Out of the Breach and Into the Fire

Information security hinges on the people and procedures, not the technical settings.

Breach Commonalities and Distinctions Data Inventory Handling of PII and sensitive data moving forward Discovery of breach Number of compromised records Parties involved Notification

Notification Decision-making Arizona Georgetown UISO CIO University Counsel UISO Ad hoc committee

Notification Logistics Arizona Georgetown “unauthorized acquisition of and access to unencrypted or unredacted computerized data that materially compromises the security or confidentiality of personal information maintained by a person as part of a database of personal information regarding multiple individuals and that causes or is reasonably likely to cause substantial economic loss to an individual” Call Center Hotline in Office of Advancement Offered credit monitoring for one year

Fallout Management Arizona Georgetown Server Reduction and Consolidation Personnel Changes Creation of DSTF Data Inventory Policies Data Stewardship model Reporting Centers

Preventative Measures Arizona Georgetown Education Policies Procedures Personal Information Sweep (PI Sweep) Registration of Critical Devices Firewalls Web App and Network Scanning Community Education Stronger Policy Enforcement Enhanced Oversight Structure PI Sweep: Removal of data, secure what’s left, educate about records retention and so forth. See security.arizona.edu/pi for more Information. Firewall are central Cisco FSM – no cost to department.

Challenging the Status Quo Dynamic security environment Review of existing policies, practices and procedures Audit of data flow and security