UW System Information Security Brief to Information Technology Management Council Katherine Mayer 15 October 2018

Linkages Administrative Excellence Commitment to Operational Reform and Excellence (CORE): Operational excellence through the transparent standardization, consolidation and streamlining of non-instructional operations where it makes sense

Digital Strategy - Goals Establish a unifying strategic layer to enable 2020FWD in an increasingly digitally-enabled world Provide direction for future digital investments and roadmaps Clarify decision-making authority, scope, and process for digital initiatives Mission 2020FWD Digital Strategy Governance Implementation Why are we here? Where should we put our focus? What are the opportunities? Who has influence and who decides? How do we get there?

Standardized Security Capabilities IS Risk-Based Decision Making Information Security (IS) Strategic Priorities Enterprise Approaches Standardized Security Capabilities Define roles, responsibilities, integration and actions to protect UWS networks in a unified manner Expand collaboration and partnerships Balance prescription with individual institution capability deployment Reduce/eliminate duplication Focus on high priority IS actions Standardized Security Capabilities Enterprise Approaches Workforce Resiliency IS Awareness IS Risk-Based Decision Making Leadership Outreach Communications clarity Define/refine governance structure(s) Leverage/align IS risk focus with ERM IS Risk-Based Decision Making IS Awareness

Workforce Resiliency HDLD High Demand Low Density Employment of IT professionals expected to grow 28% from 2016-2026* Can only fill 1/3 of IT jobs with current IT grads* By 2024, 4.4M unfilled IT jobs* Digital transformation rests on talent development Competitive advantage demands life long learning Soft skills gain prominence amid intelligent machines Human Capital Focus * Bureau of Labor Statistics

Enterprise Investment for Blocking and Tackling Advanced Malware Protection (AMP) Prevention, detection and response to threats at the endpoints CloudLock Detection of cloud data breaches and malware Umbrella Stops phishing and malware earlier (before endpoints) StealthWatch Deep visibility across the network (normal v. anomalous) Piloting an incentive-based enterprise funding model

Additional System-wide Efforts Underway Multi-factor authentication implementation General Data Protection Regulation Assessment (GDPR) complete Cyber liability insurance renewal Assisting institutions with policy implementation Building out an information security team Refining governance structures Dissolution of the Information Assurance Council (IAC) Redefining Technology and Information Security Council (TISC)

What’s Next? Continued Cisco deployments throughout UW System Develop a risk management assessment process focused on information security risk Develop cyber security metrics for reporting to leadership in partnership with Madison Incorporate specific GDPR assessment recommendations into IS work plan Policy development and vetting Existing policy updates Data privacy Asset management Network protection Security monitoring Human capital development

Questions?