Locking down PCs - Revision history

Meredith: Reverted edits by SunshineMcFadden (talk) to last revision by Librarycomputerguy

2011-07-18T19:50:00Z

Reverted edits by SunshineMcFadden (talk) to last revision by Librarycomputerguy

SunshineMcFadden: /* Malware */

2011-07-17T14:27:56Z

‎Malware

Librarycomputerguy at 18:27, 22 October 2007

2007-10-22T18:27:48Z

Librarycomputerguy at 18:13, 22 October 2007

2007-10-22T18:13:58Z

Librarycomputerguy at 00:14, 22 October 2007

2007-10-22T00:14:06Z

Librarycomputerguy: /* All Operating Systems */

2007-10-21T23:18:14Z

‎All Operating Systems

Librarycomputerguy: /* Patron Privacy Protection */

2007-10-21T23:10:36Z

‎Patron Privacy Protection

Librarycomputerguy: /* All Operating Systems */

2007-10-21T23:08:42Z

‎All Operating Systems

Librarycomputerguy at 22:23, 21 October 2007

2007-10-21T22:23:36Z

Librarycomputerguy at 19:43, 21 October 2007

2007-10-21T19:43:38Z

@@ Line 26: / Line 26: @@
 *[http://www.safer-networking.org/ SpyBot Search & Destroy] (freeware)
 *[http://www.javacoolsoftware.com/sbdownload.html Spyware Blaster] (freeware)
 ==Third Party Solutions==
 Many Commercial products exist to protect PACs by locking down the harddrive.  These software solutions bring the system to a restored state after reboot.  This is also helpful to protect the privacy of users because it clears out any personal information stored during their session.

@@ Line 26: / Line 26: @@
 *[http://www.safer-networking.org/ SpyBot Search & Destroy] (freeware)
 *[http://www.javacoolsoftware.com/sbdownload.html Spyware Blaster] (freeware)
 ==Third Party Solutions==
 Many Commercial products exist to protect PACs by locking down the harddrive.  These software solutions bring the system to a restored state after reboot.  This is also helpful to protect the privacy of users because it clears out any personal information stored during their session.

@@ Line 14: / Line 14: @@
 ==BIOS==
 Another consideration is the [http://en.wikipedia.org/wiki/BIOS Basic Input/ Output Settings (BIOS)] which boots the computer.  The BIOS settings should be password protected and the boot order should start with the internal hard drive and if possible any other boot option should be removed.  This is to prevent someone from booting from a CD, Floppy, or USB drive which could allow them to steal passwords, alter the computer settings or gain access to the network resources.
 ==OS Patches==
 All [http://en.wikipedia.org/wiki/Operating_system operating systems (OS)] require frequent system updates to patch security holes discovered in the OS. For example, in Windows, running Windows update will insure that the system has the latest updates. Virtually all OSs have some type of automatic update for critical patches, but it wise to periodically run these services manually to insure that all software is patched.  Libraries should be aware that Microsoft no longer supports versions of Windows before Windows 2000.  This means that any systems running Windows 98, Windows ME or Windows NT are at risk to be compromised because Microsoft no longer provides patches for them.

