1. Robert Ono Office of the Vice Provost, Information and Educational Technology September 9, 2010 TIF-Security Cyber-safety Plans for 2010

2. Security Tools Update Incident response plan unit template released in 2009 Audit log practices – training in September 2010 Physical security – new security template released in 2009 Security awareness training – 2010 system-wide workgroup Equipment release - multi-function printing device guidance released to campus/UCDHS in 2010 Web application security vulnerability scanning – security lifecycle development training in August 2010

3. 2010 Cyber-safety Policy Revisions Clarify mobile devices integration within CS standards Broaden reference to “computers” to include mobile devices Require firmware updates for mobile devices Remove AV requirement for mobile devices Require mobile devices to use at least a four character password, where available Require mobile devices to support remote wipe capability, where available Modify annual survey items to include mobile devices Modify annual survey password references to include passphrases

4. Recommended Cyber-safety Survey Revisions Update definition of “restricted information” Existing definition: Restricted information is defined as data that is considered sensitive to some degree and may include personal information or information whose unauthorized access, modification or loss could seriously or adversely affect the university. Proposed definition: Restricted information describes any confidential or personal information that is protected by law or policy and that requires the highest level of access control and security protection, whether in storage or in transit. (BFB IS-3, 5/20/2009)

5. 2010 Cyber-safety Survey Items SOFTWARE PATCHES AV Software Removal of insecure services Secure authentication PERSONAL INFORMATION PROTECTION* Firewall Services* PHYSICAL SECURITY* Open email relays Proxy services AUDIT LOGS* BACKUP/RECOVERY* Security training* Anti-spyware* EQUIPMENT RELEASE* INCIDENT RESPONSE PLAN* WEB APPLICATION SECURITY* 2009 survey items Underline: needed improvement areas

6. Cyber-safety Survey Schedule October through December 2010: Survey data collection January through February 2011: Analysis and reporting to units, as appropriate March 2011: Reporting to CS oversight committee, Technical Infrastructure Forum and Campus Council for Information Technology April 2011: Report to Chancellor’s cabinet

7. Continued Support of Organizational Effectiveness Web application scanning service Anti-malware licensing Computer host vulnerability scanning and reporting Intrusion prevention capability at network border Network firewalls at network border Authentication services and identity and access management Personal identity information scanner – licensed for Windows and Mac OS X InCommon certificates for SSL Encryption for email with restricted content Forensic investigation and reporting assistance