1. Annual CISO Update Ken Runyon, CISO Ken.Runyon@suny.edu

2. Session Outline: 1.Introduction 2.Annual Training Requirements 3.SANS Securing the Human 4.SAQ 2015 Review 5.Q&A

3. Annual Training and Assessment

4. ISO Training Requirements: NYS-S10-001  ISO or designated security representatives for State Entities  Minimum of 37.5 CPE credits annually User Training Requirements: SUNY 6608 NYS P003-002 PCI-DSS

5. SANS Securing the Human

6. SANS Training: Expected Outcomes  Provide standards based information security awareness training  All system users (faculty or staff) should participate  May be augmented with face to face training (Executives)  Does not replace specific PCI or HIPAA required compliance training Current Situation  24 SUNY entities (campuses and other) participate in group program  4 have conducted training, running out of time for 2015-2016 cycle

7. SAQ 2015 Review

8. ISEC Program Observations: Security Projects remain a top indicator to success Management/Executive are necessary Establishing Policies based on established standards is a requirement  Cyber Security Framework v1.0  NIST 800-53  ISO 27001/27002  COBIT

9. State Operated ISEC Program Scores

10. Community College ISEC Program Scores

11. State Operated ISEC Program Percentages

12. Community College ISEC Program Percentages

13. ISEC Controls Observations: IT has addressed the basics as can be seen in the scores Intrusion Prevention remains a stretch goal 1/3 of the campuses do not conduct vulnerability scans Content based filtering (i.e. DLP) is not being done

14. State Operated IT Controls Scores

15. Community College IT Controls Scores

16. State Operated IT Controls Percentages

17. Community College IT Controls Percentages

18. Questions