Email is not secure Email is not secure.

Gary Scott Senior Business Systems Developer Administrative & Residential Information Technology I’m Gary Scott, a senior business systems developer in ARIT. I’ve been at UCSB for over 4 years, but my real claim to fame is 13 years at Santa Barbara Bank & Trust. There I worked in software development and information security. Banks have to be secure, by law. I’ve learned a thing or two during my time there.

The Cloud This is the cloud in all its awesome glory.

The Cloud But really it is a dark and gloomy place.

Full of lions and bears. Surprisingly... no tigers.

Here is the cloud again. I’m going to walk you thru how many web apps operate including several here at UCSB. The customer is up there on the left and our servers are down there on the right. A big dark cloud in between.

Customers want to communicate with us thru this dark scary cloud.

But we can use encryption to keep that conversation safe But we can use encryption to keep that conversation safe! They send us private information and no one can see it. We protect their privacy.

The web app stores that private information but then creates an email with that same information.

Then sends it to the customer.

In the clear as plain text.

For any big-eyed dude in the cloud to see.

Those dudes could be gangstas Those dudes could be gangstas. We don’t know what nefarious purpose these folks have for that data. Probably identity theft, maybe social engineering. Anyways, they should not have it! So all the data we protected by the secured web connection was just compromised by sending it back out in an unencrypted email. Why did we even bother putting encryption on the site in the first place. Well at least we protected their password, so we have have that going for us.

University of California, Office of the President Office of Ethics, Compliance and Audit Services has a page: Privacy principles & practices at UC at this url: http://www.ucop.edu/ethics-compliance-audit-services/compliance/privacy/ with ... UCOP office of ethics, compliance, and audit services has a web page titled, “Privacy principles and practices at UC” which contains....

RULES OF CONDUCT FOR UNIVERSITY EMPLOYEES INVOLVED WITH INFORMATION REGARDING INDIVIDUALS A. Employees responsible for the collection, maintenance, use, and dissemination of information about individuals which relates to their personal life, including their employment and medical history, financial transactions, marital status and dependents, shall comply with the provisions of the State of California Information Practices Act. B. Employees shall not require individuals to disclose personal or confidential information about themselves which is not necessary and relevant to the purposes of the University or to the particular function for which the employee is responsible. C. Employees shall make every reasonable effort to see that inquiries and requests by individuals for their personal or confidential records are responded to quickly, courteously, and without requiring the requester to repeat the inquiry to others unnecessarily. D. Employees shall assist individuals who seek information pertaining to themselves in making their inquiries sufficiently specific and descriptive so as to facilitate locating the records. E. Employees shall not disclose personal or confidential information relating to individuals to unauthorized persons or entities. The intentional disclosure of such information to such persons or agencies may be cause for disciplinary action. F. Employees shall not seek out or use personal or confidential information relating to others for their own interest or advantage. The intentional violation of this rule may be cause for disciplinary action. G. Employees responsible for the maintenance of personal and confidential records shall take all necessary precautions to assure that proper administrative, technical, and physical safeguards are established and followed in order to protect the confidentiality of records containing personal or confidential information. Rules of conduct for university employees involved with information regarding individuals. There are three sections I want to point out to you.

A. Employees responsible for the collection, maintenance, use, and dissemination of information about individuals which relates to their personal life, including their employment and medical history, financial transactions, marital status and dependents, shall comply with the provisions of the State of California Information Practices Act. Reference (State of California Information Practices Act): https://leginfo.legislature.ca.gov/faces/codes_displayexpandedbranch.xhtml?tocC ode=CIV&division=3.&title=1.8.&part=4.&chapter=1. Section A. Lists out some types of data. There is the reference to the law, I looked it up.

E. Employees shall not disclose personal or confidential information relating to individuals to unauthorized persons or entities. The intentional disclosure of such information to such persons or agencies may be cause for disciplinary action. Section E. We know that email is sent in the clear, or at least you know now. We don’t know who is intercepting that email. I say sending an email with personal information is intentional disclosure.

G. Employees responsible for the maintenance of personal and confidential records shall take all necessary precautions to assure that proper administrative, technical, and physical safeguards are established and followed in order to protect the confidentiality of records containing personal or confidential information. Section G speaks to me as an IT professional. I don’t want to take business requirements that say to send personal info in an email.

What can you do? Review each system that sends email. Identify the systems that send personal information. Craft generic confirmation emails “Thank you for submitting XYZ”. Update those systems to send the new email copy. Action items!

B. Employees shall not require individuals to disclose personal or confidential information about themselves which is not necessary and relevant to the purposes of the University or to the particular function for which the employee is responsible. I also want to point out section B. Think about the information you ask for. Don’t collect it if you don’t need. If we don't have it, we can't lose it.

Thank You There is no cloud. It’s just someone else’s computer. Thank you!