1. Presentation to the COIT Architecture Sub-Committee
Security Update March 2009
Jeana L. Pieralde, CISSP
DT Security and Engineering Manager

2. Overall Information Security Plan
Created a draft 5 Year Business Plan
New Draft has been submitted for review
New plan combines DT Engineering and Security Services
Identified key positions for a City-Wide Information Security Group
Actively pursuing the hiring new Security Positions
Identified Core Services
Risk Assessment
Completed Penetration and Vulnerability assessments on 4 Departments
Created a DT Computer Incident Response Team (CIRT)
Network Security
Installed Intrusion Prevention capabilities and actively monitoring network perimeter
City-Wide Policies
Reviewing CCISDA Framework and ISO best practices
Create review Policy Review committee

3. Information Security Working Group
Information Security Contact Form
14 Departments responded to initial inquiry
Re-canvassing the Departments to get a broader response
Next Steps
Compiling a list of all departmental contacts
Create the Security Working group

4. Risk Assessments City-Wide and for each Department
Current Efforts – 3 Phases
Phase 1 -Vulnerability and Penetration testing of DT and Financial departments - Completed
Phase 2 - Vulnerability and Penetration testing of Public Safety Departments – Seeking funding
Phase 3 – Determining need to test remaining departments
Resources required for Risk Mitigation can not be identified until assessments are completed

5. Create City-Wide Security Policies
City-Wide Policies and the Security Working Group
Executive Order places policy creation and initial approval with the Security Working Group
CCISDA Framework and Best Practices
Adopted as a framework in February, 2008

6. CCISDA Framework Current Status
In the process of creating the Info Sec Working Group
Waiting to compile complete list of contacts
Reviewing the Best Practices and Policies manuals
Highlighting Changes that need to be made to reflect the unique operations of the City and County of San Francisco
Mapping Policies to existing City Policies
Reviewing standard template for Policies

7. Progress Inhibitors Resources Budget Facilities
Unable to fill needed and key Security Positions
Existing resources need Security Training
Budget
Key programs do not have funding Or
Out of funding
Supplemental funding efforts have been only marginally successful
Facilities
Lack of Data Center space and power slowing system implementation