Information Security The University of Texas at Dallas Education – Partnership – Solutions ISC Meeting April 10, 2015 Information Security

Information Security The University of Texas at Dallas Education – Partnership – Solutions Information Resources Update Presented by Information Resources Management

Information Security The University of Texas at Dallas Education – Partnership – Solutions CISO Update Presented by Nate Howe

Initiatives Firewall architecture review and reduction of “global allow” Identity Finder – disabled monthly scanning WordPress administrative pages SANS Securing the Human videos Information Security Office Education – Partnership – Solutions Information Security The University of Texas at Dallas Education – Partnership – Solutions

Information Security The University of Texas at Dallas Education – Partnership – Solutions 6 month collaborative drafting process, including more than 75 reviewers Replaces all “policy” documents formerly published by ISO Outlines expectations for secure use of University data and computing resources New Information Security and Acceptable Use Policy

Information Security The University of Texas at Dallas Education – Partnership – Solutions Convenient reference table covering applicability to personal and University data, on personal or University equipment Updated language for data classification: confidential, controlled, and public data References standards, rather than incorporating technical details into policy All portions of the policy are subject to exemptions Policy Highlights

Information Security The University of Texas at Dallas Education – Partnership – Solutions Will detail specific configuration requirements for key technologies in use across campus The first set of standards will cover: – Desktops and laptops – Mobile computing devices – Servers – Web applications We will be seeking input from technical specialists on campus Coming Soon: Standards

Information Security The University of Texas at Dallas Education – Partnership – Solutions 2-Factor Authentication Presented by Nate Howe & Brian McElroy

Problem to be Solved Direct deposit routing number changed Passwords can be obtained if recovery questions are predictable based on social media research Phishing victims provide username and password by or fraudulent website Information Security Office Education – Partnership – Solutions Information Security The University of Texas at Dallas Education – Partnership – Solutions

Information Security Office Education – Partnership – Solutions Information Security The University of Texas at Dallas Education – Partnership – Solutions

Information Security Office Education – Partnership – Solutions Information Security The University of Texas at Dallas Education – Partnership – Solutions

Information Security The University of Texas at Dallas Education – Partnership – Solutions What is 2-Factor Authentication? 3 Categories of authentication elements: Something you know Something you have Something you are

Information Security The University of Texas at Dallas Education – Partnership – Solutions What is 2-Factor Authentication? 3 Categories of authentication elements: Something you know (username, password, PIN, questions and answers) Something you have (ATM card, SecureID keychain, mobile phone) Something you are (fingerprint, retina, voice)

Information Security The University of Texas at Dallas Education – Partnership – Solutions What is 2-Factor Authentication? Video of Duo:

Information Security The University of Texas at Dallas Education – Partnership – Solutions What is 2-Factor Authentication? Traditional authentication only uses elements from the first category, such as username and password Reduced risk when using more elements from the first category, referred to as “multifactor authentication” Further risk reduction when using elements from two categories Authentication model should match the risk; ATMs use two factors because most people like cash

Information Security The University of Texas at Dallas Education – Partnership – Solutions Scope 2-Factor is the right thing to do for our high risk connections UT System memo defines August 31, 2015 target for: High-value PeopleSoft transactions, in particular direct deposit VPN remote access Remote administrative tasks [via external SSH]

April May June July August September -Initial committee meetings -Product decision Awareness campaign Letter to UT System 9/1 Moat & Mote for Admins - SSH Cisco VPN March Budget Proposal PeopleSoft Direct Deposit Change Draft Timeline

Information Security The University of Texas at Dallas Education – Partnership – Solutions Cloud Storage Update Presented by Brian McElroy

Information Security The University of Texas at Dallas Education – Partnership – Solutions Cloud Storage Update We have reviewed and approved several storage providers for various use cases We endorse box.com for the most allowed purposes This month we are launching utdallas.edu/cometspace Table indicating allowed use cases Frequently Asked Questions Link to our box.com instance

Information Security The University of Texas at Dallas Education – Partnership – Solutions Box.com The service is live – Login using your NetID and password 100GB storage quota Departmental shared folders are available 500+ early adopters are already using the service Very few questions, even with our FAQs not available yet

Information Security The University of Texas at Dallas Education – Partnership – Solutions Questions & Discussion Information Security