Information Security Board Mission, Goals and Guiding Principles SL2

Mission Assist agency management with implementing and maintaining a sound information security program consistent with industry best practices and compliant with state policies. SL2

Goals Implement policies, procedures, and processes to ensure the information security objectives of confidentiality, integrity, and availability are met. Comply with all statewide information security policies and have best practices identified and implemented when practical. Effectively work with partners (DAS, vendors, etc.) to ensure information security objectives are met. Be proactive in identifying and mitigating risks to information as they emerge, however, when a potential breach does occur, the agency reacts immediately to investigate and take appropriate action. Raise user awareness for information security by establishing regular training and information security communications. Develop and implement metrics to track the progress of the information security program. SL2

Information Security Guiding Principles We understand that information security affects us all daily We approach information security in layers We grant access based on “least privilege” and “roles” where appropriate We are fiscally responsible We strive for simplicity over complexity We lean toward “buy” versus “build” We strive to implement best practices as appropriate We weigh the benefits of “open” over “commercial” sourced software We adopt industry “standards” where appropriate We use risk management as a tool in decision making We strive to use existing infrastructure where feasible SL2

Strategies for Goal 1 Implement policies, procedures, and processes to ensure the information security objectives of confidentiality, integrity, and availability are met. Develop information security goals and objectives. Implement policies, procedures, and processes. For example: Completed: Acceptable Use policy. Personal Use of State Resources policy. Security Breach Response Team. In Process: Data Classification policy. Information Handling Standards. Information Security Plan. Planning: Incident Response policy. SL2

Strategies for Goal 2 Comply with all statewide information security policies and have implemented best practices identified when practical. Identify statewide policies the agency must comply with. For example: ORS 646A.600 through 646A.628: Oregon Consumer Identity Theft Protection Act. ORS 192: Records; Public Reports and Meetings. ORS 182.122: State Administrative Agencies. OAR 125-800-0005 through 0020: State Information Security. DAS policy 107-004-052: Information Security. Develop suitable set of information security best practices. Deploy encryption technologies to portable computing and storage devices. Deploy endpoint management technologies to help prevent data loss. Develop information security standards and guidelines. Develop data handling standards. SL2

Strategies for Goal 3 Effectively work with partners (DAS, vendors, etc.) to ensure information security objectives are met. For example: Participate on the statewide Information Security Council. Assigned Jason Stanley and Clint Christopher. Share appropriate information with other state agencies and private organizations. SL2

Strategies for Goal 4 Be proactive in identifying and mitigating risks to information as they emerge, however, when a potential breach does occur, the agency reacts immediately to investigate and take appropriate action. For example: Develop an information security incident response team. Revise the Security Breach Incident Response process to include incident response. Develop an enterprise risk management program. SL2

Strategies for Goal 5 Raise user awareness for information security by establishing regular training and information security communications. For example: Develop articles to be published in the PERC and Espersso. Maintain an Intranet site for information security. Develop agency wide email on “hot topics.” Develop information security awareness training using iLearnOregon and other tools. SL2

Strategies for Goal 6 Develop and implement metrics to track the progress of the information security program. For example: Awareness: Do security walkthroughs for workstations “not locked” and compare with previous walkthroughs. Develop scenario based testing. Incidents: How many security breaches occurred? Prevention: How many workstations and servers have “up-to-date” patches? How many viruses have been detected? Compliance: Security findings; high, medium, low. Open versus closed. SL2