1. Lessons Learned from a Breach Eric van Wiltenburg University of Victoria @e_vanwiltenburg

2. Let’s start with some exercise

3. Hey Eric, aren’t you embarrassed?

4. “Transparency is an asset.” Eric van Wiltenburg, January 31, 2012

5. OK, so what happened anyway?

8. +

10. +

12. =

23. 11845

24. employee names employee numbers Social Insurance Numbers bank account employee classification code amount of last deposit

25. January 2010 January 2012

27. Lesson Having good policies in place is very important, even if nobody reads them

28. UVic Privacy Policy

29. Privacy Breach Response Team

31. University Secretary Vice President Finance and Operations Manager Privacy, Access and Policy University Legal Counsel Information Security Manager Director, Communications Associate Vice-President Human Resources Associate Vice-President Faculty Relations Assistant Director, Campus Security Executive Director, Government Relations Vice-President External Relations Assistant Treasurer Risk Analyst

32. FIPPA OIPC

34. Lesson Effective external communication to {organization, staff, community} is important for {salvaging reputation, reassuring affected individuals, ensuring resolution}, even if the internal politics, communications and logistics cause friction.

39. 250-472-4333 privacyinfo@uvic.ca

41. uvic.ca/infobreach

44. Regular bulletin updates Information sent to current and former UVic employees, Jan. 9, 2012 Letter from Vice-president Finance and Operations Gayle Gorrill, Jan. 10, 2012 A message from President David Turpin, Jan. 11, 2012 Jan. 12, 2012 update Jan. 13, 2012 update Jan. 19, 2012 update Jan. 20, 2012 update - Launch of review Jan. 23, 2012 update - Phishing attacks & fraud investigation Jan. 25, 2012 update - Preliminary report to board Jan. 27, 2012 update - Agreement reached on Credit Monitoring Service Jan. 26, 2012 update - Saanich police release info Feb. 3, 2012 update - Credit monitoring service available Monday Feb. 6, 2012 update - Credit monitoring instructions

45. Lesson Bad guys and gals know how to read the news

49. Lesson Understand what “reasonable security arrangements” are

52. Lesson If you don’t need it, get rid of it (or don’t collect it). Data minimization

54. Lesson Effective project management helps ensure the last mile is completed.

55. Lesson Keeping momentum once the storm blows over can be difficult

56. Lesson Centralized command and control for privacy and security is necessary, even in a decentralized environment

57. Lesson A crisis can be a platform for change

58. Lesson Having good policies in place is very important, and everybody should read them

59. Remember… It’s not IF you’re going to have a breach, it’s WHEN you’ll have a breach and HOW you respond to it and what you LEARN from it that really matters.