The Way Ahead for Information Systems Security: What You Don’t Know Can Hurt You Christopher Baum Research Vice President Global Government NYSCIO Conference July 13 th 2005

Key Issues What security threats are higher education institutions facing, and what are the trends? What resources are institutions bringing to bear on the security challenge? What principles should guide institutional IT security planning?

The Gartner/Chronicle of Higher Education IT Security Survey 2004/2005 Mail-based, US survey of Chronicle of Higher Ed subscribers, closed Nov 2004, Based EMEA/Australia survey closed May 2005 Topics: IT security organization, funding, attack/misuse incidence, technology, policy US: 556 total respondents (138 CIOs used) Non-US 63 respondents (40 EMEA, 23 Australia)

Types of Attacks/Misuse Detected in the Past 12 Months US Responses No

Types of Attacks/Misuse Detected in the Past 12 Months Non-US Responses No

Change in Attack/Misuse Incidence Compared to Previous 12 Months US Responses No

Change in Attack/Misuse Incidence Compared to Previous 12 Months Non-US Responses No

US Responses: Calculated Financial Loss No Loss calculation favors “obvious” hard values-- real costs are going almost unmeasured

Non-US Responses: Calculated Financial Loss No

US Percentage of IT Budget Spent on Security Current FY Mean: 6.24% Percentage compared to previous fiscal year Increased Same Decreased

Non-US Percentage of IT Budget Spent on Security Current FY Mean: 4.78% Percentage compared to previous fiscal year Increased Same Decreased

US Information Security Officer: Status and Plans Has institution designated an ISO? If not, plan to designate one within 12 months? Yes No 65% No Yes Don’t Know 75% 12% 30% 70% 13% Yes No Don’t Know Yes No Yes

Non-US Information Security Officer: Status and Plans Has institution designated an ISO? If not, plan to designate one within 12 months? Yes No 65% No Yes Don’t Know 80% 10% 35% 65% 10% Yes No Don’t Know Yes

US Security Planning & Training Yes No Don’t Know Yes No Have a formal IT Security Plan? Plan to resume mission-critical operations during crisis? Offer security awareness training?

Non-US Security Planning & Training Yes No Don’t Know Yes No Have a formal IT Security Plan? Plan to resume mission-critical operations during crisis? Offer security awareness training?

US: Frequency of Testing Plan to Resume The Operation of Mission-Critical Information Systems and Protect Related Data During a Crisis >Once a Month Once a Month Once Every 2-3 Months Once a Semester Once a Year Not Been Tested

Non-US: Frequency of Testing Plan to Resume The Operation of Mission- Critical Information Systems and Protect Related Data During a Crisis >Once a Month Once a Month Once Every 2-3 Months Once a Semester Once a Year Not Been Tested

CISO CIO Policy Management Policies and standards Risk assessment/profiling Policy compliance and consulting Awareness training Business security architecture Intellectual property management Security Administration Platform/application user management Security Engineering Minimum platform standards Technical security architecture Incident Response ID threat + solution BISO President Business/Academic Unit Management Expertise in Practice: CISO Organisation Board of Trustees

US Anti-Viral Software: Mandatory, Optional, Not Available

Non-US Anti-Viral Software: Mandatory, Optional, Not Available

US: VPN for Remote Access: Mandatory vs Optional

Non-US: VPN for Remote Access: Mandatory vs Optional

US: Personal Firewall: Mandatory, Optional or Not Available

Non-US: Personal Firewall: Mandatory, Optional or Not Available

Policy and Training Security policies need to be concise, clear, role- based and enforceable –Nontech user issues: acceptable use, privacy, business continuity –Tech staff: privileged access & ethical statement, PW management, change management, role –A policy that isn’t signed can’t be enforced Focus security training on network and system administrator Create a security culture

Establishing the Baseline

Building for Whom? Omniscient Nomadic Connected Telepathic

Defense in Depth in Practice: Scan and Block Scan Good: Allow Connect Scan Bad: Block Home PC Corporate Laptop Contractor Laptop VPN Switch Radius Server DHCP Server Policy Server Scan Results

Vulnerability Management Technologies Baseline/ Discover Audit and Policy Compliance Tools Security Management Monitor Network System Application Vulnerability Assessment External Threat Services Prioritize Asset Inventory and Classification Patch Install Mitigate Mitigation Workflow Shielding Provisioning Configuration Management Maintain Firewall IPS Scan and Block

Understanding the Environment Environ- mental Trends Environ- mental Trends Forces in the universe Trace the Value Business Drivers Business Drivers How they affect your organization Business Strategies and Tactics How you react What, who, when, how Information Require- ments Information Require- ments “Thou shalt...” Architecture Design Principles Business and Technology Architecture Business and Technology Architecture

Understanding the Environment Environ- mental Trends Environ- mental Trends How you react What, who, when, how “Thou shalt...” Trace the Value Information Require- ments Information Require- ments Business Drivers Business Drivers Business Strategies and Tactics Architecture Design Principles Forces on your organization How you react Business and Technology Architecture Business and Technology Architecture What do we know? What do we need? Where do we get it? Where does it need to be? When does it need to be there? Who should not see it? PeopleSystemsProcessesData INFORMATIONREQUIREMENTS

A New World

Seven Guiding Principles of IT Security Defense in Depth –Combine proactive & reactive mechanisms Principle of Least Privilege –Users, processes, & resources get minimum necessary access The Weakest Link –Train against social engineering Security Expertise is Key –Establish a CISO office; mix central policy w. distributed implementation Build Security in Early –The earlier a defect is found, the cheaper it is to fix Be Paranoid –Don’t just build for legitimate or “correct” usage Simplify, Simplify, Simplify –Simpler systems are easier to deploy, manage, & maintain

The Way Ahead for Information Systems Security Christopher Baum Research Vice President Global Government NYSCIO Conference July 13 th 2005