mandatory online training

mandatory online training

intro

• why we are doing this

• why you should care

• what we hope you get out of this

How does info sec affect me?

• need to understand the info sec policy

• need to follow safe data handling practices, including disposal

• need to practice safe computing

What Information Security is

• definition

• examples

University Information Security policy

• Summarize policy– what covered – who covered– define principles

University Information

• University Data - Data created or maintained by the University related to carrying out the University's mission. It’s a University resources, owned by the University.

• Exclusions – Research data, class notes, lesson plans, personal papers, materials covered in the University’s Intellectual Property Policy

defined roles in policy

• cio• data oversight• data steward• university community (faculty, staff, students)• info sec department• Univ archives• audit and advistory• procurement

Data Steward

• An individual who is responsible for ensuring the confidentiality, integrity, and availability of University information. A Data Steward defines access to and restrictions on use of the information for which he or she is responsible.

• A data steward also:– Ensures the confidentiality, integrity and availability of

University data– Classifies all University information as Public, Internal,

Sensitive, or Highly Sensitive, according to Data Classification Guidelines

who are the data stewards?

• do we list them?

Univ community

• Protect the privacy and security of University information, applications, computer systems, and networks under their control

• Adhere to all relevant data handling standards

• Report suspected violations of this policy to the Director of Information Security or to the appropriate Data Steward

Categorization of University data

• Determined by the degree of expected impact on the University or individuals if University information is mishandled.

Categories of University Data

• Public

• Internal

• Sensitive

• Highly sensitive

Data category: Public

• Information intended for public use that, when used as intended and not altered, would have no adverse impact on University operations, University assets, or individuals.

examples of public data

• PR releases

Data category: Internal

• Information not intended for parties outside the University community that, if disclosed, would have minimal or no adverse impact on University operations, University assets or individuals.

examples of Internal data

• directory info?

Data category: Sensitive

• Information that, if mishandled, could be expected to have a serious adverse effect on University operations, University assets or individuals.

examples of restricted data

Data category: Highly sensitive

• Information that, if mishandled, could be expected to have a severe or catastrophic adverse effect on University operations, University assets or individuals.

examples of highly sensitive data

interaction

• sorting data by types?

Enforcement of info sec policy

• The University will investigate suspected violations, and may recommend disciplinary action in accordance with University codes of conduct, policies, or applicable laws. Sanctions may include one or more of the following:– Suspension or termination of access – Disciplinary action up to and including termination of

employment – Student discipline in accordance with applicable

University policy– Civil or criminal penalties

Transition?

• how do we move from Info sec policy to rest of topics?

Data Handling Standards

• Get permission from data steward for access

• Use and share info with others only according to standards

Safe data handling (could be interactive—choose correct answers)

• Secure handling procedures:• Lock screen when leaving computer• Turn monitor from door• Keep hard copies locked in desk when not in

use• Lock your office door when leaving room• Never leave hard copies in printer/copier• Store electronic files in Netfile

Disposal methods

• Data/information – Shred paper copies– Use spy-bot to electronically shred files

• Technology– clean hard drives before disposal

Safe computing

• Includes using tools such as – TakeCharge– virus protection– anti-spyware– Use SENF to find files containing sensitive data

– laptop encryption

• Safe Web surfing– all your precautions can be undone by visiting the

wrong site

Myths about security

• No one wants my stuff

• A little surfing hurts no one

• The University/OIT is protecting me

Points to remember

• Information Security is an ever evolving responsibility

• policies are being developed and implemented over time

Want more info?

• secure.nd.edu

• reporting violations

my points

• Missing:– secure work space

presentation issues

• travel theme– road signs (caution signs, stop signs, billboards, street signs,

etc.)– could use roadmap (sorry!) to mark progression through course

• interactions– click to advance to next slide?– questions interspersed with text?

• how often?

– does wrong answer send them back or just get right answer told to them?

– Matching? Multiple choice?– do we keep score?

More issues

• length– this covers topics chosen but seems way too

long– any ideas on what to cut, if anything?

• adverse effects maybe?

– ideas on focus of subsequent training?