UAB IT Provides Critical Guidance to Campus on Appropriate Versions of Internet Explorer, Mac OS, and Java to Mitigate Risks of Exploitation; updates Java recommendation to 1.7.0_55

A significant security vulnerability was discovered in the Internet Explorer web browser over the weekend of April 26th and is being shared in mass media.  This vulnerability could allow an attacker to compromise a Windows based computer should the end-user visit a website with appropriate content.

On May 1st, Microsoft released a fix to the IE vulnerability. Users should install this fix immediately.  UAB IT will begin pushing this update Thursday afternoon May 1st.  If IE is open, you will be required to perform a system reboot in order for the fix to take effect. If IE is closed, no reboot should be necessary.  Once the fix has been applied to your system (and IE is open) you will have 24 hours to perform a reboot or your system will automatically reboot.  

UAB IT continues to recommend that end-users use a two web browser methodology to limit the risks to the campus.

1.       Use an up-to-date version of Internet Explorer for conducting UAB business on university supported web sites.

2.       Use a second web browser (such as Mozilla Firefox or Google Chrome) with the Java plug-in disabled for any general web surfing and accessing off-campus resources.

Windows Systems:

• On Windows 7 Install IE 10 and Java 1.7.0_55

UAB IT has updated the minimum recommendations for versions of Internet Explorer and Java as UAB systems have improved functionality to support newer browsers and the currently secure version of Java. Internet Explorer 10 and Java 1.7.0_55 are recommended for installation on Windows 7/8. UAB IT also recommends using a separate browser with JAVA disabled for Internet use.  Use IE for on campus with Java enabled and your choice of Firefox or Chrome for Internet browsing with JAVA disabled (for information on disabling Java click here).

Mac Systems:

• Install OSX 10.9 and Java 1.7.0_55

UAB IT has updated the minimum recommendations for versions of Mac Operating systems and Java as UAB systems have improved functionality that are compatible with the current version of Java. The recommended operating systems for use on Campus are Apple OSX 10.7x and 10.8x. While Apple OSX 10.6x is still supported by Apple, vendors are no longer testing against it for compatibility. Apple operating systems will not run any version lower than Java 1.7.0_51.

UAB IT also recommends using two different browsers — one for surfing the Web and one just for accessing UAB systems. For Internet Web browsing, use one of the following: Firefox Safari, or Chrome, with Java disabled (for information on disabling Java click here). For working with just UAB systems, choose a different browser and enable Java to work in it. If you run into compatibility issues with the local browser and UAB IT systems, use the IT terminal servers to access UAB resources via RDP client (for information on using IT terminal servers on Mac click here).

For more information, contact AskIT (www.uab.edu/askit).

UAB IT has announced a new enterprise licensing agreement with Adobe that covers Adobe Creative Cloud and Acrobat Pro effective June 2014.  This agreement makes the Creative Cloud products available to University faculty and staff which had not been included in previous UAB agreements with Adobe.  Creative Cloud includes products such as Photoshop, Illustrator, InDesign, Acrobat, Dreamweaver, and others.  Separate subscriptions for just Acrobat Pro will also be available. Ordering will be through AskIT going forward, not CDWG as in the past.  The agreement also includes improved home-use rights for faculty/staff.  Students will continue to be able to purchase Adobe products under the Student Agreement UAB already has in place.  For more information on pricing and ordering see the Adobe page here.
UAB IT announced Friday that Windows XP systems (that do not have an approved exeception in place) will have all internet access suspended.  The UAB IT Oversight Committee approved this plan in late April.  See detail about the announcement below and effective dates.


May 2, 2014

Office of the Chief Information Security Officer

Subject:

Suspension of Internet Access for XP Computers/System

To:

All UAB Faculty and Management

What is Happening:

Effective April 8th, Microsoft stopped support for the Windows XP operating system and associated software.  Non-support represents a significant vulnerability to UAB and, as a result, the IT Oversight Committee has directed that action be taken to mitigate this vulnerability.



Actions:

Mitigation actions include the following steps:

1.    XP system owners will be notified via an email that their Internet access will be suspended. Notices will start being sent on Monday May 5th.

2.    7 calendar days after notification, Internet access will be suspended via our IPS/IDS system.

3.    After May 31st, all XP systems will be disconnected from the UAB campus network.

4.    If an XP system requires campus network and Internet access, an Exception Request must be submitted to the Information Security Office, be adjudicated by the Enterprise Information Security Council, and the system access restored if approved.



Contact: For questions call the Enterprise Information Security staff at (205) 975-0842 or email datasecurity@uab.edu
Physician Tax Fraud Scheme

Alabama has now been added to a growing list of states with a doctor targeted tax fraud outbreak.  Hundreds of physicians in Arizona, Connecticut, Indiana, South Dakota, New Hampshire, Michigan, North Carolina, Vermont and Alabama have been impacted.

A bulletin from the North Carolina Medical Society recently said, “The majority of those affected first become aware of it when they receive an IRS 5071C letter advising them of possible fraud. Others are receiving a rejection notification when attempting to electronically file their tax return. It indicates it cannot be submitted because a return has already been filed under that Social Security number.”

