Strategies for Crafting Effective IT Security Policies CIO Forum March 12, 2003 Dennis Maloney & Marin Stanek The University of Colorado at Boulder.

Slides:

Advertisements

Similar presentations

Planning Collaborative Spaces in Libraries

Advertisements

How Will it Help Me Do My Job?

Manatt manatt | phelps | phillips New York State Health Information Technology Summit Initiative Overview and Update Rachel Block, Project Director United.

Legal Work Group Developing a Uniform EHR/HIE Patient Consent Form.

Darton College Information Systems Use Policies. Introduction Dartons Information Systems are critical resources. The Information Systems Use Policies.

Defining the Security Domain Marilu Goodyear John H. Louis University of Kansas.

Security Education and Awareness Workshop January 15-16, 2004 Baltimore, MD.

Overview of Priorities and Activities: Shared Services Canada Presentation to the Information Technology Infrastructure Roundtable June 17, 2013 Liseanne.

October  A Web Portal recognized as the authoritative source for national interagency wildland fire information is needed to.

On Beyond Z Building a Directory Service educause presentation #074 University of Colorado at Boulder Deborah Keyek-Franssen Marin Stanek Paula J. Vaughan.

Why are we scared of Social Media in our schools? Why do we need a policy? Does it need to be slanted toward a specific technology?

Advancing Security Programs through Partnerships Cathy HubbsShirley Payne IT Security Coordinator Director for Security Coordination & Policy George Mason.

Security Controls – What Works

Information Security Policies and Standards

Content Management System (CMS) Implementation at SFU Feb 10, 2011 Frances Atkinson Director, Institutional, Collaborative & Academic Technologies IT Services.

August 9, 2005 UCCSC IT Security at the University of California A New Initiative Jacqueline Craig. Director of Policy Information Resources and.

Data Management Awareness January 23, University of Michigan Administrative Information Services Data Management Awareness Unit Liaisons January.

Cybersecurity Summit 2004 Andrea Norris Deputy Chief Information Officer/ Director of Division of Information Systems.

University of Guelph IT Security Policy Doug Blain Manager, IT Security ISC, April 27th.

July 12, 2005 CSU SIMI Workshop - Melding Policy and Technology to Manage Identity1 Provisioning Services Collaborative CSU, East Bay and CSU, San Bernardino.

NDSU Lunchbytes "Are They Really Who They Say They Are?" Digital or Electronic Signature Information Rick Johnson, Theresa Semmens, Lorna Olsen April 24,

Effort in hours Duration Over Weeks Or Months Inception Launch Web Lifecycle Methodology Maintenance Phases Copyright Wonderlane Studios.

Copyright 2003 Cuyahoga Community College District Knowledge Management: Making it Fly in Higher Education Presenter: Amy C. Eugene Director, Knowledge.

ACCEPTABLE An acceptable use policy (AUP), also known as an acceptable usage policy or fair use policy, is a set of rules applied by the owner or manager.

Copyright Shanna Smith & Tom Bohman (2003). This work is the intellectual property of the authors. Permission is granted for this material to be shared.

Copyright © Center for Systems Security and Information Assurance Lesson Eight Security Management.

Data Protection in Higher Education: Recent Experiences in Privacy and Security Institute for Computer Law and Policy Cornell University June 29, 2005.

About Waterloo website Project report June Outline Overview of process Project deliverables Lessons learned.

1 Tuesday, August 16, 2005 W E B C A S T August 16, 2005 Policy Development Theory & Practice: An Emphasis on IT Pat Spellacy Director of Policy & Process.

Emergency Communications Management Jonathan Rood CIO and Associate VP, San Francisco State University Laine Keneller Business Continuity Planner & Project.

Peer Information Security Policies: A Sampling Summer 2015.

Security Guide for Interconnecting Information Technology Systems

National Public Health Performance Standards Local Assessment Instrument Essential Service:3 Inform, Educate, and Empower People about Health Issues.

