IT Audit Summary Bruce Patrou Chief Information and Technology Officer St. Johns County School District Rick Laneau Data Center Manager, Information Services School District of Hillsborough County

User Account Mgt User Account Mgt Develop system to provision user accounts Develop system to provision user accounts Document your methods Document your methods Ensure your system handles account revocation Ensure your system handles account revocation Link accounts to your Directory System (if able) Link accounts to your Directory System (if able) Project at St. Johns: Project at St. Johns: Working to employ Microsoft FIM (for employees) Auto Provision accounts when new/changed in HR System Auto account rights revocation/lockout Groups and rights tied to role Accounts cross multiple systems Accounts tied to MS Active Directory

User Access Rights User Access Rights Limit Users to Role based system rights Limit Users to Role based system rights Review Users rights Review Users rights Document Results Make changes from findings Perform as often as practical Document Account approval procedures Document Account approval procedures Avoid exceptions to your rules Avoid exceptions to your rules

Data Loss Prevention Data Loss Prevention School Districts handle lots of sensitive data School Districts handle lots of sensitive data Student Academic Records (many elements) Staff sensitive data (SSN, Medical, etc.) Loss or unauthorized disclosure can be damaging Loss or unauthorized disclosure can be damaging Identify what is sensitive and where it’s located Identify how it is accessed and via what systems Identify how to control its transmission Policies, Procedures Monitoring Encryption User Awareness and Training

Data Loss Prevention Data Loss Prevention Supported by multiple Documents: Supported by multiple Documents: Employee Acceptable Use Policy Procedures for Handling Student Directory Information IT Procedures Handbook Procedures for handling and transmitting sensitive data Location and security of sensitive/critical data Data Inventory Data Backup Training and awareness

Disaster Recovery and Testing Identify critical processes Identify critical processes Identify key staff to participate Identify key staff to participate Cold or Hot remote site Cold or Hot remote site Annual testing Annual testing Daily log file updates Daily log file updates Dedicated connection preferred Dedicated connection preferred

User Authentication Security Settings Password length (minimum 8) Password length (minimum 8) Password complexity enabled Password complexity enabled Password history Password history Password lockout after x number of attempts Password lockout after x number of attempts Password expiration (60 days) Password expiration (60 days) Document your settings Document your settings

Incident Response Procedures Procedures for reporting the unauthorized release of sensitive Student or Staff dataProcedures for reporting the unauthorized release of sensitive Student or Staff data Include who will do what and whenInclude who will do what and when

IT Procedures Manual Mission/GoalMission/Goal DefinitionsDefinitions Documentation StandardsDocumentation Standards Org Chart (IT Dept) (include roles)Org Chart (IT Dept) (include roles) Major Software AcquisitionMajor Software Acquisition Project approval, selection and monitoringProject approval, selection and monitoring Operational ProceduresOperational Procedures Security Awareness ProgramSecurity Awareness Program Security and AccessSecurity and Access System BackupsSystem Backups

Security Risk Assessment Security Risk Assessment Survey and Mitigation Plan (see template)Security Risk Assessment Survey and Mitigation Plan (see template) External/Internal penetration assessmentExternal/Internal penetration assessment Helpful links to NIST and Florida AEITHelpful links to NIST and Florida AEIT /Security/2011FloridaITRiskAssessmentFinal.pdf /Security/2011FloridaITRiskAssessmentFinal.pdf /Security/2011FloridaITRiskAssessmentFinal.pdf /Security/2011FloridaITRiskAssessmentFinal.pdf NIST SP Revision 1 (Sept 2011 Draft) NIST SP Revision 1 (Sept 2011 Draft)

Security Awareness ProgramSecurity Awareness Program Publish SA notes for employeesPublish SA notes for employees Publish notice of changesPublish notice of changes Provide training to staff on changesProvide training to staff on changes Security Training (log via PD system)Security Training (log via PD system) ExampleExample

Questions