1 / 28

Information Security Awareness Briefing

Information Security Awareness Briefing. Why are you here today?. University’s Information Security Policy and new UAS Information Security Policy Your Head of Department is responsible for information security within your department or section

hien
Download Presentation

Information Security Awareness Briefing

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. InformationSecurity Awareness Briefing

  2. Why are you here today? • University’s Information Security Policy and new UAS Information Security Policy • Your Head of Department is responsible for information security within your department or section • Part of this is to ensure all your staff are made aware of their individual responsibilities for information security • The new online Information Security Awareness module - mandatory for UAS staff - will help you with this

  3. Agenda (14:30 - 15:30) • Risk Management - University and national perspective • Information Security - Departmental obligations • Information Security Awareness Programme • Online awareness module for staff • Questions

  4. Information Security website www.it.ox.ac.uk/infosec/ Information Security Toolkitwww.it.ox.ac.uk/infosec/istoolkit/ Lunchtime courseswww.it.ox.ac.uk/infosec/protectyourself/courses/ Q&As (about Online Awareness Module)www.it.ox.ac.uk/infosec/awareness/ Online Awareness Modulewww.it.ox.ac.uk/infosec/module/ Contact InfoSec teaminfosec@it.ox.ac.uk

  5. Risk Management University and national perspective

  6. University Strategic Risk Register (Nov12 - Health Warning) • Risk: • Failure to ensure security of people, property, and information • Consequences: • Damage to operations, financial loss • Measures: • Strategic assessment of threat. • Appropriate security arrangements • Action: • Review of …oversight arrangements

  7. Risk threat (IT Services Strategic Risk Register) If IT Services does not ensure that its information assets are managed correctly and securely - then - there is a possibility of information loss and corruption - resulting in a risk of - damage to reputation and the possibility of criminal or civil proceedings

  8. UUK Cyber Security Policy Briefing, Jul 12 “Given the importance of universities to the UK economy and to economic prosperity in general, it is essential to increase the level of awareness of, and resilience to, cyber threat in the sector.” “Cyber security can all too often be thought of as an IT issue, rather than a strategic risk management issue.” The cyber threats facing universities today will not be solved through investment in technology alone, but through concerted risk assessment which results in: universities identifying which critical information assets need to be prioritised for protection; and the establishment of a cyber risk oversight structure at senior level.”

  9. Real life stories (1) • A laptop stolen from office • A research project was (temporarily) closed down because laptop wasn’t encrypted having severe operational and financial implications CPNI www.cpni.gov.uk/Security-Planning/Staff-training-and-communications/posters/

  10. Real life stories (2) • Encrypted laptops stolen from lab HEISC on Facebook www.facebook.com/VideoPosterContest

  11. Real life stories (3) • Social media hacked! • Over-sharing on social media

  12. Real life stories (4) • Phishing attacks • Users who weren’t aware of their responsibilities for maintaining access to data were adversely affected when the University temporarily blocked Google Docs. HEISC on Facebook www.facebook.com/VideoPosterContest

  13. Real life stories (5) • Phishing attacks • Cryptolockerransomware, malware that effectively destroys documents by encrypting them and demanding a ransom to unencrypt them. CPNI www.cpni.gov.uk/Security-Planning/Staff-training-and-communications/posters/

  14. Real life stories (6) • Shared computing room • Keystroke-logging incident Images: JISC http://www.flickr.com/photos/jiscimages/435085112 and https://en.wikipedia.org/wiki/File:Keylogger-hardware-PS2-example-connected.jpg

  15. Information Security Your obligations

  16. Incident Register

  17. Your obligations Policies: • University’s Information Security Policy • UAS Information Security Policy Departmental obligations include: • an Information Security policy owned by head of section • train staff Help is available from the Information Security team!

  18. Information Security (IS)Awareness Programme

  19. Information Security (IS) Awareness Programme ‘The cyber threats facing universities today will not be solved through investment in technology alone’ (Universities UK) • Creating right culture and providing training is most important activity • The Information Security Team is therefore working on an Awareness Programme

  20. Information Security (IS) Awareness Programme www.it.ox.ac.uk/infosec/ YOU ARE THE TARGET! 7 Nov, 11 Dec and next term

  21. Online Information Security Awareness Module

  22. Online Information Awareness Module • Mandatory for each member of UAS to take part in by 15 March 2014 • Designed in collaboration with five Universities and customised by InfoSec team (including testing) • Highlights important considerations and information security risk • Offers a mixture of information, supporting resources and case studies • Takes approximately 45 minutes to complete and can be done in several ‘sittings’ • Login via Single-Sign-On required

  23. Online Information Awareness Module www.it.ox.ac.uk/infosec/module/

  24. Online Information Awareness Module Sections, and how long it will take to complete www.it.ox.ac.uk/infosec/module/

  25. Online Information Awareness Module www.it.ox.ac.uk/infosec/module/

  26. How UAS staff will be informed • On <date> each member of UAS will receive an email invitation to take the online information security awareness module • Awareness posters will be spread across your offices • Email reminders will be circulated Most importantly: we need your help to ensure that each member of your department completes the online awareness module!

  27. Your questions answered All UAS staff MUST take the IS Awareness Module • What if anyone refuses? • All temporary staff MUST do this? • All consulting / intern staff MUST do this? • All new staff MUST do this? • Will this module be registered against their contract of employment? UAS staff SHOULD attend IS courses in IT Services • UAS staff SHOULD attend the course "You Are The Target!" • Will IT Services repeat this course if it is oversubscribed? Information Security is an issue for the whole University • Why is the University raising awareness about Information Security? • Who cares who has completed the module? • How can IT Services check that someone has completed this? • Who is going to follow up this activity, next academic year? • Who will keep the module up-to-date? • What about the module outside of UAS?

  28. Information Security website www.it.ox.ac.uk/infosec/ Information Security Toolkitwww.it.ox.ac.uk/infosec/istoolkit/ Lunchtime courseswww.it.ox.ac.uk/infosec/protectyourself/courses/ Q&As (about Online Awareness Module)www.it.ox.ac.uk/infosec/awareness/ Online Awareness Modulewww.it.ox.ac.uk/infosec/module/ Contact InfoSec teaminfosec@it.ox.ac.uk

More Related