Virginia Tech’s Effective Practices for Managing Sensitive Data Common Solutions Group January 11, 2008

VT EP for Managing Sensitive Data Our needs… Stay out of the Press. Stay out of the courts. Preserve the integrity of the data. Respect the privacy of our students and employees.

VT EP for Managing Sensitive Data Education On-demand Compliance HR Disciplinary Action Building Blocks Acceptable Use Policy Data Classification Tools SSL Pre-2003 #1: Do what you can when you can do it.

VT EP for Managing Sensitive Data #2. Create a framework for doing it.

VT EP for Managing Sensitive Data #3. Garner support from the Big Sticks. Board of Visitors University Legal Counsel Internal Audit Campus Police

VT EP for Managing Sensitive Data Education Awareness sessions Faculty Dev. Institute Communication SANS-EDU Compliance ITSO Security Reviews Audit Building Blocks Authority Docs VTCA Policies (SSN) Standards (PII) Tools Find_SSN Find_CCN Encryption 2008 #4. Don’t think you’re done.

VT EP for Managing Sensitive Data Security Standards for Social Security Numbers IT Standards –SSN on display screens, reports –Security protocol to access SSN on VT DB –Electronic Storage of SSN (encrypt it) –Electronic transmission of SSN (encrypt it) –Obtain permission to include SSN in ANY electronic system Records management handles paper documents

VT EP for Managing Sensitive Data Benefits Lack of a complete solution has not prevented us from implementing partial solutions. Everyone has a role. –Members of the IT organization and the university have increased their involvement, interest and awareness in security through policy development, tool development and by participating in VT IT Security Task Force.

VT EP for Managing Sensitive Data Challenges Pulling all the pieces together to create a comprehensive plan for securing personally identifying information (PII).

VT EP for Managing Sensitive Data Future Plans Meet the challenge!

VT EP for Managing Sensitive Data References Virginia Tech IT-Related University Policies Security Standards for Social Security Numbers ecurity%20standards_5July05.pdf ecurity%20standards_5July05.pdf Virginia Tech Certification Authority Virginia Tech Information Technology Security Office Virginia Tech IT Security Task Force Administrative Data Management and Access Policy