mandatory online training

1. mandatory online training

2. intro • why we are doing this • why you should care • what we hope you get out of this

3. How does info sec affect me? • need to understand the info sec policy • need to follow safe data handling practices, including disposal • need to practice safe computing

4. What Information Security is • definition • examples

5. University Information Security policy • Summarize policy • what covered • who covered • define principles

6. University Information • University Data - Data created or maintained by the University related to carrying out the University's mission. It’s a University resources, owned by the University. • Exclusions – Research data, class notes, lesson plans, personal papers, materials covered in the University’s Intellectual Property Policy

7. defined roles in policy • cio • data oversight • data steward • university community (faculty, staff, students) • info sec department • Univ archives • audit and advistory • procurement

8. Data Steward • An individual who is responsible for ensuring the confidentiality, integrity, and availability of University information. A Data Steward defines access to and restrictions on use of the information for which he or she is responsible. • A data steward also: • Ensures the confidentiality, integrity and availability of University data • Classifies all University information as Public, Internal, Sensitive, or Highly Sensitive, according to Data Classification Guidelines

9. who are the data stewards? • do we list them?

10. Univ community • Protect the privacy and security of University information, applications, computer systems, and networks under their control • Adhere to all relevant data handling standards • Report suspected violations of this policy to the Director of Information Security or to the appropriate Data Steward

11. Categorization of University data • Determined by the degree of expected impact on the University or individuals if University information is mishandled.

12. Categories of University Data • Public • Internal • Sensitive • Highly sensitive

13. Data category: Public • Information intended for public use that, when used as intended and not altered, would have no adverse impact on University operations, University assets, or individuals.

14. examples of public data • PR releases

15. Data category: Internal • Information not intended for parties outside the University community that, if disclosed, would have minimal or no adverse impact on University operations, University assets or individuals.

16. examples of Internal data • directory info?

17. Data category: Sensitive • Information that, if mishandled, could be expected to have a serious adverse effect on University operations, University assets or individuals.

18. examples of restricted data

19. Data category: Highly sensitive • Information that, if mishandled, could be expected to have a severe or catastrophic adverse effect on University operations, University assets or individuals.

20. examples of highly sensitive data

21. interaction • sorting data by types?

22. Enforcement of info sec policy • The University will investigate suspected violations, and may recommend disciplinary action in accordance with University codes of conduct, policies, or applicable laws. Sanctions may include one or more of the following: • Suspension or termination of access • Disciplinary action up to and including termination of employment • Student discipline in accordance with applicable University policy • Civil or criminal penalties

23. Transition? • how do we move from Info sec policy to rest of topics?

24. Data Handling Standards • Get permission from data steward for access • Use and share info with others only according to standards

25. Safe data handling (could be interactive—choose correct answers) • Secure handling procedures: • Lock screen when leaving computer • Turn monitor from door • Keep hard copies locked in desk when not in use • Lock your office door when leaving room • Never leave hard copies in printer/copier • Store electronic files in Netfile

26. Disposal methods • Data/information • Shred paper copies • Use spy-bot to electronically shred files • Technology • clean hard drives before disposal

27. Safe computing • Includes using tools such as • TakeCharge • virus protection • anti-spyware • Use SENF to find files containing sensitive data • laptop encryption • Safe Web surfing • all your precautions can be undone by visiting the wrong site

28. Myths about security • No one wants my stuff • A little surfing hurts no one • The University/OIT is protecting me

29. Points to remember • Information Security is an ever evolving responsibility • policies are being developed and implemented over time

30. Want more info? • secure.nd.edu • reporting violations

31. my points • Missing: • secure work space

32. presentation issues • travel theme • road signs (caution signs, stop signs, billboards, street signs, etc.) • could use roadmap (sorry!) to mark progression through course • interactions • click to advance to next slide? • questions interspersed with text? • how often? • does wrong answer send them back or just get right answer told to them? • Matching? Multiple choice? • do we keep score?

33. More issues • length • this covers topics chosen but seems way too long • any ideas on what to cut, if anything? • adverse effects maybe? • ideas on focus of subsequent training?