Earlier week, the UAB IT Information Security Team received information that a half-dozen physicians associated with a local medical group affiliated with the Children’s Hospital of Alabama have also been victimized as a result of this scheme.  We have unconfirmed reports that several UAB physicians may also be impacted.

We are in contact with the local FBI field agent regarding this matter and are asking if you or a physician you know has been affected by this, please contact the UAB Chief Information Security Officer at (205) 975-3117 or by email to jwp3@uab.edu for additional information.
The OpenSSL/Heartbleed vulnerability has been recently spotlighted in the news media since being announced on April 7, 2014.  UAB IT has reviewed all centrally supported systems for this vulnerability and, working with our vendors, have installed patches on all supported systems to mitigate this vulnerability.  We have used results from our daily Nessus campus network scans to identify system which are/were vulnerable and mitigated those systems which are centrally supported.  Additional mitigation steps were taken where needed to protect sensitive credentials and data from compromise.

We believe that the possibility of a data breach or compromise is very low at this time however we recommend that all users take additional steps from an abundance of caution perspective.  Those steps include 1) if you have access as an administrator to a system change your password(s) after you have verified that the vendor supporting your system has patched it appropriately, 2) increase your effort to mitigate those vulnerable systems identified on the weekly Nessus vulnerability report available at https://silo.dpo.uab.edu/vulnreport (if you need assistance please call Information Security at 205-975-0482), 3) please ensure that all systems that use SSL encryption services are fully patched, then restart the service on that system, 4) replace all SSL certificates on those systems with one provide free of charge from UAB IT from www.uab.edu/uabcrt (certificates from UAB are vetted, patched and kept up to date), 5) change all privileged account passwords immediately after vendor patches have been applied, and 6) be aware that many network devices and printers have embedded SSL based encrypted web based access portals which should be updated with vendor patches to mitigate this vulnerability.

We also recommend that all users with privileged access change their BlazerID passwords immediately as a precaution to mitigate any possible exfiltration of sensitive data by the OpenSSL vulnerability.  And we also recommend that users change their personal passwords which they may use to access personal non-UAB web sites such as on-line banking and others to assist in reducing the possibility of becoming a cybercrime victim.


If you need additional assistance, please call AskIT at (205) 996-5555.
After 10 years as a student and 25 years working at UAB, Doug Rigney, Ph.D., interim vice president of Information Technology, has announced his retirement, effective May 31.  See the full article on Dr. Rigney here.

GraphPad Prism Software Subscriptions 

UAB now has an agreement in place with GraphPat for their Prism software at a discounted price to what is available to individual users and schools direclty from GraphPad.  

GraphPad Prism is a commercial scientific 2D graphing and statistics software published by GraphPad Software, Inc.. Prism is available for both Windows and Macintosh computers. 

  • Provides statistical guidance for novices.
  • Analysis checklists review if an appropriate analysis was performed.
  • Nonlinear regression with many options (remove outliers, compare models, compare curves, interpolate standard curves, etc.).
  • Live links. When data are edited or replaced, Prism automatically updates the results and graphs.
  • Analysis choices can be reviewed, and changed, at any time.
  • Automatic error bars. Raw data (replicates) can be entered, and then plotted as mean with SD, SEM or confidence interval.

For more information about the GraphPad Prism subscriptions available under UAB's Agreement click here.

Beginning April 30 UAB will be upgrading students to Microsoft Office 365, a new cloud-based platform for e-mail, file storage, and Microsoft Office applications (Word, PowerPoint, Excel). This new service provides students with the following benefits:

  • 50 GB of e-mail space, an increase of 49 GB from the current service
  • 25 GB of free file storage, an increase of 24 GB from the current service
  • Access to Microsoft Office applications from laptops, tablets, and other mobile devices
  • A single web interface to access all of the above features

Students who prefer to work offline will be able to download the Office applications and continue using their preferred e-mail clients.

We expect all students to be transitioned to the Office 365 service by June 30, 2014. For more information and how the transition will occur please visit our Office 365 for Students info page.
UAB IT is aware of an issue with Optidoc and systems that have been upgraded to Java 1.7.51.  When opening Optidoc users may be prompted with an alert (see examples below).  The work around for these alerts is to click 'Run' until such time as the vendor resolves the issue.  You can also check the "Always trust content from this publisher" to prevent the alert from appearing each time you start Optidoc. While this resolution is not optimal, it is the only solution available at this time.

If you have any questions please contact AskIT.


OptidocOptidoc
tech talkUAB IT is introducing a new quarterly series, “Tech Talk,”   beginning this month.  On March 19th,  Dell Field Marketing Senior Advisor, Andrew Vanderploeg will kick off our series.  The focus will be a review of end-user computing, as well as the current state of Dell and where they are headed in the future.  Please plan to attend, and feel free to pass the invitation along to others on campus that you feel may want to attend.  March 19, 2pm-4pm CEC 140.