Seven Effective Habits of a Successful ITSO Ken Hanna University of Minnesota

What we’ll cover today Assumed: A security function exists A security function exists You have the technical basics covered (policy,process,people,technology,etc) You have the technical basics covered (policy,process,people,technology,etc) You sometimes have problems getting from technical analysis to a decision You sometimes have problems getting from technical analysis to a decision

I have the technical analysis done…now what? Preliminary steps: Reality check with others inside/outside (compliance issues, expense, staff time) Reality check with others inside/outside (compliance issues, expense, staff time) Survey the landscape (who is affected, how big a change is required, etc) Survey the landscape (who is affected, how big a change is required, etc) Keep your management informed Keep your management informed

Now what? (cont’d) Collaborate with others to determine potential solutions Collaborate with others to determine potential solutions Communicate the risks and possible solutions widely Communicate the risks and possible solutions widely Build consensus on a solution or let people know the most likely solution Build consensus on a solution or let people know the most likely solution Sell your management on the need to make a change Sell your management on the need to make a change

Making change palatable If possible, make it easy to comply If possible, make it easy to comply Communicate “why” for the change Communicate “why” for the change Expect a few complaints…be diplomatic & courteous Expect a few complaints…be diplomatic & courteous Over-communicate big changes...until everyone is tired of hearing about it Over-communicate big changes...until everyone is tired of hearing about it Expect change to take longer than anticipated Expect change to take longer than anticipated

Security Decisions: Balancing usability vs complete security Don’t burn bridges if the decision doesn’t go your way Don’t burn bridges if the decision doesn’t go your way Don’t expect to get support for every decision Don’t expect to get support for every decision Educate others on the “why’s”…use the misfortune of others Educate others on the “why’s”…use the misfortune of others Be a trusted teamplayer Be a trusted teamplayer Listen to the view of others Listen to the view of others How you handle today’s issue will influence if people trust you on tomorrow’s How you handle today’s issue will influence if people trust you on tomorrow’s

Example: Windows desktop security settings The problem: High risk of Windows password cracking from the U network (XP pre- SP2 days) High risk of Windows password cracking from the U network (XP pre- SP2 days) Too many picky security changes to make from default settings Too many picky security changes to make from default settings No way for typical desktop user to know if they were at risk or compliant No way for typical desktop user to know if they were at risk or compliant Too hard to do the right thing Too hard to do the right thing

Windows Desktop (cont’d) The process: Require the settings by policy for computers that work with private data Require the settings by policy for computers that work with private data Script the 30 or so changes to the setting Script the 30 or so changes to the setting Get feedback for the proposed solution at technical and other meetings Get feedback for the proposed solution at technical and other meetings Enlist early adopters to show it works Enlist early adopters to show it works Collaborate w/auditors to use a version of the script to check settings Collaborate w/auditors to use a version of the script to check settings Sell management on why needed Sell management on why needed

More examples… Border filters Border filters P2P on wireless P2P on wireless Log collection and review Log collection and review Password rules Password rules Encryption of laptops Encryption of laptops VMware VMware IPv6 traffic on campus IPv6 traffic on campus

Result: Enjoy both the turkey AND the dressing

Questions?