Presentation is loading. Please wait.

Presentation is loading. Please wait.

STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Protect Your Data, Protect Yourself Tech Briefing August 6, 2010 Turing Auditorium.

Similar presentations


Presentation on theme: "STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Protect Your Data, Protect Yourself Tech Briefing August 6, 2010 Turing Auditorium."— Presentation transcript:

1 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Protect Your Data, Protect Yourself Tech Briefing August 6, 2010 Turing Auditorium

2 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Agenda  Risks of data loss  What kinds of data need to be treated with special care  An overview of free tools to protect your data: Stanford Whole Disk Encryption (SWDE) Secure AFS Stanford IM Secure  Data Security for Mobile Devices  Avoiding the perils of phishing attacks  Upcoming changes to WebLogin password update procedures 5/7/2015 Protect Your Data, Protect Yourself page 1

3 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES 5/7/2015 Protect Your Data, Protect Yourself page 2 You’re Doing it All Right, Right?  A lot of us have Prohibited, Restricted, or Confidential Data we work with every day.  It’s part of the job.  Your computer is locked up.  You don’t give out your password or have it taped to your keyboard.  You don’t download and install weird programs from unreliable sources.

4 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES You Are Liable  If your computer is lost or stolen, you are liable for the unprotected data on it.  Depending on the type of data, various legal entities must be notified.  You will likely be discharged by the university. For example, a laptop was stolen… 5/7/2015 Protect Your Data, Protect Yourself page 3

5 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Prohibited Data  Prohibited Data includes: Social Security Numbers Credit Card Numbers Financial Account Numbers, such as checking or investment account numbers Driver’s License Numbers Health Insurance Policy ID Numbers  These CANNOT be on your computer without explicit permission from the Data Governance Board If DGB approved, NIST-approved encryption is required on Computing Equipment. 5/7/2015 Protect Your Data, Protect Yourself page 4

6 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Restricted Data  Restricted Data includes: Student Records Protected Health Information (PHI) Passport and visa numbers Research and other information covered by non-disclosure agreements  Access limited to those permitted under law, regulation and Stanford’s policies, and with a need to know.  NIST-approved encryption is required if information is stored on Computing Equipment. 5/7/2015 Protect Your Data, Protect Yourself page 5

7 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Confidential Data  Confidential Data includes: Faculty/staff employment applications, personnel files, benefits information, salary, birth date, and personal contact information. Admission applications Donor contact information and non-public gift amounts Privileged attorney-client communications Non-public Stanford policies and policy manuals Stanford internal memos and , and non-public reports, budgets, plans, and financial information Non-public contracts University and employee ID numbers Information subject to Export Control License  NIST-approved encryption is recommended if information is stored on Computing Equipment. 5/7/2015 Protect Your Data, Protect Yourself page 6

8 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES What Does it Mean? No Problem  Access via Oracle, Peoplesoft, etc. is over a protected transmission channel and data remains on the server. Needs Protection  Excel, Word, etc. files stored on your computer Grant proposal data HR files Student data  attachments  sending and receiving  Instant Message conversations 5/7/2015 Protect Your Data, Protect Yourself page 7

9 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Stanford Whole Disk Encryption  To protect everything on the drive, use Stanford Whole Disk Encryption It’s free Initial set up takes some time. You must use Big Fix and Sophos Anti-Virus  SWDE works on Macintosh and Window  SWDE protects your data at rest. 5/7/2015 Protect Your Data, Protect Yourself page 8

10 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES 5/7/2015 Protect Your Data, Protect Yourself page 9

11 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES How Does SWDE Work?  After installation, after encryption, when you reboot your computer, you will see this new screen:  Type your passphrase and press Enter/Return  Type your ID & password to login to your computer operating system. 5/7/2015 Protect Your Data, Protect Yourself page 10

12 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES I Don’t Want the Data on My Computer?!  Delete old, unnecessary files Secure Delete for Mac: https://encryption.stanford.edu/desktop/mac/securedelete.html https://encryption.stanford.edu/desktop/mac/securedelete.html Eraser for Windows: ml ml  Move it to a server Use a departmental server Use for-fee services like Sharepoint, Secure Virtualized Server, or SafeFiles (contact IT Services for more information) Use the free, centrally provided WebAFS service with SecureAFS 5/7/2015 Protect Your Data, Protect Yourself page 11

