Put your company logo here Confidential Data Upgrade from 8.x to 9.0

Speaker Michael Stutz - Consultant 22 years of IT industry experience 15 years of PeopleSoft experience PeopleSoft v.2.11 – v.9.0 Mostly Technical but some Functional Primary: HRMS / Payroll / Benefits Recently: Campus Solutions... also some CRM and Financials Numerous International Banks Very Large Corporations Very Small Companies

Agenda Who – Who’s data is it anyway? What – Elements of Concern Why – Driving Factors How – Protection in Action Where – Environments When – & When Not to! Tools – Secure, Separate, Scramble Questions & Answers

WHO – Has Information Applications o HRMS / Payroll / Benefits o Campus Solutions (Student Admin / Financials / Aid) o Financials (GL / AP / AR / etc.) o Customer Relationship Management (CRM) Departments or Parts of the Organization o IT o Call Centers o Marketing o Sales and Sales Operations o HR / Payroll / Benefits o Legal o Finance and Accounting o Research and Development

WHO – Needs Access Management o Department Heads (Corporate) o Managers with Direct Reports (Line Managers) Back Office o Human Resources / Payroll / Benefits o Accounting o Corporate Dashboards and Reporting IT o Developers o Database & Systems Administration o IT Management Interfaces to Other Organizations

WHO – Is Responsible Management o Department Heads (Corporate) o Managers with Direct Reports (Line Managers) Back Office o Human Resources / Payroll / Benefits o Accounting o Corporate Dashboards and Reporting IT o Developers o Database & Systems Administration o IT Management Interfaces to Other Organizations Keep Needs, Access, & Responsibility Synchronized

WHAT Elements of Concern o Intellectual Property o Business Confidential Information o Customer and Consumer Data o Employee Data Motion o At Rest o In Transit within Organisation o In Transit on the WWW

WHAT Intellectual Property Business Confidential o Business Strategy o Project & Costing o Marketing Plans o Budgets and Forecasts

WHAT Customer & Consumer o Key Accounts o Contact Information o Product or Service Issues o Contracts

WHAT Employee Data o Social Security Numbers o Dates of Birth o Pay Information o Health Care Information o Dependants & Dependant Information o Company Structure & Internal Contacts

WHY Risks Internal to Organization Employee Negligence Malicious Employees Business Processes Risks External to Organization Hackers / Theft (Laptops, USB Drives, etc.) Competition Sarbanes & Oxley / Basel I & Basel II

WHY Costs Confidentiality Legal Issues Loss Competitive Edge Employee Compensation Issues Sarbanes & Oxley Responsibility of Corporations Basel I & Basel II Responsibility of Banks Risk Management

WRITE THIS DOWN...

WHY (SOX) Risk Assessment Control Environment Culture based on Awareness & Integrity Keeping Balance: “What is our Business?” Control Activities Monitoring / Auditing Information and Communication

Half Way There!

HOW Create the Culture Define Data Types Identify Who is Responsible and Accountable Reduce Access Maintain Controls Maintain Culture Test (steps)

HOW - Create the Culture Addressed at All Levels of Organization (Vertical) Addressed across Corporation (Horizontal) Support of Upper Management (Top Down) Keep the Balance (Mind Your Business!) Cost / Benefit / RISK o Money in your Mattress? o Day-trading Penny Stocks?

HOW - Define Data Types What is Confidential Data? How do I Classify my Data?

HOW - Responsible & Accountable Identify those Responsible Identify those Accountable Identify those who need access Designate Authority Accordingly Ensure Responsibility, Accountability, and Authority are properly balanced and applied.

HOW – Reduce Access Reduction of Access Departmental Segregation Within IT Balanced against Cost Balanced against Effectiveness Balanced against Trust

HOW – Maintain Controls Access to Data Application Security Database Security Network Security Where is my Data? Laptops PDAs Internal / External

HOW – Maintain Culture Security Awareness Across The Organization Vertically within Organization KEEPING THE BALANCE!

HOW - Test Audit Ask! White Hat Trigger Monitoring Tools Triage Scenarios MIND YOUR BUSINESS

WHERE PRODUCTION STAGING TEST DEVELOPMENT VANILLA TRAINING

WHERE PRODUCTION STAGING TEST DEVELOPMENT MODS

WHERE PRODUCTION STAGING TEST DEVELOPMENT DATA

WHERE PRODUCTION TRAINING METADATA DATA

WHERE PRODUCTION TRAINING FOUNDATION CONFIDENTIAL Data Scrambler Mockup Data GENERAL DATA

WHEN Review the Who... o Database Administrators o System & Network Administrators o Developers o Management o Back Office

WHEN o Database Administrators  Have Access. Period. o System & Network Administrators  No Application Access  Any and All Reports o Developers  Negotiable! o Management – Application Security o Back Office – Application Security

WHEN - Developers Cost / Benefit / Risk How Many Developers Organization of Developers Production Support Modifications & Testing Database Access

WHEN - Developers PRODUCTION STAGING TEST DEVELOPMENT DATA

Tools (types) Secure Database Application Separate Applications (HR & Financials) Roles (Centralized vs Normalized) Environments (TST, DEV, TRN) Scramble Select Environments On the Fly

TOOLS - Separate Identify Data Types o SSN o DOB o Compensation  Department (Name & EMPLID Scrambled) Identify Records (Boeing / Princeton) o EMPLID o Compensation  Paycheck (Not keyed by EMPLID)

WRITE THESE DOWN... (Presentation & Resume) (RBAC & FURBAC) (Johan Bethlehem)

Questions Contact Information: Michael Stutz (888)