2. PERSONAL INFORMATION SWEEP Juliana Luna-Freire, Graduate Assistant David Reamer, Graduate Assistant Justin LeBreck, Applications Systems Analyst

3.  If reviewing each email took one minute it would require 5 hours to review all of them. 1 Computer/Laptop 2 Flashdrives 300 Emails How Much Data Do You Have?

4. First name or initial and last name accompanied by:  SSN  Arizona driver’s license number  Student Grades or Disciplinary Information  Human Subjects Data  Financial account or credit/debit card number What is Personal Information?

5. Legislative & Regulatory Responses Record retention and disposal law Security breach notification law Payment Card Industry Data Security Standard

6. Security Breach Notification A.R.S. Section 44-7501 The University must contact individuals residing in Arizona if their unencrypted or unredacted personal information included in a computer database is accessed and acquired by an unauthorized person.

7. Educational Security Breaches Total Number of Incidents: 139 –67.5% increase over 2006 Total Number of Institutions Affected: 112 –72.3% increase over 2006 The Educational Security Incidents Year in Review – 2007 by Adam Dodge - Posted on 2/10/08 $90-305 total cost per lost record $50 average cost per lost record for –discovery –response –notification Khalid Kark, “Calculating the Cost of a Security Breach,” Forrester Research, 4/10/07

8. Ripped From the Headlines Texas A&M Math Department Chair loses flash drives with 8,000 student SSNs 8,000 X $50 = $400,000

9. Information Security Responsibilities Users of UA data, computers and networks  compliance with laws  compliance with Board of Regents’ policy  compliance with University policy Vice Presidents, Deans, Directors, Department Heads and Heads of Centers  ultimate responsibility for UA data, computers and networks  implementation of the Information Security Policy within their units

10. 1.LOCATE personal information 2.DELETE unneeded files 3.SECURE personal information 4.INSTALL Cornell Spider 5.DELETE temporary files 6.RUN Cornell Spider 7.FIND the log file 8.DELETE or SECURE personal information 9.COMPLY with applicable standards 10.REGISTER your computer 11.CERTIFY completion 12.SUBMIT the Certification http://security.arizona.edu/pi Personal Information Sweep

11. Based on your current understanding, locate the personal information under your control Consider:  all types of computers or storage devices  where you store personal information Step 1: Locate Personal Information

12. not needed for work purposes not a public record that must be retained A file containing personal information is NOT necessary if: Step 2: Delete Unneeded Files

13. If you can’t delete it, secure the information Transfer files to external media Truncate the number to last four digits Replace digits with filler X’s Encrypt personal information Step 3: Secure Personal Information

14. Steps 4, 5 & 6: Scan Computer Install and scan your computing and storage devices using Spider. http://security.arizona.edu/pistep6 http://www.microsoft.com/net

15. Cornell Spider Program Click Run Spider Click Start => Programs, Spider3 => spider_3.0.exe

16. Spider Log Viewer

17. Spider Log Viewer – False Positive

18. Steps 7 & 8: Handle Personal Information Identified by Spider Find the log file Handle files with personal information  Delete if unnecessary (Step 2)  Secure remaining files (Step 3)

19.  Meet the Minimum Security for Networked Devices Standard for all computers  Meet the Server Security Standard for all servers  Register the computer - Locate MAC address: Windows Button + R => Type ‘cmd’ => Type ‘ipconfig /all’ - Go to http://dhcp.arizona.edu to register MAC address. http://dhcp.arizona.edu Step 9: Comply w/ Security Standards Step 10: Register the Computer If you keep personal information on your computer:

20.  Sign the Certification Form.  Return the Certification to your department/unit head. Steps 11 & 12: Completing the Process

21. Implementation Schedule – Nov. 21st AUGSEPOCTNOVDECJANJUL Key Personnel Plan Implementation ON TIME! Key Personnel Attend/View Overview All Personnel Perform the Personal Information Sweep

22. University Information Security Office http://security.arizona.edu/pi 621-UISO (8476) Justin LeBreck - jlebreck@email.arizona.edujlebreck@email.arizona.edu Juliana Luna-Freire – juliana@email.arizona.edujuliana@email.arizona.edu David Reamer – dreamer@email.arizona.edudreamer@email.arizona.edu Instructional Comp. - cohic@email.arizona.edu Business Comp. - cohhelp@email.arizona.edu Contact Us