1 Fighting Back With An Alliance For Secure Computing And Networking Wayne Donald, Virginia Tech Cathy Hubbs, George Mason University Darlene Quackenbush, James Madison University Shirley Payne, University of Virginia 2003 EDUCAUSE Conference November 5 th, 2003 Copyright Wayne Donald, Cathy Hubbs, Darlene Quackenbush, Shirley Payne; This work is the intellectual property of the authors. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

2 Agenda The why and what of the alliance Present offerings Creation and strategies for success Benefits realized Q&A

3 The Why & What of the Alliance Wayne Donald Information Technology Security Officer Virginia Tech

4 Events Influencing Formation Cooperative efforts were already underway among four institutions Governor Mark Warner charged higher education to help meet cybersecurity goals Development of Higher Education CIO’s plan for supporting Virginia IT strategic plan JMU and GMU cybersecurity research centers’ charged to assist State in meeting security goals

5 V irginia A lliance for S ecure C omputing A nd N etworking

6 Purpose Strengthen security programs across Virginia higher education by integrating and making available field-proven tools, best practices, and people from VA SCAN partner institutions Establish links to security research, instruction, and federal/state government initiatives to enhance security opportunities

7 VA SCAN The alliance brings together Virginia higher education security practitioners, who develop and maintain security programs emulated by other institutions, and Researchers responsible for creating cybersecurity instruction and research programs nationally recognized for excellence

8 Current VA SCAN Partners Security Practitioners at George Mason University James Madison University University of Virginia Virginia Tech Security Researchers at Commonwealth Information Security Center (JMU) Center for Secure Information Systems (GMU) Critical Infrastructure Protection Project (GMU/JMU)

9 Status Endorsed by Higher Education CIO’s Group and University Presidents First products and services were made available March 2003 Assisted other State institutions in defining and organizing security programs Additional products and services under development with input from “user” institutions

10 Present Offerings Cathy Hubbs Information Technology Security Coordinator George Mason University

11 Present Offerings Available to Higher Education institutions in Virginia Consulting Ask the Expert service On–site engagements Periodic information sharing meetings and workshops

12 Present Offerings Information resources: Security instructional materials Moderated mail list for general security discussions VA-CIRT group for tracking new threats Compliance Checklist for State of VA Web-based toolkit of tools & best practices

13 Creation and Strategies for Success Shirley Payne Director for Security Coordination & Policy University of Virginia

14 Set-up Steps (May 2002 – February 2003) Developed concept paper Held monthly half-day planning sessions Developed formal charter Identified best practices and training materials Designed website Developed operating procedures Planned and executed communication and marketing efforts

15 Ongoing Efforts Monthly meetings to share information and plan new activities Website content enhancement Mail list activity Consulting & training engagements Promotion

16 Strategies for Success Support of Commonwealth of Virginia’s IT agency Support of partner institutions’ executives Long history of collaboration among partners Linkage of security research and practice in the field We’re filling a critical need

17 Strategies for Success Our principles: We teach and guide clients to develop and maintain strong security programs We base offerings on state and federal standards Offerings balance security risks with other organizational priorities. We promote security being integrated into everything an organization does. We use research to keep offerings on the cutting edge. Cooperation among Alliance members transcends competition.

18 Benefits Darlene Quackenbush Information Security Officer and Director of Information Technology Planning James Madison University

19 Benefits Saves time and improves quality during program development

20 Benefits Saves time and improves quality during program development Reduces security training costs

21 Benefits Saves time and improves quality during program development Reduces security training costs Helps avoid costs associated with security breaches

22 Benefits Saves time and improves quality during program development Reduces security training costs Helps avoid costs associated with security breaches Greater influence and economies of scale

23 Benefits Saves time and improves quality during program development Reduces security training costs Helps avoid costs associated with security breaches Greater influence and economies of scale BUILDING RELATIONSHIPS that let us fight back more effectively!

24 Governor’s Technology Award Winner September 22, 2003

25 Wayne Donald, Virginia Tech Cathy Hubbs, George Mason University Shirley Payne, University of Virginia Darlene Quackenbush, James Madison University