13 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES SecureAFS  Free space granted to a workgroup by request for storing Prohibited, Restricted and Confidential data  Access Secure AFS via WebAFS or an AFS client paired with Stanford VPN  To ensure file safety, data is backed up nightly and kept for 30 days If an important file is deleted, submit a HelpSU request and the file can be restored  Secure AFS space must be renewed annually At the end of the grace period, the account is deleted and files purged 5/7/2015 Protect Your Data, Protect Yourself page 12

14 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Secure AFS Request Form 5/7/2015 Protect Your Data, Protect Yourself page 13

15 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Secure AFS Request Form 5/7/2015 Protect Your Data, Protect Yourself page 14

16 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Secure AFS Confirmation 5/7/2015 Protect Your Data, Protect Yourself page 15

17 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Secure AFS Confirmation 5/7/2015 Protect Your Data, Protect Yourself page 16

18 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES WebAFS 5/7/2015 Protect Your Data, Protect Yourself page 17

19 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Secure AFS 5/7/2015 Protect Your Data, Protect Yourself page 18

20 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Secure  After July 20, 2010, all sent via address is encrypted over-the-wire from your computer to the SMTP gateway.  Secure must be used when sending Prohibited, Restricted, or Confidential data in .  Starting August 22, 2010, you can send secure from webmail or your desktop client by adding “Secure:” to the Subject of the message.  Stanford recipients receive the message normally.  Non-Stanford recipients must prove their identity before being allowed to unencrypt the message. 5/7/2015 Protect Your Data, Protect Yourself page 19

21 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Non-Stanford Recipients 5/7/2015 Protect Your Data, Protect Yourself page 20

22 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Non-Stanford Recipients 5/7/2015 Protect Your Data, Protect Yourself page 21

23 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Non-Stanford Recipients 5/7/2015 Protect Your Data, Protect Yourself page 22 Look! Important confidential data! Ammy

24 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Instant Message  Using AIM, Yahoo!IM, Microsoft Messenger, Google Chat, or other IM tools sends your conversation to servers at that company.  For Stanford business, use Stanford IM instead. Servers belong to Stanford. It is required for Confidential data over IM. Prohibited and Restricted data should NEVER be sent via IM.  Go to im.stanford.edu 5/7/2015 Protect Your Data, Protect Yourself page 23

25 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Securing Your Mobile Device  Always use a lock code to protect data  If you are synchronizing Stanford data to your phone, be prepared to remotely wipe of your phone if it is lost or stolen. This wipes EVERYTHING from the phone. 5/7/2015 Protect Your Data, Protect Yourself page 24

26 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Phishing Attacks  A phishing attack attempts to get you to reveal your username and password  Credentials are sent to an anonymous attacker who then takes over the account and uses it to launch other attacks.  s can be extremely deceptive.  Stanford will NEVER ask you to send your password via .  Watch for senders who are not at https:, as well as for spelling and date errors. 5/7/2015 Protect Your Data, Protect Yourself page 25

27 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Phishing Sample 5/7/2015 Protect Your Data, Protect Yourself page 26

28 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Password Change Compliance  HIPAA rules require that passwords are changed every six months. The Admin Guide recommends changing passwords every 90 days.  In the past, you got an . If the password was not updated, you got another .  If you are in a HIPAA data group, you will likely see the new password change page in the next six months.  Always double check the URL at the top of the page to make sure it starts with https and is at stanford.edu before entering any information. 5/7/2015 Protect Your Data, Protect Yourself page 27

29 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Change Password Button 5/7/2015 Protect Your Data, Protect Yourself page 28

30 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Password Change Page 5/7/2015 Protect Your Data, Protect Yourself page 29

31 STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES What questions do you have?


Download ppt "STANFORD UNIVERSITY INFORMATION TECHNOLOGY SERVICES Protect Your Data, Protect Yourself Tech Briefing August 6, 2010 Turing Auditorium."

Similar presentations


Ads by Google