Presentation to the COIT Architecture Sub-Committee Security Update March 2009 Jeana L. Pieralde, CISSP DT Security and Engineering Manager

Overall Information Security Plan Created a draft 5 Year Business Plan New Draft has been submitted for review New plan combines DT Engineering and Security Services Identified key positions for a City-Wide Information Security Group Actively pursuing the hiring new Security Positions Identified Core Services Risk Assessment Completed Penetration and Vulnerability assessments on 4 Departments Created a DT Computer Incident Response Team (CIRT) Network Security Installed Intrusion Prevention capabilities and actively monitoring network perimeter City-Wide Policies Reviewing CCISDA Framework and ISO 17799 best practices Create review Policy Review committee

Information Security Working Group Information Security Contact Form 14 Departments responded to initial inquiry Re-canvassing the Departments to get a broader response Next Steps Compiling a list of all departmental contacts Create the Security Working group

Risk Assessments City-Wide and for each Department Current Efforts – 3 Phases Phase 1 -Vulnerability and Penetration testing of DT and Financial departments - Completed Phase 2 - Vulnerability and Penetration testing of Public Safety Departments – Seeking funding Phase 3 – Determining need to test remaining departments Resources required for Risk Mitigation can not be identified until assessments are completed

Create City-Wide Security Policies City-Wide Policies and the Security Working Group Executive Order 07-09 places policy creation and initial approval with the Security Working Group CCISDA Framework and Best Practices Adopted as a framework in February, 2008

CCISDA Framework Current Status In the process of creating the Info Sec Working Group Waiting to compile complete list of contacts Reviewing the Best Practices and Policies manuals Highlighting Changes that need to be made to reflect the unique operations of the City and County of San Francisco Mapping Policies to existing City Policies Reviewing standard template for Policies

Progress Inhibitors Resources Budget Facilities Unable to fill needed and key Security Positions Existing resources need Security Training Budget Key programs do not have funding Or Out of funding Supplemental funding efforts have been only marginally successful Facilities Lack of Data Center space and power slowing system implementation