EDUCAUSE Security Conference Denver, Colorado April 10 to 12, 2006 Bob Beer Biggs Engineering 117 (419)

2 Topics SunGard Security in Banner Identity Management Payment Card Industry-Data Security Standard

3 Banner Security BOF Joy R. Hughes, CIO George Mason SunGardHE should not do identity management Security feature requests include negative performance items –Encryption –Change tracking –Field level audit trails –Current product performance

4 Banner Security cont. Support for regulatory compliance Security emphasized at the pre- implementation stage

5 Miscellaneous Banner Discussion Best/Recommended practices missing Sensitive data not masked Auto-generated ID are sequential Third party application access is via privileged accounts PINs visible in GOATPAD form –six characters –default DOB

6 Identity Management AuthN and AuthZ Identifiers (unify namespace) –Replaced SSN –PUID Provisioning (by department) AuthZ (Id X Role matrix) Example

7 PCI-DSS Data Security Standard 2004 Applies to everyone who processes cards Includes any equipment attached to the card processing environment Compliance date June 2005 (poorly communicated)

8 Merchants and Service Providers Merchant-our institutions Service Provider-process, stores, transmits cardholder data

9 Levels 1Any merchant who processes over 6,000,000 transactions annually. Any merchant that has suffered a breach. Any merchant designated Level 1 by Visa 2Any merchant who processes between 150,000 and 6,000,000 e-commerce transactions annually.

10 Levels continued 3Any merchant who processes between 20,000 and 150,000 e-commerce transactions annually. 4Anyone else.

11 Risks Reputation (damage to “brand” and data disclosure legislation) Financial ($500,000 per incident) Compliance (level 1 requirements) Operational (loss of processing)

12 12 Requirements Install and maintain a firewall Do not user vender supplied default passwords Protect (encrypt) Stored Data Encrypt transmission of cardholder data Use and update AV software

13 Requirements continued Develop and maintain secure systems and applications (patch management) Restrict access (need to know) Assign unique identifiers to all users (various password policies) Restrict physical access to cardholder data

14 Requirements continued Track and monitor access to cardholder data Regularly test security systems and processes Maintain an information security policy

15 Resources Guidelines Self Assessment Audit