Information Security Awareness, Assessment, and Compliance A Success Story 1

What ISAAC was intended to address Provide an information security risk assessment process that was thorough, effective, and efficiently used the time of the system administrators and other assessors A large decentralized university environment with over 200 departments, each having their own IT function and budget Had to be cost effective  Minimal expenditure to create and operate  Currently, institutions using ISAAC spend less than $2,000 per year for the Web-SQL based system 2

Approach and Methodology Information Security Awareness, Assessment, and Compliance (ISAAC)  Awareness is a key aspect in that ISAAC creates a familiarity with information security standards and best practices for IT personnel  ISAAC leverages the concept of known threat vectors and best practices/countermeasures thus providing a time savings for those involved o Assessment process may begin immediately without spending large amounts of preparation time in committee meetings as is typical of other methodologies 3

Approach and Methodology (cont.)  The 2 major components are: o A module that assesses or evaluates compliance with information security standards, best practices, and requirements, legal or otherwise o Compliance modules for HIPAA and PCI are also included o A risk assessment methodology, which is currently the Relative Risk Index (borrowed from the National Institutes of Health) The RRI simplifies to acceptable or unacceptable in terms of risk Requires identifying mitigation measures that will bring the risk to an acceptable level 4

Benefits of this Approach Designed to be used independently at the department level Individual departments are able to decide what risk management decisions to make and what risk mitigation measures to implement based on their departmental budget and personnel resources 5

Benefits of this Approach (cont.) The assessment is considered to be completed when the department head signs the assessment and risk management report This creates awareness of the nature of the security environment at the department head level and fosters communication between the department head/administrative level and those in an IT function 6

Benefits of this Approach (cont.) A composite view of departmental risk assessment reports  Are used to create a composite report to highlight common risks  Provide guidance to the CIO on what centrally based initiatives would be of most benefit to improve the security posture of the institution  Are used to develop an institution-wide risk management plan to address global risks ISAAC has grown not only to provide awareness, risk, and compliance checks supporting information security but also into other awareness and compliance aspects of IT policy administration 7

Current Users Use of ISAAC has grown over the years from use at a single institution (TAMU) Now used as the officially recommended assessment tool for all Texas state agencies Currently in use by Health Science Centers and universities from 4 major state university systems Also being utilized by a Health Science Center outside of Texas This is primarily due to an efficient and cost effective methodology 8

Plans for Future There are currently 4 different versions of ISAAC and additional sub-modules ISAAC-EU is the newest module soon to be widely available  A module that is brief and simple  Designed for the individual with administrative rights for their own desktop unit  Ensures that the essential countermeasures/best practices are in place  This can be very useful for systems that are not centrally supported by the department (research groups, faculty desktops, etc.) 9

Plans for Future (cont.) The infrastructure of ISAAC is being rewritten from the ground up to develop a very modular and table driven framework This allows for  Assessments to be highly customizable  Individual institutions can include their own customized questions and methods 10

Plans for Future (cont.) Assessments will be keyed to resources Will also allow various “views” in terms of reporting  Likert scale evaluation for a phased view of compliance initiatives/levels  Capability maturity model approach  Additional or multiple measures/views Plans include the availability of online tutorials (delivered by Articulate) addressing the various aspects of ISAAC that are available 11

Contact Us Information Technology Issues Management (979)