Public Employees Retirement System October 31, 2007 Eric Sokol, CSD Administrator Jeffrey Marecic, ISD Administrator Senate Bill 583 Implementation

2 PERS SB 583 Program Components Incident Response Plan Incident Response Plan Eliminate Sending Personal Information Eliminate Sending Personal Information Information Security Program Information Security Program Issues Issues

3 HQ 72nd SDC VPN BHS Mercer Iron Mtn CitiStreet Salem PERS Rev-Q VPN FTP/VPN FTP Manual Saber VPN Internet VPN Manual D.O.R. Treasury Employers VPN Health Care Insurance Carriers Medical Advisors PERS Business Network

4 Two Incident Response Teams Two Incident Response Teams –Executive team makes policy and response decisions. –Security Breach Response Team (SBRT) works under the direction of the Executive team and provides coordination, analysis, procedures and actions associated with suspected breaches. Other Sections of Agency Get Involved as Needed Other Sections of Agency Get Involved as Needed Incident Response Plan Notification Best Practices Checklist Greatly Assisted in Developing This Plan

5 Incident Response Plan

6 Inventoried All System Generated Correspondence Inventoried All System Generated Correspondence Completed/Nearly Completed Completed/Nearly Completed –Remove SSN Completely Where Possible –Use Last 4 Digits Where Needed –Move to PERS ID in the Long Term Relaxed Procedural Requirements that Lead to Returned Documents in the First Place Relaxed Procedural Requirements that Lead to Returned Documents in the First Place Move to Redacting SSN and Personal Information on Member Records Requests Move to Redacting SSN and Personal Information on Member Records Requests Move to Secure FTP and VPN Instead of Tapes/Disks Move to Secure FTP and VPN Instead of Tapes/Disks Eliminate Sending/Transporting Personal Information Personal Information

7 Information Security Program Information Security Message Begins at the Top Information Security Message Begins at the Top Information Security is Everyone’s Job Information Security is Everyone’s Job Information Security Board Formed Information Security Board Formed Security Awareness Training Security Awareness Training –HR and ISD Leads the Training Effort – Division Administrators Ensure Compliance

8 Information Security Program Policies and Procedures Policies and Procedures –Review and Update Data Classification Data Classification Data/Document Labeling and Handling Data/Document Labeling and Handling ‘Clean Desk’ Provisions ‘Clean Desk’ Provisions Consultant/Contractor Compliance Consultant/Contractor Compliance

9 Physical Security Physical Security –Key Card Access to All Work Areas and Sensitive Information –Limited Access to Records Management Area –Monthly Review of Access System Information Security Program

10 Data Files Data Files –Network File Structure and Access –Data in Transport (Tapes, Disks, etc.) Encrypt Encrypt Password Protect Password Protect Log Movements (senders and receivers) Log Movements (senders and receivers) –Electronic Transfer (SFTP, VPN, EDX, ) Encryption Encryption –Developer Environments Encrypted, Scrambled, Fictitious Data Encrypted, Scrambled, Fictitious Data Information Security Program

11 Backup Tapes Backup Tapes –Encrypt –Log movements Information Security Program

12 Information Security Program System Generated Reports System Generated Reports –Remove SSN Where Possible –Limit Internal Distribution to Those Who ‘Need to Know’ –Track Reports When Printed When Printed When Delivered (internally) When Delivered (internally)

13 Public Records Requests Public Records Requests –Redaction policy & procedure Information Security Program

14 Applications Applications –Remove SSN From Screens –Implement Role Based Access Control (RBAC) –Replace SSN as Account Identifier –ORION is Being Developed to Comply –RIMS will be retired Q4/2009 Information Security Program

15 Internal Audit Internal Audit –Provides Periodic Assessments of Agency Compliance to Information Security Program Information Security Program

16 ISSUES 3 rd party vendors out-of-state 3 rd party vendors out-of-state –Vendor Certifications Required? Members Sending Original Documents Members Sending Original Documents Public Records Requests Public Records Requests Member Records Requests Member Records Requests Movement of Personnel Files Movement of Personnel Files Employer Data Exchange (SSN vs Another Identifier) Employer Data Exchange (SSN vs Another Identifier)