1. Information Security Awareness Briefing 5 November 2013

2. Why are you here today? Slide 2  University’s Information Security Policy and new UAS Information Security Policy  Your Head of Department is responsible for information security within your department or section  Part of this is to ensure all your staff are made aware of their individual responsibilities for information security  The new online Information Security Awareness module - mandatory for UAS staff - will help you with this

3. Agenda (14:30 - 15:30) Slide 3  Risk Management - University and national perspective  Information Security - Departmental obligations  Information Security Awareness Programme  Online awareness module for staff  Questions

4. Slide 4 Information Security Toolkit www.it.ox.ac.uk/infosec/istoolkit/www.it.ox.ac.uk/infosec/istoolkit/ Lunchtime courses www.it.ox.ac.uk/infosec/protectyourself/courses/www.it.ox.ac.uk/infosec/protectyourself/courses/ Q&As (about Online Awareness Module) www.it.ox.ac.uk/infosec/awareness/ www.it.ox.ac.uk/infosec/awareness/ Online Awareness Module www.it.ox.ac.uk/infosec/module/ www.it.ox.ac.uk/infosec/module/ Contact InfoSec team infosec@it.ox.ac.uk infosec@it.ox.ac.uk Information Security website www.it.ox.ac.uk/infosec/ www.it.ox.ac.uk/infosec/

5. Slide 5 Risk Management University and national perspective

6. University Strategic Risk Register (Nov12 - Health Warning) Slide 6 Risk: Failure to ensure security of people, property, and information Consequences: Damage to operations, financial loss Measures: Strategic assessment of threat. Appropriate security arrangements Action: Review of …oversight arrangements

7. Risk threat (IT Services Strategic Risk Register) Slide 7 If IT Services does not ensure that its information assets are managed correctly and securely - then - there is a possibility of information loss and corruption - resulting in a risk of - damage to reputation and the possibility of criminal or civil proceedings

8. UUK Cyber Security Policy Briefing, Jul 12 Slide 8 “Given the importance of universities to the UK economy and to economic prosperity in general, it is essential to increase the level of awareness of, and resilience to, cyber threat in the sector.” “Cyber security can all too often be thought of as an IT issue, rather than a strategic risk management issue.” The cyber threats facing universities today will not be solved through investment in technology alone, but through concerted risk assessment which results in: universities identifying which critical information assets need to be prioritised for protection; and the establishment of a cyber risk oversight structure at senior level.”

9. Real life stories (1) Slide 9  A laptop stolen from office  A research project was (temporarily) closed down because laptop wasn’t encrypted having severe operational and financial implications CPNI www.cpni.gov.uk/Security-Planning/Staff-training-and-communications/posters/

10. Real life stories (2) Slide 10  Encrypted laptops stolen from lab HEISC on Facebook www.facebook.com/VideoPosterContest

11. Real life stories (3) Slide 11  Social media hacked!  Over-sharing on social media

12. Real life stories (4) Slide 12  Phishing attacks  Users who weren’t aware of their responsibilities for maintaining access to data were adversely affected when the University temporarily blocked Google Docs. HEISC on Facebook www.facebook.com/VideoPosterContest

13. Real life stories (5) Slide 13  Phishing attacks  Cryptolocker ransomware, malware that effectively destroys documents by encrypting them and demanding a ransom to unencrypt them. CPNI www.cpni.gov.uk/Security-Planning/Staff-training-and-communications/posters/

14. Real life stories (6) Slide 14  Shared computing room  Keystroke- logging incident Images: JISC http://www.flickr.com/photos/jiscimages/435085112 and https://en.wikipedia.org/wiki/File:Keylogger-hardware-PS2-example-connected.jpg

15. Slide 15 Information Security Your obligations

16. Incident Register

17. Your obligations Slide 17 Policies:  University’s Information Security Policy  UAS Information Security Policy Departmental obligations include:  an Information Security policy owned by head of section  train staff Help is available from the Information Security team!

18. Slide 18 Information Security (IS) Awareness Programme

19. Slide 19 ‘ The cyber threats facing universities today will not be solved through investment in technology alone’ (Universities UK)  Creating right culture and providing training is most important activity  The Information Security Team is therefore working on an Awareness Programme

20. Information Security (IS) Awareness Programme Slide 20 YOU ARE THE TARGET! 7 Nov, 11 Dec and next term www.it.ox.ac.uk/infosec/

21. Slide 21 Online Information Security Awareness Module

22. Online Information Awareness Module Slide 22  Mandatory for each member of UAS to take part in by 15 March 2014  Designed in collaboration with five Universities and customised by InfoSec team (including testing)  Highlights important considerations and information security risk  Offers a mixture of information, supporting resources and case studies  Takes approximately 45 minutes to complete and can be done in several ‘sittings’  Login via Single-Sign-On required

23. Online Information Awareness Module Slide 23 www.it.ox.ac.uk/infosec/module/

24. Online Information Awareness Module Slide 24 Sections, and how long it will take to complete www.it.ox.ac.uk/infosec/module/

25. Online Information Awareness Module Slide 25

26. How UAS staff will be informed Slide 26  On each member of UAS will receive an email invitation to take the online information security awareness module  Awareness posters will be spread across your offices  Email reminders will be circulated Most importantly: we need your help to ensure that each member of your department completes the online awareness module!

27. Your questions answered Slide 27 All UAS staff MUST take the IS Awareness Module  What if anyone refuses?  All temporary staff MUST do this?  All consulting / intern staff MUST do this?  All new staff MUST do this?  Will this module be registered against their contract of employment? UAS staff SHOULD attend IS courses in IT Services  UAS staff SHOULD attend the course "You Are The Target!"  Will IT Services repeat this course if it is oversubscribed? Information Security is an issue for the whole University  Why is the University raising awareness about Information Security?  Who cares who has completed the module?  How can IT Services check that someone has completed this?  Who is going to follow up this activity, next academic year?  Who will keep the module up-to-date?  What about the module outside of UAS?

28. Slide 28 Information Security Toolkit www.it.ox.ac.uk/infosec/istoolkit/www.it.ox.ac.uk/infosec/istoolkit/ Lunchtime courses www.it.ox.ac.uk/infosec/protectyourself/courses/www.it.ox.ac.uk/infosec/protectyourself/courses/ Q&As (about Online Awareness Module) www.it.ox.ac.uk/infosec/awareness/ www.it.ox.ac.uk/infosec/awareness/ Online Awareness Module www.it.ox.ac.uk/infosec/module/ www.it.ox.ac.uk/infosec/module/ Contact InfoSec team infosec@it.ox.ac.uk infosec@it.ox.ac.uk Information Security website www.it.ox.ac.uk/infosec/ www.it.ox.ac.uk/infosec/