1 EDUCAUSE Midwest Regional Conference Top Strategies for Working with Stakeholders: Synopses of Recommendations from the Identity Management Summit Mark.

Taking Control: Constructing an Editorial Framework and Policies Introduction Model and Elements Principles Roles Protocols Policies Case Studies Ending.

Get Started With Marketing!. Marketing on Your Mind?  This presentation will include: Info for New and Experienced Users Ideas for marketing to Students.

A Roadmap to Service Excellence Information Technology Strategic Plan University of Wisconsin-Madison A report to the ITC

Exchange Network Node Help Desk NOLA Conference Feb 9-10, 2004.

An Introduction to the Fairfax County Communication Strategy

Information Technology Master Plan

An Educational Computer Based Training Program CBTCBT.

Commonwealth of Massachusetts Statewide Strategic IT Consolidation (ITC) Initiative ANF IT Consolidation Website Publishing / IA Working Group Kickoff.

Important acronyms AO = authorizing official ISO = information system owner CA = certification agent.

Environmental Management Systems (EMS) Update Region 5 February 27, 2006.

Policy and IT Security Awareness Amy Ginther Policy Develoment Coordinator University of Maryland Information Technology Security Workshop April 2, 2004.

EdReNe, 2nd Strategic Seminar (Lisbon, June 2008) (c) 2008, Daniel Weiler, Centre of Technology of Education Luxembourg’s Educational Portal Enabling Connected.

Policy Development at Georgetown: Directory Enabled Applications (and not) Charles F. Leonhardt CSG Winter Meeting Sanibel Harbour,

1 The World Bank Internet Services Program Rajan Bhardvaj

Safeguarding Research Data Policy and Implementation Challenges Miguel Soldi February 24, 2006 THE UNIVERSITY OF TEXAS SYSTEM.

Seeking a National Standard for Security: Developing a Systematic Crosswalk of the Final HIPAA Security Rule, the NIST SP , NIST SP Security.

1 GSC: Standardization Advancing Global Communications ISACC Opening Plenary Presentation GSC-11 SOURCE:ISACC TITLE:ISACC Opening Plenary Presentation.

Federal Strategic Sourcing Initiative U.S. General Services Administration FSSI Office Products II “ OS2 in a Box” Implementation Kit.

The Impact of Evolving IT Security Concerns On Cornell Information Technology Policy.

Converting Policy to Reality Designing an IT Security Program for Your Campus 2 nd Annual Conference on Technology and Standards May 3, 2005 Jacqueline.

9-Oct-03D.P.Kelsey, LCG-GDB-Security1 LCG/GDB Security (Report from the LCG Security Group) FNAL 9 October 2003 David Kelsey CCLRC/RAL, UK

Best Practices in Enterprise IAM Liza Lowery Massey Montana Government IT Conference December 6, 2007.

1 CREATING AND MANAGING CERT. 2 Internet Wonderful and Terrible “The wonderful thing about the Internet is that you’re connected to everyone else. The.

Policy Lifecycle Policy Created Published & Communicated Periodic ReviewRevised or Retired 10/4/2010 Policy Development Process-v4.b.

Quickly Establishing A Workable IT Security Program EDUCAUSE Mid-Atlantic Regional Conference January 10-12, 2006 Copyright Robert E. Neale This.

Computer Policy and Security Report to Faculty Council Jeanne Smythe ATN Director for Computing Policy March 26,2004.

1 An Overview of Process and Procedures for Health IT Collaboration GSA Office of Citizen Services and Communications Intergovernmental Solutions Division.

UNDERSTANDING INFORMATION MANAGEMENT (IM) WITHIN THE FEDERAL GOVERNMENT.

