UAB IT Security Program Sallie Wright UAB AVP, Information Technology

Agenda UAB Cyber Security Awareness Symposium October 20, :00–9:05WelcomeDr. Doug Rigney, Interim Vice President 9:05–9:15Current State of IT Security at UABSallie Wright, Assistant Vice President 9:15–9:20Recognition of CISSPsSallie Wright, Assistant Vice President 9:20–9:40Security & Jeff Jessee, Asst. Director, Infrastructure Services 9:40–10:00Data Loss/ARRA/HIPAATerrell Herzig, Information Security Officer, HSIS 10:00–11:00Implementing ISO 27001/27002 in Higher EducationTammy Clark, Georgia State 11:00–11:20Break 11:20–12:00Dell’s Approach to Enterprise Information Security Dale Whiteaker-Lewis, Dell IT Security Consultant 12:00–12:20High Performance Computing/caBIG John Sandefur, Information Systems Manager John-Paul Robinson, System Programmer Lead 12:20–12:40Break/Lunch 12:40–1:00Equipment SurplusMichael Thorn, Information Security Specialist 1:00–1:20Infrastructure Security David Wolford, Communications Network Specialist 1:20–1:40Encryption & Pod SlurpingSean Maher, Information Security Coordinator 1:40–2:00Software BundlesChris Green, Information Security Specialist 2:00–2:10Break 2:10–2:40*Security/Forensics Careers - NCFITBD 2:40–3:05*Safety in Social NetworkingBrandon Cain, Information Security Coordinator 3:05–3:30*Securing Your ComputerBrandon Cain, Information Security Coordinator 3:30– Wrap-upSallie Wright, Assistant Vice President *of interest to students

UAB Information Security  Mission  Protected computing everywhere  Support the University’s mission of research, education and service  Objectives  World class security program  Recognized as the national leader for excellence in information assurance across higher education 3

Higher Ed Trends in IT Priorities

IT Priorities at UAB  Top 3  Administrative and Student Information Systems (ERP)  Increased Support for Teaching and Learning  Increased Information Security  2008 – 2009 Top 3  Support for Research  Increased Support for Teaching and Learning  Increased Information Security

Security Programs Stages of Excellence Stage 4 Stage 3 Stage 2 Stage 1 World Class program Excellent results World Class program Excellent results Advanced security program Limited fire fighting, most processes in place Advanced security program Limited fire fighting, most processes in place Basic security program Fire fighting with some processes in place Basic security program Fire fighting with some processes in place No real security program Mostly fighting fires No real security program Mostly fighting fires Stages of Excellence

Stage 1 No real information security Program Mostly fighting fires

Stage 2 Basic security program Fire-fighting with some processes in place Basic security program Fire-fighting with some processes in place

Stage 3 Advanced security program Limited fire fighting, most processes in place Advanced security program Limited fire fighting, most processes in place

Stage 4 World Class program Excellent results World Class program Excellent results

11

IT Security Central Resources Sallie Wright Chris Green Michael Thorn Sean Maher Brandon Cain14

UAB Security Initiatives Recent Accomplishments Intrusion DetectionRESNET NACComputer Forensics LabWhole Disc Encryption In Process Electronic Messaging Security Application Penetration Testing Lab caBig Security Framework On the Horizon Campus Wide Security Training & Certifications PCI Compliance Risk & Security Assessments eDiscovery 15

UAB Security Initiatives AccomplishmentsIn ProcessOn the Horizon Electronic Messaging Security Research Security Planning UAB Information Security Enterprise Council Application Penetration Testing Facility JRE UpgradesCell Phone and Removable Media Encryption Deployment Electronic Media Destruction 2 Factor AuthenticationIT Technical Coordinators Forensics Service CenterPCI CompliancePolicies, policies, policies Campus Wide Security Training and Certifications ARRA HIPAA Privacy Breach Notifications IDM caBig Security FrameworkBundle Images Laptop Encryption

Security Services  Computer Forensics & Investigations  Application Penetration Testing  Risk Vulnerability Assessments  Incident Response  Security Planning  Security Architecture  Electronic Messaging Security  Anti-Virus Protection 17

IT Technical Coordinators  Deans appointed IT technical coordinators  Build communications and partnerships with the schools  Ensure coordination of university-wide solutions with school-based initiatives  UAB Computer Incident Response Team membership  Participate in the selection of new UAB-wide solutions 18

UAB Security Stats Computer Forensics Risk Assessments Pen Tests Help Tickets Copyright Violations Virus Infections

Information Security Certifications  CISSP – Certified Information Systems Security Professionals  Course attended by 29 participants  Testing completed by 26; 2 scheduled for December  Confirmed 15 New CISSP’s across campus 20

UAB Information Security Enterprise Council  Purpose  To provide insight into the IT security needs of UAB  To assist with ensuring IT security posture continues to be strengthened across UAB  To help identify opportunities to improve IT security  To participate in the review of the IT security plan and to recommend the priorities for best meeting the information security needs of UAB

Congratulations to….CISSP’s Phillip CottonAshley FlemingFran Fabrizio Chris GreenEd HarrisTerrell Herzig Jerry LawrenceSean MaherLarry Owen Rajesh PillaiBrian RosenowEric Rzeszut John SandefurDr. Feng SunMichael Thorn