CompuMentor needs your help! We developed a
guide for non profits to use to do a security audit of their window desktops
and networks. We need a few mentors to take this into the real world and do an
audit following the steps in the guide and reporting back to us on what, if
anything, was missing. The audit should
be done on a small non profit or business.

This is a shorter project commitment than usual, lasting only a month. Please e-mail mentor@compumentor.org if you're interested in volunteering for this.

Healthy and Secure Computing is a set of best practices and recommended technologies that, when taken together, will help small to medium-sized nonprofits build and maintain a stable and secure IT infrastructure. A healthy and secure computing environment will allow you to plan for and implement transformative technologies, integrate IT with programmatic functions, lower basic IT support costs, and improve reliability of IT systems. The key goals of HSC include:

This workbook will help you create an information technology environment that we call Healthy and Secure Computing (HSC). It is not a technology guide or user's manual. Rather, it is a guide to making decisions that will minimize the costs and increase the reliability and security of your information technology.

Use this workbook with the full Healthy and Secure Computing support documents, located at http://www.compumentor.org/HSC, and as a companion to workshops and seminars explaining HSC.

This workbook was developed by CompuMentor's Healthy and Secure Computing program for use in a series of training sessions for small nonprofit organizations in the San Francisco Bay Area. The content is offered here to the community in the hope that someone else may be able to benefit from it.

Implementation Materials

The HSC program includes guides for implementing our recommended baseline technologies. These materials include both step-by-step directions for manual implementation and automated installation tools, where possible. If you follow these guides you will insure that your computer and network installations are indeed healthy and secure.

These guides are included in the appendixes, and are available on the HSC program Web site.

Appendices
Appendix 1 - Implementation Guidelines

General Documentation

Fancy IT systems won't do your organization any good unless your staff has the necessary skills and knowledge to use the systems, so make sure that resources are set aside to cover the costs of staff training. There are various ways to approach IT skills training, from formal classroom lessons, to informal one-to-one knowledge transfer.

Here are some basic recommendations for IT skills training.

Nonprofit IT staff fall into two common roles, the IT manager and the accidental techie. An IT manager is a staff member with an IT support background whose primary job responsibilities include IT support for the organization. This role is responsible for most IT decision making. An accidental techie is a staff member with basic IT skills, but whose primary responsibilities are not IT-related. Often the accidental techie participates with management to make IT decisions rather than taking sole responsibility for those decisions.

Desktop User Support
Any organization that uses computers needs to have some form of end-user support. This can be provided in a number of different ways, but this support needs to be available. Lack of this first-level support is almost certain to result in significantly more costs, in staff time and data loss, than it will cost to provide.

Technology is not a one-time retail experience. Ongoing maintenance, support and management are essential, or the technology will degenerate. Proper support procedures and the resources needed to provide them are essential. An important part of the HSC program is a set of support and documentation materials. These materials help you with HSC program adoption, implementation, support, and maintenance. Below is an overview of the support and documentation materials. More detailed samples are located in Appendix 3.

This is the easy part. You can assign tech staff (internal or consultants) to implement your priority projects. But remember, these are not complex, proprietary or organization-specific projects; they are standard tasks like upgrading desktops or implementing a back-up system. Most anyone you hire can do these projects, the challenge is for you to determine which projects are most important.

The HSC guidelines themselves are in Appendix 1. They are organized into seven broad categories:

• PC hardware
• PC software
• LAN technologies
• Server technologies
• Internet technologies
• Security and privacy
• Ergonomics

PC Hardware: minimum specifications for Windows and Macintosh systems, buying advice, and more.

Where and when should you begin implementing the HSC guidelines? We recommend using the prioritization worksheet; we have already filled it in with recommendations from the security and backup guidelines. Along with items from your gap analysis, you should now have a list of technology projects that you should undertake - most likely too many for your current time and budget.

Information security revolves around three concepts, confidentiality, integrity, and availability. In a secure environment, your information is:

A gap analysis describes how your existing IT systems deviate from the HSC guidelines. You will use the gap analysis document to set priorities and plan for implementing a more robust system.

As you follow the technology implementation guidelines this first time, you should look for the baseline standards for each area of technology. You are not concerned now with what it may take to meet the current standards, there are other questions to answer along the way.

Worksheet Gap Analysis

In order to adopt HSC guidelines successfully, you need basic information on your existing IT systems, including desktop hardware and software, server hardware and software, network equipment, and specialized software. An inventory does not need to be exhaustive, but should include the basics such as make and model, serial numbers, and software titles and versions. It is also important to track licensing information, proof of purchase information, warranties, and support contracts. Often much of this information exists in your accounting system.

Before beginning the Healthy and Secure Computing process, decide if the program is an appropriate fit for your organization. This section discusses what you should consider while planning to implement the guidelines, including legal mandates and programmatic concerns. You will use this information at different points in the process to decide between technology options. You may find that your information system needs are such that HSC is not an appropriate fit, or that large parts of HSC are appropriate, or that you will be able to adopt all of the HSC guidelines.

The healthy and secure computing program is easy enough to use that you can successfully engage in the program on your own using the resources available here:

http://www.compumentor.org/HSC

If your organization has complicated IT infrastructures or limited IT know-how on staff, you may want to use the HSC materials in the context of a workshop or a one-to-one engagement with an IT consultant.