UWM CIO Office Institutional Data Privacy and Security Presenter: Steve Brukbacher, Information Security Architect Moderated by: Bruce Maas, CIO November.
Post on 04-Jan-2016
214 Views
Preview:
Transcript
UWM CIO Office
Institutional Data Privacy and
Security
Presenter: Steve Brukbacher, Information Security Architect
Moderated by: Bruce Maas, CIO
November 11, 2009
UWM CIO Office
UWM Information Security responsible for coordinating:• Policies
• Technical controls• Compliance• Communication• Forensics, investigations
and incident response
UWM CIO Office
Session Goals
• Answer “Why is this important?”
• Share Security Goals• Identify future steps and needs
First, some background…
UWM CIO Office
We are all data
custodians.
UWM CIO Office
Security Trends
Increasingly complex landscape
UWM CIO Office
Security Trends
Need to control where confidential data lands
UWM CIO Office
Security Trends
Challenging endpoint security
UWM CIO Office
Data breaches are costly.$202/record
500 records = $101K 1,000 records = $202K30,000 records = $6.06M
Source: Ponemon Institute ponemon.org
UWM CIO Office
Loss of trust.
Data breaches are costly.
Source: Ponemon Institute ponemon.org
UWM CIO Office
What dangers are on the
horizon?
UWM CIO Office
Threats
Datalossdb.org
UWM CIO Office
What have we gotten good at:
-Incident Response and Forensics-Day to day security issues-AV Management-Risk Assessments -Network Monitoring-Efficient Desktop Support
UWM CIO Office
So where is UWM in this
landscape?
UWM CIO Office
Data Sources
Students: Academic Health HR
Faculty/staff: HR Health
Research: Health Patent
UWM CIO Office
Types of Data
• SSNs• Credit card numbers• Grades• Personnel-related• Health-related• Research-related
UWM CIO Office
Personal Health Information Example
• CUPH (Aurora, Medical College, UWM)
• Milwaukee Health Report 2009
• Perinatal database hosting (80+ hospitals) statewide:
- Providing data to state vital records- Meeting reporting needs for
hospitals/health departments
UWM CIO Office
Health care issues such as:• Health care legislation• Pandemic issues• Socioeconomic disparity
Even more motivation for breach prevention!
UWM CIO Office
1.Manage access to and use of confidential data.
2. Understand where the data is
3. Develop efficient and consistent compliance processes
4. Offer “pre-fab” high security environments
Institutional Data Privacy and Security Goals
UWM CIO Office
1. Limit access to and use of confidential data
Institutional Data Privacy and Security Goals
UWM CIO Office
2. Know location of data
Institutional Data Privacy and Security Goals
UWM CIO Office
3. Employ a repeatable, cost-effective and reportable compliance methodology
$
Institutional Data Privacy and Security Goals
UWM CIO Office
4. Offer “pre fab” high security environments for researchers
Institutional Data Privacy and Security Goals
UWM CIO Office
What do we need?• Policy
• Procedures and processes
• Strengthened core IT infrastructure
• Security-enhanced networking environments
• Security-enhanced desktop environments
UWM CIO Office
Policies currently in place:• Acceptable Use Policy (AUP)• Campus Information Security Policy
UWM CIO Office
Policy Needs Identified/in ProcessResearch Data Security Policy:
- Integrate w/IRB process to secure confidential human subjects data
- Utilize form to gather basic info
- Work w/Security via checklist or
one-on-one engagement
UWM CIO Office
SSN Privacy & Security Policy:
- Establishes understanding to only collect/store data as necessary
- Formally ensures data is secured where
it is needed and used
Policy Needs Identified/in Process
UWM CIO Office
Procedures and Processes
• Need for GRC product?• IRB coordination• Ongoing process of procedure development
for security assessment and implementation
UWM CIO Office
New credit card data handling procedures/processes• Consolidation of card payment services
• Allowance for other options provided unit responsible for compliance efforts
UWM CIO Office
Strengthen Core IT
InfrastructureFramework: ITIL - IT Infrastructure Library:• Utilizes methodology for efficient and secure
IT management
• Focuses on defining services
• Clarifies requirements for: - Performance- Functionality- Security
UWM CIO Office
How do we do this?• Determine what you have• Stabilize the patient• Establish repeatable build processes• Enable continuous improvement
Strengthen Core IT
Infrastructure
UWM CIO Office
What are we working on?• More formal change management
process• Development of a unified patching
methodology• Contemplating a Log Management
system• Baseline system security standards
Strengthen Core IT
Infrastructure
UWM CIO Office
New Service/Service Enhancement Process
• Enumerates resource estimates and details impacts of systems/services
• Facilitates top-level resource decision-making
• Ensures right people at the table
• Helps balance service levels with service expectations
UWM CIO Office
• Need a network “home” for confidential data
• Need network-based firewall services
• Need flexible implementation
Security-enhanced Networking
Environments
UWM CIO Office
Tech Users Group providing foundation • Common identified solutions:
McAfee & EPOIdentity FinderNext Gen. endpoint securityCollaboration on OS deployments
• Needs:Patch ManagementFull support for FDEFile/folder level encryption software &
support
Security-enhanced Desktop
Environments
UWM CIO Office
1.Manage access to and use of confidential data.
2. Understand where the data is
3. Develop efficient and consistent compliance processes
4. Offer “pre-fab” high security environments – ability to execute
Institutional Data Privacy and Security Goals
UWM CIO Office
What do we need?• Policy to establish roles and “must do’s”
• Procedures and processes
• Strengthened core IT infrastructure
• Security-enhanced networking environments
• Security-enhanced desktop environments
UWM CIO Office
Specific Technical Needs:• Network firewall• GRC software• Identity Finder• Full disk encryption• File/folder-level encryption• Patch Management• Log management
UWM CIO Office
Requires Investment
:
Technology
People
UWM CIO Office
Shared responsibility of all to serve as data custodians
and ensure data is kept secure.
UWM CIO Office
Steve Brukbacher, sab2@uwm.edu
Bruce Maas, bmaas@uwm.edu
Institutional Data Privacy and
Security
top related