@@ Line 2: / Line 2: @@
 Legal protection, patron privacy protection, and computer security are key concerns for libraries that provide public access computers (PACs).  Providing access to computers and the Internet are now seen as an integral role for libraries, and along with that expanded role come a host of new threats and concerns.  Providing this technology and protecting from the increasing level of threats is a constant battle.
 =Filtering=
-[http://www.webjunction.org/do/DisplayContent?id=12027 Filtering] is a contentious issue and is required for E-rate by [http://www.fcc.gov/cgb/consumerfacts/cipa.html CIPA]. This requires filters to be installed on all Internet filters can limit end user's exposure to undesirable content, but may also restrict their access to legitimate content. There are numerous commercial and opensource web-filtering programs available.
+[http://www.webjunction.org/do/DisplayContent?id=12027 Filtering] is a contentious issue and is required for E-rate by [http://www.fcc.gov/cgb/consumerfacts/cipa.html CIPA]. This requires filters to be installed on all PACs with Internet access with the ability to remove the filter for any patron over the age of 18. Filters can limit end user's exposure to undesirable content, but may also restrict their access to legitimate content. There are numerous commercial and opensource web-filtering programs available.
 =Computer Use Policy=
-The use of policy has been an important tool for libraries and by extension apply to this new library tool.  Most PC Management solutions include a click-through [http://www.webjunction.org/do/Navigation?category=394 Acceptable Use Policy] to ensures that all Patrons agree to the library's terms of use.  Library computer use policies should outline acceptable and unacceptable uses of both the equipment and the Internet access.  The policy should also outline how the policy is enforced and a include a disclaimer.
+The use of policies has been an important tool for libraries and apply to PACs as well.  Library computer use policies should outline acceptable and unacceptable uses of both the equipment and the Internet access.  The policy should also outline how the policy is enforced and include a disclaimer that the patron is using the computer and the Internet at their own risk.  It is impossible to guarantee that patrons will be absolutely safe in using these PACs.  Most PC Management solutions include a click-through [http://www.webjunction.org/do/Navigation?category=394 Acceptable Use Policy] to ensures that all Patrons agree to the library's terms of use.
 =Patron Privacy Protection=
-It is important that public PCs contain security features designed to detect when users have left the station but forgotten to log out and ensure that all their personal files and information are automatically cleared from the station to protect the user's privacy.  Libraries also need to control the time that patrons have access to computers to insure that all users get a fair chance to access these services. Some libraries may still used manual methods to do this, but many automated systems exist.  For example, pc management system like Envisionware's PCres (for windows systems) make this possible.  Free and OSS options are available for both [http://userful.com/products/pre-book GNU/Linux] and [http://userful.com/products/pre-book-win-client Windows].
+It is important that PACs contain security features designed to detect when users have left the station but forgotten to log out and ensure that all their personal files and information are automatically cleared from the station to protect the user's privacy.  Libraries also need to control the time that patrons have access to computers to insure that all users get a fair chance to access these services. Some libraries may still use manual methods to do this, but many automated systems exist.  For example, [http://www.envisionware.com/en/pc_reservation Envisionware's PCres] (for windows systems) make this possible.  Free and OSS options are available for both OSs:
+*[http://userful.com/products/pre-book GNU/Linux]
 =Securing PACs=
-==All Operating Systems==
+==Key Loggers==
-All operating systems require frequent system updates to patch security holes discovered in the OS. Many Commercial products exist to protect PACs by locking down the harddrive.  These software solutions bring the system to a restored state after reboot.  This is also helpful to protect the privacy of users because it clears out any personal information stored during their session.
+Computers should be physically secured for use. It is important to visually inspect the computers at regular intervals to make sure no devices have been attached to record keystrokes.  These devices may look like part of the keyboard plug and can record keystrokes for up to 12 months and they are undetectable to scanning software.
 *[http://www.faronics.com/html/deepfreeze.asp Faronics DeepFreeze]
 *[http://www.fortresgrand.com/ Fortres 101 & Cleanslate]
+==Free Tools for Windows==
-==Windows==
+The [http://en.wikipedia.org/wiki/Bill_and_Melinda_Gates_Foundation Bill & Melinda Gates Foundation (B&MGF)] provided a free tools to help secure Windows computers for public use.  [http://www.webjunction.org/do/DisplayContent?id=979 Public Access Computing Security Tool]. This was related to the computers granted to libraries. Though this tool is no longer supported, it still works well on older Windows operating systems like Windows 2000.
-Because it is more ubiquitous and therefore a larger target for crackers more diligence is required in securing a Windows machine for public use.  It is critical to have antivirus software and antispyware software installed on Windows machines.  There are a large number of commercial products available to
+Microsoft has recently released [http://www.microsoft.com/windows/products/winfamily/sharedaccess/default.mspx SteadyState](replacing Microsoft Shared  which is a tool to secure Windows XP and Windows Vista systems for shared use.
-===Windows 2000 or older===
+*Step by step howto for SteadyState
 [http://www.webjunction.org/do/DisplayContent?id=979 Public Access Computing Security Tool]
-===Windows XP and Vista===
-*Step by step howto for [http://www.microsoft.com/windows/products/winfamily/sharedaccess/default.mspx SteadyState.]
-−
 .Un-install old security software (if applicable)
 .Install SteadyState as per instructions.
@@ Line 61: / Line 70: @@
 .Set disk protection to Remove all changes at restart.
-==GNU/Linux==
-===DIY===
-GNU/Linux machine are more secure in their design, and some GNU/Linux distributions will work as they are.
-*[http://www.ubuntu.com/ Ubuntu]
-*[http://www.pclinuxos.com/ PCLinuxOS]
-===Turnkey Solutions===
-*[http://userful.com/products/library Userful DiscoveryStation.]
-*[http://groovix.com/solutions_public_access.html Groovix].
 =Resources=
 *Balas, Janet L. 2004. "Managing Public Access Computers and the People Who Use Them." Computers in Libraries 24, no. 6: 35-37.

@@ Line 1: / Line 1: @@
 =Introduction=
 Legal protection, patron privacy protection, and computer security are key concerns for libraries that provide public access computers (PACs).  Providing access to computers and the Internet are now seen as an integral role for libraries, and along with that expanded role come a host of new threats and concerns.  Providing this technology and protecting from the increasing level of threats is a constant battle.
-=Legal Protection=
+=Filtering=
-==Filtering==
 [http://www.webjunction.org/do/DisplayContent?id=12027 Filtering] is a contentious issue and is required for E-rate by [http://www.fcc.gov/cgb/consumerfacts/cipa.html CIPA]. This requires filters to be installed on all Internet filters can limit end user's exposure to undesirable content, but may also restrict their access to legitimate content. There are numerous commercial and opensource web-filtering programs available.
-==Computer Use Policy==
+=Computer Use Policy=
 The use of policy has been an important tool for libraries and by extension apply to this new library tool.  Most PC Management solutions include a click-through [http://www.webjunction.org/do/Navigation?category=394 Acceptable Use Policy] to ensures that all Patrons agree to the library's terms of use.  Library computer use policies should outline acceptable and unacceptable uses of both the equipment and the Internet access.  The policy should also outline how the policy is enforced and a include a disclaimer.
 =Patron Privacy Protection=

@@ Line 21: / Line 21: @@
 ====Windows 2000 or older====
 [http://www.webjunction.org/do/DisplayContent?id=979 Public Access Computing Security Tool]
-====Windows XP and Vista=====
+====Windows XP and Vista====
 *Step by step howto for [http://www.microsoft.com/windows/products/winfamily/sharedaccess/default.mspx SteadyState.]