CHANGE MANAGEMENT - PART 2 MODULE 7

Incorporating Privacy Into Systems Development Methodology Phil Moleski Director Corporate Information Technology Branch Saskatchewan Health

Implementing a SharePoint Portal

An Introduction to the Fairfax County Communication Strategy

An Introduction to the Fairfax County Communication Strategy

Colorado state university-pueblo policy and administration (PA)

November AUL Open House

Presentation transcript:

Strategies for Crafting Effective IT Security Policies CIO Forum March 12, 2003 Dennis Maloney & Marin Stanek The University of Colorado at Boulder

Why Now?? Internal Drivers Telecommunications & wireless audit Campus-wide IT Strategic Plan = greater coordination & collaboration External Drivers 9/11 Federal Laws & Agencies (FERPA, HIPAA, NSF) State Laws Private Research Communities (NASA)

2002 – The Year of Policy Development Established policies Computing and Network Resources for all Users (Rights and Responsibilities Doc) Student as an Official Means of Communication (FERPA, HIPAA, Confidential/Sensitive Information) Campus-wide Access & Authorization (Encrypted Authentication) Directories Wireless Policies still under development Identity Management Copyright Antivirus

Policy Roadmap A great idea for a policy Then a flurry of communication occurs CIO, ITS & IT Coordinators begin drafting ITC discusses & revises Legal Counsel advises Appropriate constituencies involved Endless revisions occur Life looks bleak A better policy emerges because of campus input Policy is reviewed & approved by CEC ITC & LC review again Policy is signed by the Chancellor Policy is communicated to campus and life is good!

Policy Development: Step One – Be Aware of Existing Policies Federal (Research requirements, FERPA, HIPPA, Copyright) State (Campaign Fair Practices Act, Conflict of Interest) University Policies Current Campus Policies

Policy Development: Step Two – Conceptualizing High Priority Policies/Basic Set of Policies (Our List) Accountability (Rights & Responsibilities/Acceptable Use, C&NR) Availability (Wireless) Integrity (Server Security, Directories) Access Control (Access & Authorization, Identity Management) Determination of Data Sensitivity (Copyright, and Guidelines for Computer Users) Security Management (Network Security, Antivirus) Policies managing flow of information (Web Publishing Policy, Portal Policy)

Accountability (Rights & Responsibilities/Acceptable Use, C&NR) Security Management (Network Security, Antivirus) Integrity (Server Security, Directories) Access Control (Access & Authorization, Identity Management) Determination of Data Sensitivity (Copyright, & Guidelines for Computer Users) Availability (Wireless) E-Policies (Web Pub, , Portal) Visualizing Your Policy/Practices Framework

Policy Development: Step Three – Policy Outline (time saver or time sucker) Develop a policy template – Introduction/Purpose of the Policy – Definitions – Scope of the Policy – Policy Statement (most important) – Sanctions – References – Responsible Office & Review Schedule – Date of implementation – Attachments (might include guidelines, standards, procedures/processes) Name Audience Policy Emphasis Technical Emphasis Who handles the violation

Policy Development: Step Four – Discussion, Process, & Approval Review what other similar schools are doing ( -- do your homeworkwww.educause.edu Gain support & approval from senior level –find a champion Contact key constituencies for informal input Establish or recognize who will formally approve policy Establish buy-in Provide information online & accessible from one location Provide an interim phase for feedback Develop accompanying guidelines, standards, process/procedures documentation

Educational Campaign Initial Announcement (from highest source possible) Accompanying website (includes policy, FAQ, guidelines, standards, procedures/process, AND who to contact! Tailor specific messages to audiences (faculty, students, staff) Listen to feedback! Evaluate impact

Lessons Learned 1.Research & make connections w/other schools – build on what they’ve developed 2.Collaborate across campus 3.Have patience – good policy development is about building consensus and awareness 4.Maintenance = effectiveness; don’t let a policy become “dusty”

Good References – – – –

Contact Information Marin Stanek, IT Initiatives Coordinator – Dennis Maloney, Executive Director, ITS – CU-Boulder Policy website: –