ISE Northeast Executive Forum and Awards

Size: px

Start display at page:

Download "ISE Northeast Executive Forum and Awards"

Oswald Freeman
8 years ago
Views:

1 ISE Northeast Executive Forum and Awards October 3, 2013 Company Name: Project Name: Presenter: Presenter Title: University of Massachusetts Embracing a Security First Approach Larry Wilson Chief Information Security Officer ISE Northeast Executive Forum and Awards 2013 #ISEnortheast

2 University of Massachusetts Providing High Quality Education for 140 Years 2013 World University Ratings: 42 nd of Top 100 Universities 5 Campuses + Systems Office 72,000 Students 17,500 Faculty & Staff UMass Online Degree & Certificate Programs ISE Northeast Executive Forum and Awards 2013 #ISEnortheast 2

3 Our Security-first approach What s at Stake UMASS Security Program Goals UMASS Security Program Design UMASS Security Program Implementation Roadmap UMASS Security Program Operations Center Summary of Results Lessons Learned / Best Practices ISE Northeast Executive Forum and Awards 2013 #ISEnortheast 3

4 What s at Stake The University Environment Threats: Ever changing threat landscape consisting of internal and external threats. Vulnerabilities: Complex / unstructured / decentralized administrative and academic computing and communications environment across 5 independent campuses and systems office. High Value Assets: Intellectual property, research data, student records, employee records, financial data, alumni donations, health records, credit cards. The Challenge The Controls: Design, acquire, implement, maintain and operate a comprehensive set of security controls that safeguard university computing resources and information assets. ISE Northeast Executive Forum and Awards 2013 #ISEnortheast 4

5 UMASS Security Program Goals 1. Develop university-wide security framework and strategic programs. 2. Align with industry best practices [ISO 27002, SANS 20 Critical Security Controls]. 3. Manage security throughout its lifecycle by integrating into normal operations. 4. Invest in resources (staffing, training), and technology to implement and manage the security controls. 5. Develop an implementation roadmap inclusive of all campuses and departments. 6. Develop a comprehensive communication program to increase stakeholder awareness. ISE Northeast Executive Forum and Awards 2013 #ISEnortheast 5

6 UMASS Security Program Design UMass Information Security Program Management & Communications General Computer Controls (GCCs) Cyber-security Controls People Focus Risk Management Policy / Program Marketing & Communications Awareness Training Process Focus Secure Applications IT Operations Access Controls Records Retention Technology Focus SANS 20 Critical Security Controls ISO Foundation SANS 20 Critical Security Controls Policy, Legal, and Regulatory Framework (UMass Security Policy, WISP, Mass Privacy, PCI, SOX, HIPAA, FERPA, ) ISE Northeast Executive Forum and Awards 2013 #ISEnortheast 6

7 UMASS Security Program Implementation Roadmap Phase 1 Phase 2 Phase 3 Phase 4 Planning & Approval Design & Resources Implement & Operate Assurance & Metrics Security Capability Initiate stakeholder program Policy, Plan, Controls, Governance Design Security Programs & Controls Assign Program Resources Purchase Cyber-security Technologies Implement & Manage Program Controls Conduct Campus Risk Assessments Document Program Status & Reports Program Evolution ISE Northeast Executive Forum and Awards 2013 #ISEnortheast 7

8 UMASS Security Program Operations Center Input Output Incident Response Team Help Desk Information Security Operations Center (ISOC) Work Requests, Tickets, Audit Findings (Build, Buy, Outsource, Cloud) Advisories & Incidents CSIRT IT Operations Scan, Monitor, Filter, Contain Data Breaches Management Team Intelligence Feeds Zero-day Threats, Zero-day Vulnerabilities Alerts, Metrics & Reports ISE Northeast Executive Forum and Awards 2013 #ISEnortheast 8

9 Summary of Results 2012 Accomplishments Established security program and deliverables based on SANS Controls Conducted university-wide gap assessment to determine current state of compliance Developed budget, timeline, resources, campus implementation plans Established university-wide governance team and project teams 2013 Accomplishments Established Phase 1 Implementation Plan based on quick wins and maximum impact Purchased technology (as needed) and implemented Phase 1 SANS controls Developed management reporting to track implementation and compliance Established Phase 2 (2014) Implementation Plans ISE Northeast Executive Forum and Awards 2013 #ISEnortheast 9

10 Lessons Learned / Best Practices Start with the Design: Get management buy-in including budget, resources and timelines. Implement in Phases: Quick wins, maximum impact need success stories! Communicate Often: Monthly implementation and compliance reports. Work with Partners: Including SANS, vendors / service providers to improve technology and service offerings information security is a team sport! ISE Northeast Executive Forum and Awards 2013 #ISEnortheast 10

Designing & Building an Information Security Program. To protect our critical assets

Designing & Building an Information Security Program To protect our critical assets Larry Wilson Version 1.0 March, 2014 Instructor Biography Larry Wilson is responsible for developing, implementing and