Upload File

it security policies and campus networks the dilemma of translating good security policies to...

  • Home
  • Documents
  • IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer
25
IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer Trinity College Dublin 22/05/2007

Upload: evan-phelps

Post on 17-Jan-2016

213 views

Category:

Documents


0 download

Report

Tags:

TRANSCRIPT

Page 1: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

IT Security Policies and Campus Networks

The dilemma of translating good security policies to practical campus networking

Sara McAneneyIT Security OfficerTrinity College Dublin22/05/2007

Page 2: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Overview

• Creating the Security Policy

• The Implementation Dilemma

• What makes the Campus Environment Different?

• The Answer

• Case Study: Trinity College Dublin

Page 3: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Campus Networks and Security

Cultural Resistance

Gradual infiltration

Acceptance

Period of rapid catch up

Maturity?

Page 4: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Policies Implemented 2006

*ECAR – Educause Centre for Applied Research - 2006 IT Security Survey 492 Respondents

Page 5: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Creating the Security Policy

• ISO 27001• Relevant Legislation• Organisational Environment• Identify Assets• Resources E.g. USICA Information

Security Toolkit

Page 6: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Policy

• Main Policy• Supporting policy areas:

–Email–Internet use–System development etc

Page 7: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer
Page 8: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Implementation….

• Governing Body Approval• Communication to Users• Translation to Operational Procedures• Enforcement

Page 9: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Campus Implementation Difficulties

• Traditional ethos of free & open access to systems and information

• Diverse user base - Admin, teaching, research, grids, commerce, corporations, clubs, societies, college life, public guests

• Complex collaborative arrangements - institutions, individuals and industry

• Need to facilitate the rapid adoption of emerging & often immature technologies

• Diversity and decentralised management…

Page 10: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Traditional Implementation

Management

Area Head Area Head

End User End User

Policy Dissemination

Page 11: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

University Structure

• Governing Body

• Committees

• Schools/Faculties

• Admin Areas

• Student Representatives

• Commercial Entities

Page 12: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Governing Body

CommitteesAdmin Body

Academic Body

Admin AreasSchool/Faculty

Campus Company

Research Affiliates

Student Body

Student Society

Student clubs

Committees

User Groups

Committees

User Groups

End User End User

End User End User

End User

Page 13: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Helpful to Focus on Similarities with all Large Networks

• Provide High Quality, Flexible Services

• Protect Confidential data

• Protect against Internal and External Security Threats

• Comply with Legislation

• Contingency and Disaster Recovery Planning

Page 14: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

• Despite/Because of complexity and diversity vital to implement IT Security Framework

• Framework which facilitates & protects

Goal

Page 15: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

The Answer?• Management Structure - Establish IT Security

Governance/Management Structure

• Involve Stakeholders - Identify key stakeholders and involve in creating policy, encourage ongoing communication.

• High Value Assets - Identify core IT Assets and prioritise

• Segregation - Functional and Security Boundaries

• Flexibility – make provision for high risk activity - Research, new technology etc

Page 16: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Case Study: Trinity College Dublin

• July 2003 - IT Security Policy Approved by College Governing Body

• 2004 - Awareness Exercises- Email, Booklet, website

• 2004-2006 - Translation to Operational procedures

• Ongoing - Adoption of Security Technologies

Page 17: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Security Management System

Page 18: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Implementation- College IT Security Governance

Governing Committee

Autonomous Network

Trinity College

Data Network

Autonomous Network

Local Area IT Support reps

End Users

End User End User

Page 19: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Implementation

• Internal Agreements - Central computing department & local IT interests.

• Regular Communication• Dissemination to IT Administration Staff &

End Users• Adoption of Technologies

Page 20: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Supporting Documentation

• Network Security • Internet Use • Email Use • Authentication/Passwords• Virus and Spam • Software Development • Data Backup • Disaster Recovery • Remote Access • Third Party Access • Legal Compliance Guidelines

Page 21: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Adopting Technologies

• Network Security– VPN, VLANs, Firewall, IDS, NAC,802.1x, guest network services, eduroam

• Host Security– Automatic Updates, Centrally Managed AV

• Enterprise Directory – secure Authentication• Removal Insecure Protocols

Page 22: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Wireless Services

Specialized Research

Specialized Production,

Cash Registers etc

AutonomousNetworks

Student Services

Teaching & General

Research

Central Services

Web, Mail, Proxy etc

Security Boundaries

Page 23: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Assessing the Progress

