1. UAB IT Security Program Sallie Wright UAB AVP, Information Technology

2. Agenda UAB Cyber Security Awareness Symposium October 20, 2009 9:00–9:05WelcomeDr. Doug Rigney, Interim Vice President 9:05–9:15Current State of IT Security at UABSallie Wright, Assistant Vice President 9:15–9:20Recognition of CISSPsSallie Wright, Assistant Vice President 9:20–9:40Security & Email Jeff Jessee, Asst. Director, Infrastructure Services 9:40–10:00Data Loss/ARRA/HIPAATerrell Herzig, Information Security Officer, HSIS 10:00–11:00Implementing ISO 27001/27002 in Higher EducationTammy Clark, Georgia State 11:00–11:20Break 11:20–12:00Dell’s Approach to Enterprise Information Security Dale Whiteaker-Lewis, Dell IT Security Consultant 12:00–12:20High Performance Computing/caBIG John Sandefur, Information Systems Manager John-Paul Robinson, System Programmer Lead 12:20–12:40Break/Lunch 12:40–1:00Equipment SurplusMichael Thorn, Information Security Specialist 1:00–1:20Infrastructure Security David Wolford, Communications Network Specialist 1:20–1:40Encryption & Pod SlurpingSean Maher, Information Security Coordinator 1:40–2:00Software BundlesChris Green, Information Security Specialist 2:00–2:10Break 2:10–2:40*Security/Forensics Careers - NCFITBD 2:40–3:05*Safety in Social NetworkingBrandon Cain, Information Security Coordinator 3:05–3:30*Securing Your ComputerBrandon Cain, Information Security Coordinator 3:30– Wrap-upSallie Wright, Assistant Vice President *of interest to students

3. UAB Information Security  Mission  Protected computing everywhere  Support the University’s mission of research, education and service  Objectives  World class security program  Recognized as the national leader for excellence in information assurance across higher education 3

4. Higher Ed Trends in IT Priorities 1 5 10

5. IT Priorities at UAB  2001-2007 Top 3  Administrative and Student Information Systems (ERP)  Increased Support for Teaching and Learning  Increased Information Security  2008 – 2009 Top 3  Support for Research  Increased Support for Teaching and Learning  Increased Information Security

6. Security Programs Stages of Excellence Stage 4 Stage 3 Stage 2 Stage 1 World Class program Excellent results World Class program Excellent results Advanced security program Limited fire fighting, most processes in place Advanced security program Limited fire fighting, most processes in place Basic security program Fire fighting with some processes in place Basic security program Fire fighting with some processes in place No real security program Mostly fighting fires No real security program Mostly fighting fires Stages of Excellence

7. Stage 1 No real information security Program Mostly fighting fires

8. Stage 2 Basic security program Fire-fighting with some processes in place Basic security program Fire-fighting with some processes in place

9. Stage 3 Advanced security program Limited fire fighting, most processes in place Advanced security program Limited fire fighting, most processes in place

10. Stage 4 World Class program Excellent results World Class program Excellent results

11. 11

14. IT Security Central Resources Sallie Wright Chris Green Michael Thorn Sean Maher Brandon Cain14

15. UAB Security Initiatives 2007-08 Recent Accomplishments Intrusion DetectionRESNET NACComputer Forensics LabWhole Disc Encryption In Process Electronic Messaging Security Application Penetration Testing Lab caBig Security Framework On the Horizon Campus Wide Security Training & Certifications PCI Compliance Risk & Security Assessments eDiscovery 15

16. 2008-2009 UAB Security Initiatives AccomplishmentsIn ProcessOn the Horizon Electronic Messaging Security Research Security Planning UAB Information Security Enterprise Council Application Penetration Testing Facility JRE UpgradesCell Phone and Removable Media Encryption Deployment Electronic Media Destruction 2 Factor AuthenticationIT Technical Coordinators Forensics Service CenterPCI CompliancePolicies, policies, policies Campus Wide Security Training and Certifications ARRA HIPAA Privacy Breach Notifications IDM caBig Security FrameworkBundle Images Laptop Encryption

17. Security Services  Computer Forensics & Investigations  Application Penetration Testing  Risk Vulnerability Assessments  Incident Response  Security Planning  Security Architecture  Electronic Messaging Security  Anti-Virus Protection 17

18. IT Technical Coordinators  Deans appointed IT technical coordinators  Build communications and partnerships with the schools  Ensure coordination of university-wide solutions with school-based initiatives  UAB Computer Incident Response Team membership  Participate in the selection of new UAB-wide solutions 18

19. UAB Security Stats Computer Forensics Risk Assessments Pen Tests Help Tickets Copyright Violations Virus Infections

20. Information Security Certifications  CISSP – Certified Information Systems Security Professionals  Course attended by 29 participants  Testing completed by 26; 2 scheduled for December  Confirmed 15 New CISSP’s across campus 20

21. UAB Information Security Enterprise Council  Purpose  To provide insight into the IT security needs of UAB  To assist with ensuring IT security posture continues to be strengthened across UAB  To help identify opportunities to improve IT security  To participate in the review of the IT security plan and to recommend the priorities for best meeting the information security needs of UAB

22. Congratulations to….CISSP’s Phillip CottonAshley FlemingFran Fabrizio Chris GreenEd HarrisTerrell Herzig Jerry LawrenceSean MaherLarry Owen Rajesh PillaiBrian RosenowEric Rzeszut John SandefurDr. Feng SunMichael Thorn