1 / 13

EDUCAUSE LIVE

EDUCAUSE LIVE. EDUCAUSE/Internet2 Computer and Network Security Task Force Update www.educause.edu/security Jack Suess January 21, 2004. Security Task Force. www.educause.edu/security/task-force.asp

sdutton
Download Presentation

EDUCAUSE LIVE

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. EDUCAUSE LIVE EDUCAUSE/Internet2 Computer and Network Security Task Force Updatewww.educause.edu/securityJack SuessJanuary 21, 2004

  2. Security Task Force www.educause.edu/security/task-force.asp The web site provides information on the task force members, activities, initiatives, and links to a number of security resources. Today I will briefly discuss a few of the initiatives underway that we hope are responding to the needs of higher education.

  3. REN-ISAC at Indiana University • Indiana’s Global NOC has a unique view of network connections among universities on Internet2 (e.g. Slammer or Nachi traffic) • The REN-ISAC has 7x24 network and security expertise on site. • They have access to DHS and the other 12 industry ISAC’s for early warning information • The REN-ISAC is working on ways to summarize and disseminate findings • Visit www.ren-isac.net

  4. Vendor Engagement • Vendor practices have a significant impact on higher education security • EDUCAUSE established the Cyber Security Forum to develop linkages with the vendor community. Members include - Microsoft, IBM, Dell, HP, Datatel, PeopleSoft, Oracle, Cisco, Apple, Sun, and SCT • Members of the task force visited Microsoft in September to explain the needs of higher education. Microsoft has been very responsive to suggestions.

  5. Legal Issues and Institutional Policies • Commissioned a white paper on higher education legal issues related to IT Security • We are working closely with other higher education groups to make security a priority throughout higher education • This fall we released the EDUCAUSE book - Computer and Network Security in Higher Education • NSF Workshop resulted in Principles to Guide Efforts to Improve Computer and Network Security in Higher Education • We continue to make connections with the federal government agencies -- NIST, DHS, and NSA regarding security • Task force is actively participating in National Cyber Security Forum task forces

  6. Risk Assessment and Tools • Risk assessment is a critical component in developing a campus IT Security Plan • We have worked with the CMU Software Engineering Institute (SEI) to learn the SEI OCTAVE risk assessment process and are working to streamline this for Higher Education • We continue to build partnerships with the auditing community. Rob Clark, Director of Internal Audit for Ga. Tech. Has joined the task force and will be leading an initiative on risk management in higher ed

  7. Research and Development Initiatives Members of the task force are participating in two R&D activities: • Ken Klingenstein of U. of Colorado and Internet2 is leading a group named Security @ Line Speed (S@LS). The purpose: How does higher education balance security and performance in advanced networks • Computer Incident and Factor Analysis Categorization (CIFAC) project led by Dr. Virginia Rezmierski of U. of Michigan is looking at incident classification.

  8. Education and Awareness Initiative • Security and awareness is consistently listed as a critical need. Less 40% of institutions have active awareness programs • Mark Bruhn of Indiana and Kelley Bogart of U. of Arizona are co-chairing our security awareness working group. • Last week we held a 1.5 day workshop to identify how to make quick progress and what to focus on for long-term needs • This working group is working closely with the National Cyber Security Summit sub-committee on Awareness • Finally, May 16-18 we will hold the 2nd Annual Security Professionals Workshop in Washington, D.C.

  9. Effective Practices Initiative • The goal of the initiative is to identify and publicize practical approaches to preventing, detecting, and responding to security problems • University security officers and supporting staff solicit, develop, and review the submitted practices. • Effective instead of best because higher education is too diverse for a one-size fits all approach that best implies. We hope to have multiple entries per topic from different institution types

  10. Effective Security Practices Guide Focus Areas Online at the www.educause.edu/security/guide Contents include • Education, Training and Awareness • Risk Analysis and Management • Security Architecture Design • Network and Host Vulnerability Assessment • Network and Host Security Implementation • Intrusion and Virus Detection • Incident Response • Encryption, Authentication & Authorization Presently we have 25 practices available

  11. Evolution of Security Practices

  12. Resources and Events Resources • www.educause.edu/security • security.internet2.edu • www.ren-isac.net Events 2nd Security Professionals Workshop May 16-18, 2004 in Washington, D.C.

More Related