1. INFORMATION SECURITY UPDATE Al Arboleda Chief Information Security Officer

2. Information Security Program  How did we do this year? 2014  Malware  Known Vulnerabilities/Known Threats  Security Policy Violations Copyright infringement Appropriate Use Unauthorized Network Device (wireless routers) Compromised Machine/ Spamming/botnets Loss of confidential/personal information investigations  Account Compromises

3. How did we do this year? Malware  Adware  P2P Zeus or Gameover Zeus  ZeroAccess Trojan malware  x # of Botnets used to spam other campuses  Managed machines versus unmanaged machines

4. How did we do this year? Known Vulnerabilities/ Known Threats  Heart bleed/Open SSL  Internet Explorer, Chrome, and Firefox Browser – remote access/control vulnerabilities  Windows XP

5. How did we do this year? 2014 Security Policy Violations  Copyright violations - 3  REN-ISAC compromised machine notice- 11  Loss of Confidential Data Investigations- 1

6. How did we do this year? 2014 Account Compromises  The use of stolen and/or misused credentials continues to be the source of most of our compromised accounts  Phishing emails  Users using the same passwords in multiple systems  Bronco Account compromises -25  Network Account compromises - 125

7. Malware Approach  Traditional Antivirus and Intrusion Prevention systems are not capable of blocking advance malware advanced targeted attacks that use Web-based attacks, spear phishing, and zero-day exploits  FireEye pilot mode deployment Summer 2014 Zero day signatures Ability to identify attacks with a lower false positive rate Outbound protection to stop call backs to botnets  Full deployment Fall 2014

8. Known Vulnerability/ Known Threat Approach  Antivirus software  McAfee/Intel Antivirus Software – on all managed desktops and lab computers  Patch management (Windows, Mac, Linux)  Dell Kace - on all managed desktops and lab computers  Domain Names Service (DNS) Malware protection – Evaluate solutions

9. Security Policy Violations Approach  Security Awareness Training  Data Security & Privacy  Family Education Rights and Privacy Act (FERPA)  Health Insurance Portability and Accountability Act (HIPAA)  Interim Policies  Level 1 Personal and Confidential Data  Request for Data

10. Account Compromises Approach  Password Expiration Rules  90 day - users with access to confidential data  1 year - all other users with a Bronco Account  Multi-Factor Authentication  All passwords are eventually going to be compromised  Evaluate solutions that offer a second factor to confirm identity – (Cell phone or security token)  Log Management System  Collect information from disparate systems  Evaluate solutions that will make discovery and identification of compromised accounts easier

11. Other Security Projects  Card Access System Consolidation  Multiple disparate systems  Video Camera Monitoring Consolidation  Multiple disparate systems  HIPAA IT Risk Assessment