1. Stanford Computer Security and You 

2. Higher Education  Higher education environment is open, sharing, exploratory, experimental  Many information assets and resources  Very complex and robust networking and computing environment

3. Internet  Internet environment is open, sharing, exploratory, experimental  Many information assets and resources  Distributed management  Can be “unsafe”

4.  Partner to protect Stanford information assets and resources while supporting the institution’s broad and relatively open access requirements  Works with:  Internal Audit  Networking  Risk Management  Office of General Counsel  Judicial Affairs  Residential Computing  Departments and Schools,  … and You! Information Security Services

5. Focus  Meet legal requirements  Improve individual security knowledge and awareness  Improve administrative systems security  Improve overall SUNet security

6. Legislation: Support Issues  FERPA  Protect private student information  HIPAA  Protect personal health information (PHI)  GLBA  Protect “banking” transaction information  SEVIS  Provide foreign student information  DMCA  Protect copyrighted information  California Law  May not use SSN as identifier  Must disclose compromise of private information Improve Administrative Systems Security

7. Awareness Campaign  Postcards sent to every employee  Web site securecomputing.stanford.edu  Student focus in Fall  Approaching Stanford  Packets on beds  Residence hall contest  Ongoing activities  Stanford 101  Communicating with returning students  Technical security training  Continuing to expand web site Improve Individual Security Awareness

8. Improve Application Security  Participate with the project and support teams  Design security infrastructure  Participated in security reviews Improve Administrative Systems Security

9. Categories of Data Criteria: Use these criteria to determine which data category is appropriate for a particular information or infrastructure system. A positive response to the highest category in any row is sufficient to place that system into that Category. Category A (highest, most sensitive) Category B (moderate level of sensitivity) Category C (very low, but still some sensitivity) Legal requirements Protection of data is required by law (see attached list for specific HIPAA and FERPA data elements) Stanford has a contractual obligation to protect the data Reputation risk High MediumLow Other Institutional Risks Information which provides access to resources, physical or virtual Smaller subsets of Category A data from a school, large part of a school, department Data about very few people or other sensitive data assets Examples  Medical  Students  Prospective Students  Personnel  Donor or prospect  Financial  Contracts  Physical plant detail  Credit Card numbers  Certain management information  Information resources with access to Category-A data  Research detail or results that are not Category-A  Library transactions (e.g., catalog, circulation, acquisitions)  Financial transactions which do not include Category-A data (e.g., telephone billing)  Very small subsets of Category A data Improve Administrative Systems Security

10. Firewall Architecture (c onceptual) Improve Administrative Systems Security

11. Institutional Efforts Today  Filtering extremely high-risk traffic at the border  Proactive scanning  Security alerts  Sampling all five Internet feeds Improve Overall SUNet Security

12. Significant Security Payoff Improve Overall SUNet Security

13. Individual Efforts Today  Set good passwords on all machines  Keep NetDB entries current  Patch appropriately  Practice security at appropriate levels for the data you’re working with  http://securecomputing.stanford.edu

14. Beyond Today  Continue to improve Stanford security  Health check  Patch management  Education What’s Next

15. Contact Information: Security@Stanford.eduSecurity@Stanford.edu and 650 723-2911 http://security.stanford.edu Contact Information: Security@Stanford.eduSecurity@Stanford.edu and 650 723-2911 http://security.stanford.edu How We Can All Help Protect Stanford’s Information Resources  Be aware  Keep your systems clean and healthy  Lead by example