BruinTech Vendor Meet & Greet December 3, 2015 IT Services Information Security BruinTech Vendor Meet & Greet December 3, 2015

Agenda… IT Security Program – Mike Story Penetration Testing – Alex Podobas Questions and Answers

Interim Director, Chief Information Security Officer IT Security Program Mike Story Interim Director, Chief Information Security Officer mstory@it.ucla.edu

UC Cyber-Risk Mandate President Napolitano – July 2015 1. Inventory and assess cybersecurity vulnerabilities Campus plan to inventory IT assets (data and inventory), map risks and vulnerabilities, and assess IT security 2. Develop a strategy, governance approach, and action plan to consistently evaluate and reduce cyber-risk UC Cyber-Risk Governance Committee (CRGC) Joint cyber-risk governance across the UCLA campus and Health Sciences 3. Participate in systemwide planning efforts to facilitate and promote cyber-risk reduction UC risk reporting and escalation process UC cybersecurity training for staff and students (TBD) UC prevention, detection, and remediation protocols; minimum security standards 4. Arrange for regular executive-level discussion of cyber-risk management Cyber-Risk Responsible Executive (Scott Waugh) planning and communication 5. Confirm the commitment to adequate staffing and budget to support cybersecurity initiatives Cybersecurity resource plan and implementation timeline

Cybersecurity Framework Framework for Improving Critical Infrastructure Cybersecurity http://www.nist.gov/cyberframework/ Develop the organizational understanding to manage cybersecurity risk to systems, assets, data, and capabilities Develop and implement the appropriate safeguards to ensure delivery of critical infrastructure services Develop and implement the appropriate activities to identify the occurrence of a cybersecurity event Develop and implement the appropriate activities to take action regarding a detected cybersecurity event Develop and implement the appropriate activities to maintain plans for resilience and to restore any capabilities or services that were impaired due to cybersecurity event We are working closely with the UCLA Privacy Board to ensure balance between an open academic / research environment, privacy, and security.

Program Objectives Immediate Priorities: Longer-Term Goals: Identify, locate, and protect sensitive data and systems Remediate & patch known system and application vulnerabilities Improve Information Security awareness and education Longer-Term Goals: Improve information security monitoring and intelligence Establish a differentiated security control framework Implement state of the art IT security tools and processes Build a staff of Information Security specialists Provide expert Information Security consulting and guidance to the campus Establish a formal Information Security compliance program

IT Security Team Expand the scope of IT security services To effectively leverage the appropriate tools, technologies, and processes needed to properly secure the environment Provide the skills necessary to design and support the next-generation security strategy Enhance relationships with key stakeholders and provide the security expertise and support needed to reduce cybersecurity risk On boarded 4 additional resources (1 Project Manager and 3 Information Security Analysts) in addition to 2 existing resources Assessing additional resource requirements against projects

Penetration Testing Alex Podobas IT Security Analyst ampodobas@it.ucla.edu

Vulnerability vs. Penetration Testing (Not synonymous) Vulnerability Testing: Deployed to detect, but not necessarily verify or exploit, software or configurations Typically a “point and shoot” security tool Penetration Testing (“Pentest[ing]”) Deployed with the specific intent to detect and actively exploit application code or configurations of various software in a web application stack May DoS a resource, corrupt data, or expose sensitive code or data Ideally involves human direction of the detection and exploitation process

Offerings UCLA IT Security offers penetration testing services free of charge We utilize a wide array of tools…. AppScan, Burp Suite, Kali Linux OS (sql ninja, Vega, nmap, skipfish, rainbow table attacks), and much more …But we also can human-review application code and software configurations and suggest changes to comply with law, UC and UCLA policy, and data security and privacy best practices (such as NIST)

Pentesting Objectives Our objective is to provide a central, internal service that any official UCLA group, department, unit, or employee can request to improve their technical InfoSec practices As a result of each pentesting engagement, we provide specific action items, highlight and rank vulnerability issue severity, provide the original reports from our tools, and provide pragmatic recommendations for your environment The Information Security Office is here to improve UCLA’s InfoSec posture, not punish those that seek our technical assistance

Questions ?