1. Out of the Breach and Into the Fire

2. Information security hinges on the people and procedures, not the technical settings.

3. Breach Commonalities and Distinctions
Data Inventory
Handling of PII and sensitive data moving forward
Discovery of breach
Number of compromised records
Parties involved
Notification

4. Notification Decision-making
Arizona
Georgetown
UISO
CIO
University Counsel
UISO
Ad hoc committee

5. Notification Logistics
Arizona
Georgetown
“unauthorized acquisition of and access to unencrypted or unredacted computerized data that materially compromises the security or confidentiality of personal information maintained by a person as part of a database of personal information regarding multiple individuals and that causes or is reasonably likely to cause substantial economic loss to an individual”
Call Center
Hotline in Office of Advancement
Offered credit monitoring for one year

6. Fallout Management Arizona Georgetown
Server Reduction and Consolidation
Personnel Changes
Creation of DSTF
Data Inventory
Policies
Data Stewardship model
Reporting Centers

7. Preventative Measures
Arizona
Georgetown
Education
Policies
Procedures
Personal Information Sweep (PI Sweep)
Registration of Critical Devices
Firewalls
Web App and Network Scanning
Community Education
Stronger Policy Enforcement
Enhanced Oversight Structure
PI Sweep:
Removal of data, secure what’s left, educate about records retention and so forth. See security.arizona.edu/pi for more
Information.
Firewall are central Cisco FSM – no cost to department.

8. Challenging the Status Quo
Dynamic security environment
Review of existing policies, practices and procedures
Audit of data flow and security