1 / 13

Creating Executive Awareness about Information Security

Creating Executive Awareness about Information Security. Joy Hughes, VP, George Mason Univ. jhughes@gmu.edu Jack Suess, VP, UMBC jack@umbc.edu EDUCAUSE ANNUAL 2005. George Mason University. 40 years old, 30,000 students, four campuses Strong deans, but centralized funding model

purity
Download Presentation

Creating Executive Awareness about Information Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Creating Executive Awareness about Information Security Joy Hughes, VP, George Mason Univ. jhughes@gmu.edu Jack Suess, VP, UMBC jack@umbc.edu EDUCAUSE ANNUAL 2005

  2. George Mason University • 40 years old, 30,000 students, four campuses • Strong deans, but centralized funding model • Computing somewhat distributed, somewhat centralized • Goal to be in top 100 w.r.t. research $ • Traditional excellence: performing arts, public policy, economics, IT. Now becoming biosciences: $25M lab; NIH cancer team • Two Nobel prize winners on faculty; yet 40% of faculty are adjuncts

  3. UMBC • 39 years old, 12,000 students, 1 campus • Research/extensive designation - focus on science, engineering, IT, and public policy • Moving from centralized to decentralized in management • Stable management team, most have been in place for 10 years.

  4. Aspects of the Culture that Influence Mason’s Security Strategies • IT staff can not order others to use certain hardware/software or to take particular security measures. • Decisions are made in a collegial manner with much opportunity for input from broad sections of the campus community. • The president is external; he can not lead without the support of the deans, faculty, Board, etc.

  5. Aspects of Culture that Influence UMBC’s Security Strategies • Collegiality - the management team is stable and works together on issues. Weekly VP’s/Deans meeting allows group to share issues. • Strong support for governance structure and governance works closely with administration • Founders are retiring, which is causing culture to change

  6. Aspects of the Political System at Mason that Influence Security Strategies • IT can not charge back for security services. • The deans are more inclined to listen to their own experts when it comes to technology rather than to IT. • The Budget Group has to be perceived as engaged in processes that are reasonably fair and strategic or it will lose legitimacy and not be able to function.

  7. Aspects of Political System at UMBC Influencing Security • Governance process makes policy approval lengthy and requires significant time from sponsoring entity • Small enough that people know each other and expect personal communication. • President has tremendous support, even after 14 years!

  8. Mason Strategies to Promote Executive Awareness Engage: • the president’s chief of staff: (he sets the Board agenda and Cabinet agenda) • the distributed SAs: (if they support what you are doing, they will let their leaders know – and vice versa) • the technology thought leaders in the academic units: (the deans listen to them) • the auditors:(they report to the Board) • the Budget Group: (duh! they have the money)

  9. UMBC Strategies to Promote Executive Awareness • Engage - around points of leverage • President - his concern is maintaining good legislative audits • Provost - his concern is academic integrity • VP of Research - regulatory compliance • My personal engagement in the formal governance process • Engage departmental IT Staff • Engage central IT staff

  10. Strategies to Promote Executive Awareness • Create Groups that will Influence Executives : a compliance team a systems administrators leadership team a group of security liaisons appointed by their deans an executive enterprise risk management group

  11. Strategies to Promote Executive Awareness • Leverage security into • Existing channels in your institution • Governance • Budget and Planning • Departmental IT liaisons • Personal Discussions with key stakeholders • Central and departmental IT

  12. What I’d Tell My Successor to Do! • Use your ex-officio status to connect with governance groups • Set up regular individual meetings with other VP’s and Deans to discuss IT and security issues before bringing them up in the VP meetings • Continue IT security working group meetings • Learn the culture before proposing new policies.

  13. Security Resources • EDUCAUSE/Internet2 Security Task Forcehttp://www.educause.edu/security • To view and/or download the video:www.educause.edu/LibraryDetailPage/666?ID=CSD4121

More Related