Information Security Awareness Briefing 5 November 2013

Why are you here today? Slide 2  University’s Information Security Policy and new UAS Information Security Policy  Your Head of Department is responsible for information security within your department or section  Part of this is to ensure all your staff are made aware of their individual responsibilities for information security  The new online Information Security Awareness module - mandatory for UAS staff - will help you with this

Agenda (14: :30) Slide 3  Risk Management - University and national perspective  Information Security - Departmental obligations  Information Security Awareness Programme  Online awareness module for staff  Questions

Slide 4 Information Security Toolkit Lunchtime courses Q&As (about Online Awareness Module) Online Awareness Module Contact InfoSec team Information Security website

Slide 5 Risk Management University and national perspective

University Strategic Risk Register (Nov12 - Health Warning) Slide 6 Risk: Failure to ensure security of people, property, and information Consequences: Damage to operations, financial loss Measures: Strategic assessment of threat. Appropriate security arrangements Action: Review of …oversight arrangements

Risk threat (IT Services Strategic Risk Register) Slide 7 If IT Services does not ensure that its information assets are managed correctly and securely - then - there is a possibility of information loss and corruption - resulting in a risk of - damage to reputation and the possibility of criminal or civil proceedings

UUK Cyber Security Policy Briefing, Jul 12 Slide 8 “Given the importance of universities to the UK economy and to economic prosperity in general, it is essential to increase the level of awareness of, and resilience to, cyber threat in the sector.” “Cyber security can all too often be thought of as an IT issue, rather than a strategic risk management issue.” The cyber threats facing universities today will not be solved through investment in technology alone, but through concerted risk assessment which results in: universities identifying which critical information assets need to be prioritised for protection; and the establishment of a cyber risk oversight structure at senior level.”

Real life stories (1) Slide 9  A laptop stolen from office  A research project was (temporarily) closed down because laptop wasn’t encrypted having severe operational and financial implications CPNI

Real life stories (2) Slide 10  Encrypted laptops stolen from lab HEISC on Facebook

Real life stories (3) Slide 11  Social media hacked!  Over-sharing on social media

Real life stories (4) Slide 12  Phishing attacks  Users who weren’t aware of their responsibilities for maintaining access to data were adversely affected when the University temporarily blocked Google Docs. HEISC on Facebook

Real life stories (5) Slide 13  Phishing attacks  Cryptolocker ransomware, malware that effectively destroys documents by encrypting them and demanding a ransom to unencrypt them. CPNI

Real life stories (6) Slide 14  Shared computing room  Keystroke- logging incident Images: JISC and

Slide 15 Information Security Your obligations

Incident Register

Your obligations Slide 17 Policies:  University’s Information Security Policy  UAS Information Security Policy Departmental obligations include:  an Information Security policy owned by head of section  train staff Help is available from the Information Security team!

Slide 18 Information Security (IS) Awareness Programme

Slide 19 ‘ The cyber threats facing universities today will not be solved through investment in technology alone’ (Universities UK)  Creating right culture and providing training is most important activity  The Information Security Team is therefore working on an Awareness Programme

Information Security (IS) Awareness Programme Slide 20 YOU ARE THE TARGET! 7 Nov, 11 Dec and next term

Slide 21 Online Information Security Awareness Module

Online Information Awareness Module Slide 22  Mandatory for each member of UAS to take part in by 15 March 2014  Designed in collaboration with five Universities and customised by InfoSec team (including testing)  Highlights important considerations and information security risk  Offers a mixture of information, supporting resources and case studies  Takes approximately 45 minutes to complete and can be done in several ‘sittings’  Login via Single-Sign-On required

Online Information Awareness Module Slide 23

Online Information Awareness Module Slide 24 Sections, and how long it will take to complete

Online Information Awareness Module Slide 25

How UAS staff will be informed Slide 26  On each member of UAS will receive an invitation to take the online information security awareness module  Awareness posters will be spread across your offices  reminders will be circulated Most importantly: we need your help to ensure that each member of your department completes the online awareness module!

Your questions answered Slide 27 All UAS staff MUST take the IS Awareness Module  What if anyone refuses?  All temporary staff MUST do this?  All consulting / intern staff MUST do this?  All new staff MUST do this?  Will this module be registered against their contract of employment? UAS staff SHOULD attend IS courses in IT Services  UAS staff SHOULD attend the course "You Are The Target!"  Will IT Services repeat this course if it is oversubscribed? Information Security is an issue for the whole University  Why is the University raising awareness about Information Security?  Who cares who has completed the module?  How can IT Services check that someone has completed this?  Who is going to follow up this activity, next academic year?  Who will keep the module up-to-date?  What about the module outside of UAS?

Slide 28 Information Security Toolkit Lunchtime courses Q&As (about Online Awareness Module) Online Awareness Module Contact InfoSec team Information Security website