1. Information Security Services

2. Overview  Administrative Systems Security  Legislative Requirements  SUNet Security  Individual Security Awareness  What’s Next

3. Improve Administrative Systems Security  Joined the project and support teams  Delphi, Peoplesoft  System administration  Security reviews  Peoplesoft, Delphi, Authority Manager, WebAuth, VOIP, MyApps, Workflow, TMIS, Apply Yourself, CashNet, etc.  Designed multi-tier firewall architecture  Emphasizing industry best practices Improve Administrative Systems Security

4. Categories of Data Criteria: Use these criteria to determine which data category is appropriate for a particular information or infrastructure system. A positive response to the highest category in any row is sufficient to place that system into that Category. Category A (highest, most sensitive) Category B (moderate level of sensitivity) Category C (very low, but still some sensitivity) Legal requirements Protection of data is required by law (see attached list for specific HIPAA and FERPA data elements) Stanford has a contractual obligation to protect the data Reputation risk High MediumLow Other Institutional Risks Information which provides access to resources, physical or virtual Smaller subsets of Category A data from a school, large part of a school, department Data about very few people or other sensitive data assets Examples  Medical  Students  Prospective Students  Personnel  Donor or prospect  Financial  Contracts  Physical plant detail  Credit Card numbers  Certain management information  Information resources with access to Category-A data  Research detail or results that are not Category-A  Library transactions (e.g., catalog, circulation, acquisitions)  Financial transactions which do not include Category-A data (e.g., telephone billing)  Very small subsets of Category A data Improve Administrative Systems Security

5. Firewall Architecture (c onceptual) Improve Administrative Systems Security

6. Legislation: Support Issues  FERPA  Protect private student information  HIPAA  Protect personal health information (PHI)  GLBA  Protect “banking” transaction information  SEVIS  Provide foreign student information  DMCA  Protect copyrighted information  California Law  May not use SSN as identifier  Must disclose compromise of private information Improve Administrative Systems Security

7. SUNet Security  Filter high-risk traffic at the border  Support distributed firewalls  Vaden  Controller’s Office  Sample all five Internet feeds  2.2 Gb/sec  Maintaining 5GB day logs x 8 weeks for forensic purposes  Previously sampling only two feeds  Constraining traffic to 200Mb/sec Improve Overall SUNet Security

8. SUNet Security, cont.  Scan Entire Network  Looking for vulnerabilities only  Started in residences with ResComp  Of 4,000 machines, found 300 vulnerable  All 300 repaired before break-ins  Continuing to re-scan periodically  Scanning all other network segments  Working with local support groups Improve Overall SUNet Security

9. Significant Security Payoff Improve Overall SUNet Security

10. Campus-Wide Security Leaders Group  Sub-group on Policy Development  Improvements to Admin Guide  Additional practices and procedures  Subgroup on Security Awareness  Create a security awareness and education program Improve Individual Security Awareness

11. Awareness Campaign  Launched on April 7  Postcards sent to every employee  Web site ready  Self-check security tool  Enter a drawing  Student focus in Fall  Approaching Stanford  Packets on beds  Residence hall contest  Ongoing activities  Stanford 101  Communicating with returning students  Technical security training  Continuing to expand web site Improve Individual Security Awareness

12. Other Awareness Activities  Security Alerts  Highly focused alerts  Stanford focused  Email alerts to broad distribution list  Posted to web site  Presentations  Meet with groups to continue to educate Improve Individual Security Awareness

13. Other Activities  Incident response  Continue to aim at reducing incidents  Work with various Stanford Offices  Office of General Counsel  Internal Audit  Privacy Officer  Judicial Affairs  Residential Deans  ResComp  Med School, Hospital, and other security groups at Stanford  Participating at the industry and national levels  EDUCAUSE/Internet 2 Security Task Force  USENIX  SANS  Networld + Interop

14. Beyond Today  Continue to improve Stanford security  Reach steady-state for administrative applications  Improve network security  Improve individual security  Additional services  Provide deeper and broader security training  Work with faculty  Better protection for intellectual capital  Work with Networking  Offer more and better security options through network architecture improvements What’s Next