Data Security Threats for School Districts. WASBO March 24, 2016

Transcription

1 Data Security Threats for School Districts WASBO March 24, 2016

2 Data Security Everyone is at Risk Threat Environment Attack Vectors Protecting Credentials Overall Data Security Best Practices

3 Data Security Risks Variety of data security threats Physical lost laptops and mobile devices Administrative rogue employees, careless staff Technical viruses, phishing, malware Breaches are a matter of time not if but when Breach targets not just big companies public sector had most security incidents

4 What is Protected Data? Personally Identifiable Information ( PII ) RCW data breach notification statute PII = person s first name / initial + last name + SSN Driver s license number / WA ID card number Credit card number with PIN, access code, password, etc. HB 1078 signed by Governor on April 23, 2015 encryption of data removed as blanket safe harbor but if data was encrypted and keys were not taken during breach event, no obligation to notify Notice is not required if the breach of the security of the system is not reasonably likely to subject consumers to a risk of harm RCW breach notice requirement defined for state agencies

5 What is Protected Data? Protected Health Information ( PHI ) HIPAA Health Insurance Portability and Accountability Act of 1996 PHI defined as Individual identifiers(name, address, DOB, SSN) from which there is a reasonable basis to believe a specific individual can be identified plus: Individual s past, present or future physical or mental health or condition Provision of health care to the individual Past, present or future payment for health care for the individual Covers Health Care Providers and Business Associates

6 Data Security Costs Data breach / loss costs Forensic Identifying scope of loss Tracking down and closing the point of attack Repairing systems Notification Regulatory agencies Individual data subjects Credit monitoring / repair services Crisis management / PR Damaged reputation Regulatory notification and defense Legal

7 Data Security Risks Who is Doing This? Outside actors roughly 80% of all attacks Organized crime financial info, credit cards State-sponsored trade secrets, credentials Activists personal info, organizational data Internal threats Disgruntled employees Employee negligence Lost laptops Shared credentials Business partners

8 Data Security Risks How Do They Get In? External attacks Stolen credentials Weak link poor password quality Phishing The inevitability of the click and launching malware Internal breaches Credential sharing

9 Stolen Credentials Password Quality Most commonly used passwords password qwerty football 1234 User frustration: I have too many passwords to remember! Re-use across multiple platforms

10 Improving Password Quality What can we do? Require some combination of letters, numbers and symbols Require changing passwords periodically Ensure that passwords aren t written down where anyone can find them

11 Improving Password Quality Tips for an unusual but memorable password Line from movie use first letter of each word Gentlemen, you can t fight in here, this is the War Room! = GycfihtitWR!

12 Improving Password Quality Shall we play a game? = Swpag?

13 Improving Password Quality Other Suggestions Song Titles / Lyrics Famous Speeches I have a dream Only thing we have to fear To be or not to be Stay Away From Childrens or spouse s names Widely known hobbies or interests District / school specific sayings or slogans

14 Phishing & Malware spoofs legitimate company Spear Phishing is specifically geared towards the recipient The inevitability of a click 23% of recipients open phishing messages 11% click on attachments Campaign of just 10 s has > 90% chance that one person will ultimately click on the link Phishing has evolved now often involves installation of malware as second stage

15 Phishing & Malware Issue directly impacts educational sector Verizon 2015 Data Breach Investigations Report Looked at thousands of malware events Data from FireEye, Palo Alto Networks, Lastline, Fortinet Average malware events per week: Financial Services 350 Insurance 575 Retail 801 Utilities 772 Education 2,332

16 Phishing & Malware Educating users and staff is critical Knowing what to look for Urgency of the communication Request to revise personal / login information Threat of potential adverse consequences if the information is not revised or updated immediately Actions Delete the Open a new browser window and check with the actual holder of the account referenced

17 Credential Sharing A not uncommon practice Risks of misuse are extremely high Potential harms include Unauthorized access to PII or PHI Need for notification Time-consuming investigation and removal of computer systems Reputational harm and loss of parent confidence

18 Overall Data Security Best Practices Center for Internet Security Critical Security Controls for Effective Cyber Defense Inventory of authorized devices and software Secure configurations for local, networked and mobile devices Continuous vulnerability assessment and remediation Controlled use of administrative privileges Maintenance, monitoring and analysis of audit logs and web browser protections Malware defenses Limitation and control of network ports, protocols and services Data recovery capability

19 Overall Data Security Best Practices Center for Internet Security Critical Security Controls for Effective Cyber Defense Secure configurations for network devices Boundary defense - physical safeguards of network Data protection Controlled access on need-to-know basis Wireless access control Account monitoring and control Security skills assessment and training Application software security Incident response and management Penetration tests and red team exercises

20 Implementing Data Security Best Practices Perform an initial gap assessment What steps have already been implemented and what elements are missing? Develop an implementation roadmap What controls need to be implemented, and who will have implementation responsibility? Implement the first phase of controls Which existing tools can be utilized or repurposed, and what needs to be added? Integrate controls into operations How can new methods be incorporated into existing operations? Report and manage progress At each phase of implementation, ascertain effectiveness

21 Cyber Insurance Coverage Issues Insurance Law Update April 24, 2015 Questions & Discussion