People have a lot of pre-conceived notions about security teams and
practices. While some misconceptions may be grounded in truth and others
fairly outlandish, there is a lot going on behind the scenes that users
may not see. From claims that we are all hackers wearing hoodies and
doing nefarious deeds to the perception that we are here to get in your
way, we will help you understand what is true, what is not, and why
these perceptions might exist.
Myth #1: Security is just here to say no
Being at a university presents the unique challenge of providing the
tools and technology necessary for students and faculty to research,
learn, and achieve their goals. We must strike a difficult balance
between the availability of those resources and the security of the
university and our community. As security professionals, we do
everything we can to enable safe and reliable access to the tools that
the GW community needs to reach their goals. We are here to facilitate a
safe IT environment in which all students, faculty, and staff can
access the resources that they need, sometimes it sounds like, “no”, but
what we are really requesting is modifications that reduce risk of
exposure or breaches at GW.
Myth #2: Security only deals with technology
Many people believe that IT security only works on securing servers,
reading logs, and other highly technical tasks. On the contrary, the
security team has a wide range of responsibilities of which technology
is only a part. The security team is continuously engaging with people
and data in a multitude of ways. Often trying to help people protect
themselves and the organization through a security awareness program or
working directly with other teams to enhance security within their
operations. They are constantly trying to improve way to protect the GW
community’s data by updating policies, implementing best practices, and
assessing security processes.
Myth #3: The security team is just a bunch of hackers
Just as many people think that the security team is nothing but
hackers. This is far from the truth. Information security is a wide
field with many specializations and it takes all sorts to be effective.
While some members of the team might be highly technical penetration
testers, their counterparts are security professionals focused on
defensive security and protecting the GW network and assets from outside
threats. Not to mention that members of the IT Security team range from
awareness professionals working with people and outreach to analysts
focused on identifying and reducing risk.
Myth #4: The security team takes care of security so I don’t have to
The security team works tirelessly to ensure that the GW community,
information, and assets are as well protected as possible, but the team
is not always the first line of defense. Security is your responsibility
too. Our community is often the first line of defense when it comes to
attacks from outside GW. Social engineering (aka tricking people and
deceiving them) is a common tactic employed by attackers and encompasses
phishing, piggy backing, and taking advantage of users in the
workplace. All of this means that you, the user, needs to play a vital
role in protecting the university, or, as we call it #SecuringGW.
Protecting your own information is an essential puzzle piece to overall
security of GW. Catching phishing emails and forwarding them to abuse
at GW may seem like a small task, but it is small actions like this that
alert the team and protect GW from large breaches. Being aware of
people trying to enter buildings where they don’t belong, and
maintaining a clean desk free of sensitive materials are all security
measures that you can take to do your part in #SecuringGW.
Fact: GW Information Security – Your Trusted Advisor
The information security team strives to facilitate access to the
resources that the GW Community needs in as secure a manner as possible.
Security affects everyone; data loss, lack of availability, and
compromised systems impede day to day business functions, which means it
affects the day to day lives of everyone on campus. In order to help
prevent this, the security team acts as a Trusted Advisor to everyone in
the GW Community. Whether you want to implement a new system, service,
or application, or begin a new project, involving the GW security team
as Trusted Advisors from the start enables us to aid in proper project
oversight and completion while maintaining and promoting the
confidentiality, integrity, and availability of GW’s data, systems, and
services.
