1 Institutions as Allies in the Security Challenge Wayne Donald, Virginia Tech Cathy Hubbs, George Mason University Darlene Quackenbush, James Madison University Shirley Payne, University of Virginia 2005 EDUCAUSE Conference October 20 th, 2005 Copyright Wayne Donald, Cathy Hubbs, Darlene Quackenbush, Shirley Payne; This work is the intellectual property of the authors. Permission is granted for this material to be shared for non-commercial, educational purposes, provided that this copyright statement appears on the reproduced materials and notice is given that the copying is by permission of the author. To disseminate otherwise or to republish requires written permission from the author.

2 Agenda The why and what of the alliance Products and services Creation, support, and strategies for success Benefits realized Q&A

3 The Why & What of the Alliance Wayne Donald Information Technology Security Officer Virginia Tech

4 Events Influencing Formation Cooperative efforts were already underway among four institutions Governor Mark Warner charged higher education to help meet cybersecurity goals Development of Higher Education CIO’s plan for supporting Virginia IT strategic plan JMU and GMU cybersecurity research centers’ charge to assist State in meeting security goals

5 V irginia A lliance for S ecure C omputing A nd N etworking

6 Purpose Strengthen security programs across Virginia higher education by integrating and making available field-proven tools, best practices, and people from VA SCAN partner institutions Establish links to security research, instruction, and federal/state government initiatives to enhance security opportunities

7 VA SCAN The alliance brings together Virginia higher education security practitioners, who develop and maintain security programs emulated by other institutions, and Researchers responsible for creating cybersecurity instruction and research programs nationally recognized for excellence

8 Current VA SCAN Partners Security Practitioners at George Mason University James Madison University University of Virginia Virginia Tech Security Researchers at Institute for Infrastructure and Information Assurance (JMU) Center for Secure Information Systems (GMU) Critical Infrastructure Protection Project (GMU/JMU)

9 Status Endorsed by Higher Education CIO’s Group and University Presidents First products and services were made available March 2003 Assisted other State institutions in defining and organizing security programs Additional products and services under development with input from “user” institutions

10 Products & Services Cathy Hubbs Information Technology Security Coordinator George Mason University

11 Present Offerings Full service website Consulting “Ask the Expert” service On–site engagements Annual conference and SANS workshop

12 Present Offerings Information resources: Security instructional materials Moderated mail list for general security discussions VA-CIRT group for tracking new threats Compliance Checklist for State of Virginia Web-based toolkit of tools & best practices

13 Creation, Support, & Strategies for Success Shirley Payne Director for Security Coordination & Policy University of Virginia

14 Set-up Steps (May 2002 – February 2003) Developed concept paper Held monthly half-day planning sessions Developed formal charter Identified best practices and training materials Designed and implemented website Developed operating procedures Planned and executed communication and marketing efforts

15 Ongoing Support Efforts Monthly meetings to share information and plan new activities Website content enhancement Mail list activity Consulting & training engagements Conference/workshop planning & delivery Promotion

16 Strategies for Success Support of Commonwealth of Virginia’s IT agency Support of partner institutions’ executives Long history of collaboration among partners Linkage of security research and practice in the field We’re filling a critical need Continuous service enhancement is a priority Services offered are within staffing/funding means

17 Strategies for Success Our principles: We teach and guide clients to develop and maintain strong security programs We base offerings on state and federal standards Offerings balance security risks with other organizational priorities. We promote security being integrated into everything an organization does. We use research to keep offerings on the cutting edge. Cooperation among Alliance members transcends competition.

18 Benefits Realized Darlene Quackenbush University Information Security Officer James Madison University

19 Benefits Realized Saves time and improves quality

20 Benefits Realized Saves time and improves quality Reduces security training costs

21 Benefits Realized Saves time and improves quality Reduces security training costs Helps avoid costs

22 Benefits Realized Saves time and improves quality Reduces security training costs Helps avoid costs Greater influence

23 Benefits Realized Saves time and improves quality Reduces security training costs Helps avoid costs Greater influence BUILDS RELATIONSHIPS

24 Governor’s Technology Award Winner September, 2003 EDUCAUSE Excellence in Information Technology Solutions Award Winner October, 2005

25 Wayne Donald, Virginia Tech Cathy Hubbs, George Mason University Shirley Payne, University of Virginia Darlene Quackenbush, James Madison University