Presentation on theme: "HEISC Town Hall Webinar: 2012-2013 Strategic Plan Host: Larry Conrad CIO, UNC-Chapel Hill & HEISC Co-Chair."— Presentation transcript:
HEISC Town Hall Webinar: 2012-2013 Strategic Plan Host: Larry Conrad CIO, UNC-Chapel Hill & HEISC Co-Chair
Today’s Agenda Information security changes in the past 10 years Ongoing challenges for security practitioners HEISC strategic plan (2012-2013) Vision Mission Goals & objectives HEISC working group updates What can you do?
Information Security Changes in the Past 10 Years Threats: More serious – e.g., nation states, organized crime Vulnerabilities: New technologies (e.g., social media, cloud, mobility) introduce new vulnerabilities Impact: Confidentiality, Integrity, Availability (CIA) recognized as mission critical
On the Plus Side Increased awareness Greater investments, including security staff Staff professional development and training Improved organization across higher ed Better tools More policies and standards More strategic, proactive outlook More “effective practices” are available
Ongoing Challenges for Security Practitioners Executive awareness and support Technology changes: Mobility, outsourcing, cloud, IPv6 Benchmarks and metrics Organizational dynamics: Centralized, distributed, and affiliated centers Funding for IT security Staff resources and training
Ongoing Challenges (Cont’d) Data standards, governance, and risk management Data protection tools Student and employee awareness Academic continuity and disaster recovery Legislation and compliance Research data and process International collaboration Vendor relationships
HEISC Vision Guide academic institutions in their quest to safeguard data, information systems, and networks Protect the privacy of the higher education community Ensure that information security is an integral part of campus activities and business processes
HEISC Mission Improve information security, data protection, and privacy programs across the higher education sector Develop and promote leadership; awareness and understanding; effective practices and policies; and solutions for the protection of critical data, IT assets, and infrastructures Accomplish activities through working groups of volunteers and staff Coordinate and collaborate with government, industry, and other academic organizations
HEISC Goals 1. Establish the Information Security Guide as the premier resource for security professionals.Information Security Guide 2. Improve security-related interorganizational collaboration with higher education stakeholders. 3. Inform and educate campus leaders on information security issues by leveraging enterprise risk management (ERM) processes. 4. Help institutions leverage their investments with regard to all IT products and services. 5. Increase the effectiveness of communication efforts.
Objectives for Goal #1: Establish the Information Security Guide as the premier resource for security professionals Toolkits, primers, and templates Information security maturity model Security requirements Security practices in research environments CISO duties and reporting line Identity management (IdM) practices
Objectives for Goal #2: Improve security-related collaboration with higher education stakeholders EDUCAUSE, Internet2, and the REN-ISAC Core Data Service and EDUCAUSE Data, Research, and Analytics staff Other higher education associations, industry groups, and government Higher education information security professionals
Objectives for Goal #3: Inform & educate campus leaders on information security issues by leveraging ERM processes ERM summit Messaging, talking points, and presentation template Other higher ed association meetings and conferences (e.g., URMIA, NACUBO, AAU)
Objectives for Goal #4: Help institutions leverage their investments with regard to all IT products and services Vendor community outreach Resources for IT products and services Information sharing
Objectives for Goal #5: Increase the effectiveness of communication efforts Higher ed security professionals, CIOs, IT leaders Wealth of resources in the Information Security Guide Issues and successes in the.edu domain HEISC volunteer opportunities
HEISC Working Groups Awareness & Training (A&T) Governance, Risk, & Compliance (GRC) Technologies, Operations, & Practices (TOP) Information Security Guide Editorial Board Security Professionals Conference Program Committee Research and Education Networking Information Sharing and Analysis Center (REN-ISAC)
Awareness & Training (A&T) Co-Chairs: Nicole Kegler & Ben Woelk Student Poster & Video Contest National Cyber Security Awareness Month in October Executive Awareness Communications Partnering with the IT Communications Group New! Data Privacy Month in January New! Security Awareness Metrics Outreach and Marketing
Governance, Risk, & Compliance (GRC) Co-Chairs: Doug Markiewicz & David Escalante Recent publications: Two-Factor Authentication, Data Incident Notification Toolkit, Shared Assessments Project Team Sensitive Data Exposure Incident Checklist New! GRC Systems FAQ New! Information Security Maturity Model New! Essential Security Metrics New! Top Info Security Concerns for Researchers New!
Technologies, Operations, & Practices (TOP) Co-Chairs: Jim Taylor & Marcos Vieyra Recent publications: Mobile Internet Device Security Guidelines, Dropbox Security & Privacy Considerations, Full Disk Encryption Guide Identify emerging technologies and their security implications New! With the REN-ISAC, develop partnerships with vendors to improve information sharing Facilitate state or local ISO gatherings New!
Information Security Guide Editorial Board Co-Chairs: Ced Bennett & Mary Dunker Fresh look and feel New! Emphasizing practical application of the Security Guide via conference presentations New! Growing the content (nearly doubled in 2011) Extending the Guide's exposure and reach (even beyond EDU) New!
Security Professionals Conference 2012 Program Chair: Jodi Ito & Vice Chair: Paul Howell May 15-17, 2012 in Indianapolis, IN 10th annual conference Focused on information security in higher ed Premier forum for networking with security professionals Theme: Security Everywhere: Exploring the Expanding World of Security www.educause.edu/SEC12 www.educause.edu/SEC12
REN-ISAC Technical Director: Doug Pearson Membership growth Growth in relationships Involvement in strategic industry groups Implementation of Security Event System Community Security Partnership with SANS Engagement in international standards work Handling of 0-day vulnerability communications Increase in number of notifications Additional staff Contact: email@example.com@ren-isac.net