Ferst Center Incident Incident Identification – Border Intrusion Detection System Incident Response – Campus Executive Incident Response Team Incident Analysis – Patron Credit Card Information Disclosed Incident Communications Management – Publicize Service Restoration – Change Business Practices Incident Impact – Significant Image, Regulatory and Financial Issues Remedial Actions – Campus-Level Policy, Process and Architectural Reviews

“Federal and state laws relating to privacy and information technology security have become increasingly complex in nature, and the practical effect of these laws on colleges and universities is just beginning to unfold.” -A Legal Perspective Prepared for the EDUCAUSE/Internet2 Computer and Network Security Task Force 2003

Family Educational Rights and Privacy Act (FERPA) 97 “FERPA generally imposes a cloak of confidentiality around student educational records, prohibiting institutions from disclosing “personally identifiable education information,” Health Insurance Portability and Accountability Act (HIPAA) 5 “HIPAA generally requires covered entities to (i) adopt written privacy procedures that describe, among other things, who has access to protected information, how such information will be used, and when the information may be disclosed; (ii) require their business associates to protect the privacy of health information; (iii) train their employees in their privacy policies and procedures; (iv) take steps to protect against unauthorized disclosure of personal health records; and (v) designate an individual to be responsible for ensuring the procedures are followed.” Gramm-Leach-Bliley Act (GLBA) 106 “The GLBA includes requirements to take steps to ensure the security of personally identifying information of financial institution customers, such as names, addresses, account and credit information, and Social Security numbers.” Cardholder Information Security Program (CISP) 12 VISA compliance 220 sensitive data servers scattered across 39 Academic, Research and Administrative units -what steps should be taken to mitigate this risk-

Layered Security Approach for Securing GT’s IT Infrastructure Campus border filters FW = FirewallIDS = Intrusion Detection SystemVPN = Virtual Private Network Education, Awareness & Training - Students - Faculty - Staff - CSR/CSS IDS border Policy Development - Finish unit-level policies - Sensitive/unit server (create) - Wireless (create) - Data access (revise) - Data retention (create) - Backup and recovery (create) Risk Management - Unit-level self assessment - Business process review for all sensitive servers - System acquisition reviews/ system connection - Operations monitoring IDS and firewalls 24x7 - Internal Audit & OIT IS joint review of audit findings - Centralized vulnerability assessment I 1 I 2 Router - FW - VPN - IDS Router - Education - Policy -Host-based Security -Secured Services - FW - VPN - IDS Router - Education - Policy -Host-based Security -Secured Services - IDS Router - Education - Policy -Host-based Security -Secured Services - FW - VPN - IDS Router - Education - Policy -Host-based Security -Secured Services Technical Measures Non-Technical Measures Student DomainEducation DomainAdmin DomainPrivate Services Architectural Reviews Unit Level Measures Buzzcard System Building Access Controls Environmental Controls Digital Signage Other Sensitive Systems As required Campus Vulnerability Scanning ResNet/EastNet

Layered Security Issues Building CSR/CSS skill sets – commitment of training $ Tool Repositories – for Solaris, Linux &Windows Supported OS builds (Solaris/Linux/Windows) System administration guidance – in addition to GT’s Sans guides Current patch lists (Solaris/Linux/Windows) – can we maintain this? patch management Decision support guidelines – before you purchase or accept donation Spam – costing us in system processing and human time Intrusion Prevention (opt in?) – we know who to block – how can we Architectural options/decisions – separate admin/academic networks, firewall ResNet from other campus domains Campus information security advisory committee External information security advisory board