1. Data Security At Cornell Steve Schuster

2. Questions I’d like to Answer ► Why do we care about data security? ► What are our biggest challenges at Cornell? ► What can we do?

3. Why Do We Care? ► Current federal and state law  Family Educational Rights and Privacy Act (FERPA)  Health Insurance Portability and Accountability Act (HIPAA)  Gramm-Leach-Bliley Act (GLBA)  Compromise notification laws ► 32 states ► NYS became law December 8, 2005 ► Growing social expectations due to rise in identity theft awareness ► Need to protect Cornell’s reputation

4. NYS Notification Law ► Cornell must notify and report if protected data is reasonably believed to have been inappropriately accessed ► Protected data  Name with ► Social security number ► Credit card number ► Bank account number with associated PIN ► Drivers license number ► Notification requirements  Personal notification  NYS reporting

5. Why Do We Care?

9. Our Biggest Challenges ► Changing/emerging law ► Growing social expectations and requirements ► Our general “openness” can make us an easier target  Cornell network  Home users  Roaming Cornell resources ► Changing the way data are handled, transmitted and protected around campus ► Answering institutional questions ► Complexity due to decentralized IT support complicates the identification of critical or sensitive resources/data ► Preparing for a legal defense now

10. Steps the University Is Taking ► New policy addressing minimum security standards ► Continue to investigate optional/additional security measures ► Formation of a Data Incident Response Team ► Determine if we should be assessing computers as they come onto our network ► More active security assessments ► Better security awareness for our users

11. Steps We Must All Take ► Identify the data on your systems and within your departments – You are responsible for the data  Social Security Numbers  Credit card numbers  Drivers license numbers ► Notify your IT staff of the data on your system if these data are sensitive ► Work with your local IT staff to ensure your system is protected  If in doubt ask ► Before performing any action on your computer ask if there’s a chance this action might put the data at risk  Clicking on e-mail attachments  Turning off the firewall, anti-virus  Installing programs from the internet ► If you work from home using personal computers  YOU are responsible for the security of your computer  Home wireless can be a particularly troublesome area  Unless it can’t be helped never store regulated data on home computers  www.cit.cornell.edu/computer/security/secure.html www.cit.cornell.edu/computer/security/secure.html

12. End User Security www.cit.cornell.edu/computer/security/secure.html

13. Other Useful Links ► Information on Identity Theft  www.consumer.gov/idtheft www.consumer.gov/idtheft  www.consumer.gov/idtheft www.consumer.gov/idtheft ► User Guidance  www.cit.cornell.edu/computer/security/secure.html www.cit.cornell.edu/computer/security/secure.html  www.cit.cornell.edu/services/identity/ www.cit.cornell.edu/services/identity/ ► University Policies  Reporting Security Incidents ► www.policy.cornell.edu/vol5_4_2.cfm www.policy.cornell.edu/vol5_4_2.cfm  Network Registration ► www.policy.cornell.edu/vol5_7.cfm www.policy.cornell.edu/vol5_7.cfm  Authentication of IT Resources ► www.policy.cornell.edu/vol5_8.cfm www.policy.cornell.edu/vol5_8.cfm  Computer Abuse ► www.policy.cornell.edu/Abuse_of_Computers_and_Network_Systems.cfm www.policy.cornell.edu/Abuse_of_Computers_and_Network_Systems.cfm ► General Campus Security Links  www.cit.cornell.edu/computer/security/ www.cit.cornell.edu/computer/security/

14. Questions?