1. Making Sense out of the Information Security and Privacy Alphabet Soup in terms of Data Access A pragmatic, collaborative approach to promulgating campus-wide policies to address compliance with contractual, regulatory and statutory requirements related to data integrity, security, and privacy in a heterogeneous, multi-platform IT environment at the Georgia Institute of Technology. Michael Brandon, Director Jaime Galiano, Project Director Georgia Institute of Technology Office of Information Technology – Policy & Strategy

2. © Georgia Institute of Technology, 2004 Copyright Statement Copyright Michael Brandon and Jaime M. Galiano, 2004. This work is the intellectual property of the author. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

3. © Georgia Institute of Technology, 2004 Chef’s Conundrum:

4. © Georgia Institute of Technology, 2004 Background “Recipe Starter” What? –Overhaul of existing Data Access Policy and procedures Why? –New regulatory, statutory, and contractual requirements in terms of privacy protection –Significant increase in information security threats –Minimize risk exposure associated with electronic commerce –Increasing scope and complexity of GT Information Technology infrastructure Why Now? –Contractual and legal compliance deadlines –Policy refreshment long overdue

5. © Georgia Institute of Technology, 2004 Requirements “Allspice” Legal –GLBA: FTC Safeguards Rule –HIPAA: OCR Privacy Rule –FERPA Contractual –Cardholder Information Security Program (CISP) Standards / Best Practices –ISO 17799 –GIT Internal Control Guide –Incident Response Procedures

6. © Georgia Institute of Technology, 2004 Communicating at different levels “ Appealing to the different tastes” Policy Issues Change Management Issues Implementation Strategy Safeguards Issues Implementation details – how? How much? Who?

7. © Georgia Institute of Technology, 2004 Policy Development Committee “Culinary Specialists” Representatives from –Information Security –Internal Audit –Business Office –Office of the Registrar –Human Resources –Enterprise Information Systems (Software Dev.) –Academic Units –Sponsored Programs / Research –Computer Support Representatives –Policy & Strategy –Office of Legal Affairs

8. © Georgia Institute of Technology, 2004 Summary of Activities “Cooking Instructions”

9. © Georgia Institute of Technology, 2004 Deliverables “Soup Servings” Data Classification Category 1 – Public Use Category 2 – Internal Use Category 3 – Sensitive Category 4 – Highly Sensitive Roles Chief Data Stewards Data Stewards Data Coordinators Data Administrators Authorized Requestors Technical Authorities Data Users Procedures Standardized Access Request Form –Three-way certification

10. © Georgia Institute of Technology, 2004 Deliverables “More Servings” Unit-Level Servers hosting sensitive data Deans, VP’s, Associate VP’s: Register w/ OIT IS Direct reviews and respond to technical reports for approved servers Coordinate w/OIT IS to verify security procedures Periodic access control assessments Desktops/Laptops/ Workstations User responsibility Current firewall & anti-virus software must be installed & enabled OS patches must be kept up-to-date

11. © Georgia Institute of Technology, 2004 Data Protection Safeguards “The Spice Rack” Major Safeguard Groupings –Physical Access Control –Information Security Policy –Firewall Protection –Security Patches –Protection of Stored Data –Network Data Encryption –Anti-virus Software –Access Control (need-to-know) –Unique identification (person or system) –System Configuration –Tracking Access by Unique ID –Testing of Security Systems and Processes

12. © Georgia Institute of Technology, 2004 Safeguards by Data Category “Mild or Extra Hot?” Category IV data safeguards are comprehensive and uncompromising; primarily contractual Category III data safeguards designed to meet all legal requirements in terms of “reasonable” protection Category I data mandatory requirements constitute “lowest common denominator” for protecting weakest nodes on network ^ Category = ^ Overhead

13. © Georgia Institute of Technology, 2004 High Impact Implementation Issues “ Heartburn”

14. © Georgia Institute of Technology, 2004 What did we do differently? “Chef’s Corner” Broad representation on Policy Development Committee Combined “Top-down” and “Bottom-up” approaches to policy development Extensive review of, and consensus on, all key deliverables Implementation flexibility to account for current economic and organizational constraints, while still addressing all requirements

15. © Georgia Institute of Technology, 2004 What have we learned? “Adding soup to the menu…” Critical to engage all key constituencies and stakeholders early on Inclusionary approach involves making compromises Need to have (a) clearly-defined sponsor(s) and approval process Communicate early and frequently

16. © Georgia Institute of Technology, 2004 Soup anyone? Mike Brandon Director – OIT P&S Georgia Institute of Technology mike.brandon@oit.gatech.edu Jaime Galiano Project Director – OIT P&S Georgia Institute of Technology jaime.galiano@oit.gatech.edu