• Improved communications – move away from duplication of service

• Improved focus – strategic planning• Incident Reporting• Internal Audit – systems, applications,• External Audit• ISO27001 Certification

Page 24: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

Future Challenges

• Exploding User Numbers – students/public on network, Guests, Eduroam

• Non traditional networked devices - PDA’s, phones, Xboxes, cameras, CEPOS

• Disappearing Network Boundary• Rapid Adoption New technology • Changing Threat profile• Data privacy concerns – Help users protect their

personal/financial data• More important than ever to deal with these

challenges via a strong IT Security Framework

Page 25: IT Security Policies and Campus Networks The dilemma of translating good security policies to practical campus networking Sara McAneney IT Security Officer

References:

http://www.tcd.ie/itsecurity/policies/index.php

http://www.educause.edu/ecar

http://www.ucisa.ac.uk/

http://www.tcd.ie/itsecurity/policies/index.php
http://www.tcd.ie/itsecurity/policies/index.php
http://www.educause.edu/ecar
http://www.ucisa.ac.uk/

Cisco ISE for Campus Security

Campus Safety and Security Registration...Campus Safety and Security Registration Thank you for updating your registration information for the 2018 Campus Safety and Security data

JEANNE CLERY ACT YOUR ROLE AS A CAMPUS SECURITY AUTHORITY Campus Security Authority Training January 17, 2014

Fractal Geometry Dr Helen McAneney Centre for Public Health, Queen’s University Belfast

Campus Security Authority Reference Manual

Campus Security Authority Training - Oregon Stateoutreach.oregonstate.edu/sites/default/files/pg_resources/cl_2nd/... · Campus Security Authority Training. ... • Statutory Rape

Campus Security Authority Department Heads Jeanne Clery Disclosure of Campus Security Policy & Campus Crime Statistics Act Chief John M. Reid

CAMPUS SECURITY OFFICER PROGRAM · CAMPUS SECURITY OFFICER PROGRAM CSO Training Module I Student Guide 4 D. Emergence of Federal Legislation on Campus Security Reading: Emergence

CAMPUS SAFETY & SECURITY TASK FORCE 2014 CAMPUS SAFETY & SECURITY … · 2014-10-31 · CAMPUS SAFETY & SECURITY SUMMIT. REED CENTER, MIDWEST CITY, OKLAHOMA WEDNESDAY, OCTOBER 29,

IT Security Policies and Campus Networks Translating security policy to practical campus networking Sara McAneney IT Security Officer Trinity College Dublin

CAMPUS SECURITY CYBER SECURITY - Nevada System of Higher

ACST Campus Security Overview

PENNSYLVANIA COLLEGE CAMPUS SECURITY ASSESSMENT …

Campus Security Authority Training · Campus Security Authority Training. The Jeanne Clery Disclosure of Campus Security Policy & Crime Statistics Act. ... Campus safety personnel

Combinatorics and Campus Security - Claremont

description: tags: campus-security statistics

Campus Security Poster

General Data Protection Regulation (GDPR) · Regulation (GDPR) Are you ready? Jennifer Ryan - Data Protection Officer Sara McAneney –IT Security Officer 9th November 2017. There

Campus Emergency Management & Security Update

Campus Security Authorities

Campus Safety and Security Committee/ Campus Behavioral Intervention Team

USC Campus Security

Campus Security Authority Module Closed Captioning Welcome to the campus security authority module.. Campus Security Authority

Your role as Campus Security Authority under the Jeanne Clery Campus Disclosure of Campus Security Policy and Campus Crime Statistics Act (the “Clery Act”)

Campus Safety & Security Committee

Study of campus network security

Campus Laptop Security 2010

CAMPUS SECURITY & SAFETY

July 18, 2012 Campus Bridging Security Challenges from “Panel: Security for Science Gateways and Campus Bridging”

Campus Technology Day Campus Security Review

Campus Security Commission

Campus Crime and Security Campus Fire Safety 2012 Annual Reports

CAMPUS SECURITY OFFICER PROGRAM - Improving … · CAMPUS SECURITY OFFICER PROGRAM CSO Training Module I II Student Guide 4 B. Campus Security Officer Professionalism and Ethics Reading:

Campus Area Network Security

Campus Safety & Security