is at: http://www.iss.net/security_center/maillists/.

---

GT/IRSC ALERTS

New advisories that affect a large number of users and/or describe a serious threat to the Georgia Tech network as a whole are distributed by OIT to the following email mailing lists. Please subscribe to one of these lists to receive the latest security information.

• Computing Support Representatives (CSR) mailing list

  To subscribe, send email to listproc@list.gatech.edu with

  sub csr Firstname Lastname
  

  in the body of the message (no subject).

• System and Network Administrator's Group (SNAG) mailing list

  To subscribe, send email to majordomo@housing1.stucen.gatech.edu with

  subscribe snag
  

  in the body of the message (no subject necessary).

GT/IRSC ALERT Format

We have adopted a standard format for our alerts that we hope will help you easily recognize them and quickly determine if they apply to you.

• "GT/IRSC ALERT" is the first thing in the email subject line
• Priority field is normally set to "High" or "Highest"
• Standard sections, which are separated by "tilde-lines"
• Standard header section, showing alert number, date, and subject
• Three standard body sections (AFFECTED, ACTION REQUIRED, and DETAILS)
• Standard closing reminder section referencing our security web site
• Overall, brevity is paramount; hyperlinks are used for technical details

---

Advisory Archives

Previous advisories usually result in corrective system patches so, if your system patches are up to date, you generally do not need to review them. (But see important advisories regarding UNIX systems.) In any event, previous advisories are are available from several sources:

• CERT: Computer Emergency Response Team
• CIAC: U.S. Department of Energy Computer Incident Advisory Capability