1. Talking With The Boss About Security Darlene Quackenbush, James Madison University Shirley Payne, University of Virginia EDUCAUSE Conference October 21 st, 2005

2. 2 We must all become much more vigilant in the provision of secure systems, in intrusion detection, in rapid response, and especially in education. We must practice, teach, and infuse all aspects of security into campus lives. Dr. Linwood H. Rose President, James Madison University “Information Security: A Difficult Balance” EDUCAUSE Review, September/October 2004

3. 3 Agenda The Executive Audience Benefits of Effective Communication Obstacles To Effective Communication Communication Strategies & Examples References

4. 4 The Executive Audience Boards of Trustees Presidents Vice Presidents & Provosts Deans & Department Heads Chiefs of Staff

5. 5 Perceived Barriers To IT Security Information Technology Security Study EDUCAUSE Center for Applied Research, Sept. 2003

6. 6 Perceived Barriers To IT Security Information Technology Security Study EDUCAUSE Center for Applied Research, Sept. 2003 Executives can help define appropriate security/privacy balance

7. 7 Privacy and academic freedom are critical components of campus culture; it is vital that decisions on policies and procedures regarding security and related issues be carefully vetted, understood, and authorized by both the highest levels of the campus leadership and the representatives of the campus community. The executive role in all of these matters is crucial if internal dissension and unnecessary strife are to be avoided. “Presidential Leadership for IT” David Ward and Brian L. Hawkins EDUCAUSE Review, May/June 2003

8. 8 Perceived Barriers To IT Security Information Technology Security Study EDUCAUSE Center for Applied Research, Sept. 2003 Executives can enhance policy quality & acceptance

9. 9 Perceived Barriers To IT Security Information Technology Security Study EDUCAUSE Center for Applied Research, Sept. 2003 Executives can help determine/clarify responsibilities

10. 10 Perceived Barriers To IT Security Information Technology Security Study EDUCAUSE Center for Applied Research, Sept. 2003 Executives can influence others to change

11. 11 If you can get the president to set the right tone, a majority on campus will likely follow her or his lead in supporting the changes and improvements you recommend. “Gaining the President’s Support for IT Initiative at Small Colleges.” Laurence W. Mazzeno, President, Alvernia College EDUCAUSE Quarterly, Number 1, 2004

12. 12 Perceived Barriers To IT Security Information Technology Security Study EDUCAUSE Center for Applied Research, Sept. 2003 Executives can determine resources based on risks, if they know them

13. 13 Additional Benefits Opportunity to establish appropriate expectations Constructive involvement should a security incident occur

14. 14 In a time of crisis, it’s always good to have a boss smarter than you. Joy Hughes, VP/CIO, George Mason University

15. 15 Be Prepared For... Additional Work To: –tailor the information –provide status reports, possibly including development of new metrics –respond to inquiries Increased accountability

16. 16 Obstacles To Effective Communication Security, Security, Etc.

17. 17 Obstacle: Responsibility for security placed low in the organization Alarmist view or straight facts? What’s his experience level?

18. 18 Obstacle: Significant lack of awareness What do computers have to do with identity theft? Why is he talking about fishing?

19. 19 Obstacle: Unclear terminology IPS = International Primatological Society “Compromised” computer?

20. 20 Obstacle: Security not an institutional priority This doesn’t help attract research $$ This doesn’t enhance student life

21. 21 Obstacle: Lack of security metrics Is the situation really getting worse? How do we compare with others?

22. 22 Obstacle: Security viewed as one-time fix-it project But we trained the workforce three years ago! You’ve had your turn at the well.

23. 23 Obstacle: Cultural factors There will be an insurrection if we centralize server management! What do the faculty think of this idea?

24. 24 Obstacle: Executive role not clear I’m not a techie. How could I possibly help? So what are we paying the CIO to do?

25. 25 Effectively Talking With the Boss About Security Requires… Establishing trust Building awareness Losing the jargon Linking security to institutional priorities Solidifying business case with metrics Setting appropriate expectations Addressing cultural issues Emphasizing importance of executive level involvement

26. 26 Communication Strategies “getting it done” Good communication doesn’t just happen On-going attention

27. 27 A Project Plan... Review the landscape Set a target Managed communication Maintaining communication

28. 28 Differing Viewpoints ISO or Security Practioner Operational Focused Technical Executive Governance Broad Mission-focused

29. 29 Targeting Nirvana Source: Governing for Enterprise Security, Julia Allen, June 2005 Enterprise level Expected and respected topic Treated as a business requirement Appears regularly on the executive agenda Addressed in strategic and operational planning

30. 30 Targeting Nirvana (continued) Discussion and debate are encouraged Regular benchmarking Leaders are respected as value contributors Business enabler Integrated into the enterprise Not solely an IT responsibility Full understanding of individual roles and responsibilities

31. 31 Strategies Advocate security as risk management Identify risks at an the executive level Craft the security message Prepare to inform and educate Engage others Remain open Accommodate the culture Communicate for the long-term

32. 32 Maintenance Stay informed Be persistent Remain agile Be honest

33. 33 Positive Achievement Commuication among parties that are informed, persistently committed, agile in their views and honest in dealing with information security Communications Nirvana Real Value for Security

34. 34 References ACE Letter to Presidents Regarding Cybersecurity http://www.acenet.edu/washington/letters/2003/03march/cyber.cfm Developing Security Education and Awareness Programs http://www.educause.edu/ir/library/pdf/EQM0347.pdf Gaining the President’s Support for IT Initiatives at Small Colleges http://www.educause.edu/apps/eq/eqm04/eqm0417.asp Governing for Enterprise Security http://www.sei.cmu.edu/pub/documents/05.reports/pdf/05tn023.pdf EDUCAUSE Information Security Governance Assessment Tool http://www.educause.edu/LibraryDetailPage/666?ID=SEC0421 Information Security: A Difficult Balance http://www.educause.edu/pub/er/erm04/erm0456.asp Information Security Governance: A Call to Action http://www.cyberpartnership.org/InfoSecGov4_04.pdf Information Technology Security: Governance, Strategy, and Practice in Higher Education http://www.educause.edu/LibraryDetailPage/666?ID=ERS0305 Presidential Leadership for Information Technology http://www.educause.edu/ir/library/pdf/erm0332.pdf Report of the Best Practices and Metrics Teams www.incits.org/tc_home/CS1/2005docs/cs1050005.pdf