1. 1 www.vita.virginia.gov Evolving the Cyber Security Program Michael Watson Chief Information Security Officer ISACA 3/12/2015 www.vita.virginia.gov 1

2. 2 Overview Program Overview Existing Structure Information Security Challenges New Concepts

3. 3 www.vita.virginia.gov Printers 5,311 network 22,000 desktop CoVA IT Infrastructure 2,247 Locations Communications 55,000 desk phones 6,100 handhelds (PDAs) 11,000 cell phones Networks 2,039 circuits Data Centers (2) CESC SWESC Computers 59,374 PCs 3,356 servers Mailboxes 58,948 accounts Data storage 1.5 petabytes Mainframes (2) IBM Unisys

4. 4 Information Security in the Commonwealth www.vita.virginia.gov VITA is tasked with security governance of all three branches of Commonwealth Government. VITA controls the infrastructure of the executive branch agencies. Agencies remain responsible for application management.

5. 5 COV Information Security Program IT Security Audit Program –Sensitive systems audited every 3 years –Sensitive systems list provided by the auditor Risk Management Program –Business impact analysis –Risk assessment –Vulnerability and intrusion detection data –Assessment and audit analysis www.vita.virginia.gov

6. 6 Our Current Posture How well have we reviewed our environment? What are the consistent issues in our environment? www.vita.virginia.gov

7. 7 2014 Information Security Audit Program www.vita.virginia.gov

8. 8 Sensitive System Review Status www.vita.virginia.gov

9. 9 2014 Findings by Control Family www.vita.virginia.gov

10. 10 Challenges www.vita.virginia.gov

11. 11 Evolution www.vita.virginia.gov

12. 12 Risk and Executive Support www.vita.virginia.gov

13. 13 Culture and Funding www.vita.virginia.gov

14. 14 Future Program Changes Threat Management –Incorporate vulnerability and intrusion detection information –Automate information sharing www.vita.virginia.gov

15. 15 Future Posture What are we doing to mitigate our most significant risks? How does a new threat impact our landscape? Are we monitoring the business’s current areas of concern? Are we dedicating the resources to maintain our risk posture and address identified risks? www.vita.virginia.gov

16. 16 www.vita.virginia.gov Questions?