Sean Moriarty, Oswego State CTS 2016 Cyber Security Update The title for the day and for our planning process is “The Digital Campus – technology for an enhanced Tomorrow” Obviously the Tomorrow refers to Oswego’s new strategic plan. And I think there is no doubt that technology is going to play a large part in helping to achieve it. About a year ago President Stanley did a presentation where she talked about the Digitally Enhanced Campus and our need to get there. So I have used that theme for all of my presentations since then and tried to ensure that we are moving in that direction. But I think it is time to start defining what the digital campus looks like, examine how close we are to being there and set the direction on how we get there. We want your help in achieving those tasks. Sean Moriarty, Oswego State CTS 2016 Cyber Security Update Faculty Assembly - October 24, 2016

Agenda General information on Cyber security risks and campus activities Cyber Security Month activities Risks that faculty should be aware of Cloud computing

Worldwide Top Issues and risks of the Past Year Phishing Spoofing Accidental sharing of data Auto-complete in email Human error Forgetting/losing documents/laptop in the taxi or at airport security Lost mobile device Compromised accounts

2015-16 Cyber security activities Activation of Google 2 step login Defined a position and hired an Information Security Analyst New website - https://www.oswego.edu/cts/cybersecurity Member in the SUNY SOC (Security Operations Center) Encrypt hard drives of all new laptops User account reduction New user account processes; i.e. requiring alumni to annually renew their account reviewed other options to authenticate emails (SPF,DKIM)

CyberSecurity Awareness Month Weekly Topics October 3-7: Don’t Get Hooked on Phishing - Phishing Derby Contest October 10-14: Protect Your Environment October 17-21: Protect Your Mobile Devices October 24-28: Protect Your Login - Introducing Pass- Phrases You will notice additional information on campus in the form of posters, digital signage, Oswegonian ads and articles, and pamphlets.  

Tips for Faculty Change your Lakernet passwords next week when the Passphrases are available Use 2-factor authentication for your email ALWAYS have a password on your mobile device Be wary of phishing Be wary of open networks (tether to your mobile device instead and use eduroam when you are at other institutions who use it)

Cloud Computing Pros Cons Examples at Oswego New services are only available in the cloud Services are more fully featured Require different staff skillset to administer the applications Can address increased requirements more quickly (increased bandwidth for the website during emergencies) Cons Different budgeting model (CapX vs OpX) Need to develop a legal trust relationship with the vendor – there may be risk in this Examples at Oswego Gmail, Aquia Web site, Starfish, Adirondak Residence System, Maxient, CSO, Adobe Creative Cloud

Cloud Computing (cont’d) Managing Risk Dependent on the data in the cloud, need more oversight when it is Personally Identifiable Information (PII) and Confidential data Manage by Reputation/References of the vendor Legal contracts (CTO and SUNY legal approval) Auditing contracts

Cloud Computing (cont’d) Points to Consider Is there already an existing SUNY contract with this vendor? If not, does the contract need to be reviewed by the CTO office and/or SUNY legal? Should a SUNY wide contract be considered? What data will this service use? Will Personally Identifiable Information (PII) or confidential information be shared with a vendor? Are there FERPA requirements that need to be considered to protect the shared data? Does the application meet accessibility requirements? Does the vendor have the appropriate security measures in place for the data being stored and do they have audits available?

Cloud Computing (cont’d) Points to Consider Will authentication be required to utilize the service? If so, has a plan to integrate the application with the institution’s identity management system been scheduled into the project timelines? Will a data exchange project be required to obtain the service? If required, has a project been scheduled to implement the exchange? Will the application need to be customized with logo and branding? Has the proper team been created to implement these aspects of the project?

CTS Annual report Available at http://www.oswego.edu/cts Reports on our progress towards our 4 Digital Campus Strategic Goals: Students, faculty and staff thrive by seamlessly integrating technology into their teaching, learning and scholarly activities. Our community is efficient and creates value with our technical resources. Service excellence provides efficient support through robust, green and secure infrastructure and processes. Effective IT planning and governance ensure campus priorities are achieved.

Questions/Comments