staying ahead of the storm: know your role in information security before a crisis hits

Staying ahead of the storm: know your role in information security before a crisis hits

Jason Testart, ISTKaren Jack, Secretariat

Topics

Part I: Policy Overview (Jason) Part II: What to do when there’s a breach (Karen)

WatITis | Strengthening Collaboration | December 8, 2009 | Staying Ahead of the Storm

Policy Goals

Reduce our exposure Comply with laws and regulations Focus our information security efforts


Information Security is about maintaining our integrity, not our egos!

STOP HOARDING INFORMATION!

On the topic of exposure…


You can’t compromise what’s not there

REDUCE what we collect

REDUCE what we duplicate

REDUCE what we keep


Reduce your risk off campus

Remote access or data encryption.

Use a secure connection.

Beware of un-trusted computers!


Don’t forget about Disposal!

Make sure that all confidential information is erased or not recoverable before computers, electronic storage media, or other electronic devices are disposed of.

See Electronic Media Disposal Guidelines


Information Security Policies, Standards, and Procedures

Defense Production

Act

Privacy Laws

Payment Card

Industry DSS

Policy Development: Avoid disjointed policy statements


Policy Documents

Statement on Security of UW Computing and Network Resources

Policy 8 – Information Security Statement on Electronic Business Breach Notification Procedure Computer Security Incident Response Procedure IT Security Standards (all under development)

Mobile Device Security Standards Standards for Secure Hosting Password Policy


Security Classifications (from Policy 8)

Confidential

Restricted

Highly Restricted


Public

Roles & Responsibilities(from Policy 8)

Information Steward: Governs the use of information

Information Custodian: Keeper of the information

User: Makes use of the data


Example: Vision Test Results @ Optometry

Who is the steward? Director, School of Optometry

Who is the custodian? Support staff in Optometry who handle paper records. Systems Administrators of systems where results are

stored. Who is the user?

Faculty, and students in Optometry.


Steward Responsibilities

Classify information. Assess risk. Delegating operational responsibility to one or

more Information Custodians. Establishing and maintaining rules and procedures. Ensuring Compliance.


Custodian Responsibilities

Knowing the rules, set by the steward. Understanding how information flows. Making sure information is available to authorized

people and processes when needed. Making sure the integrity of information is

maintained. Making sure information is not available to

unauthorised people or processes.


Tips for Classifying Data

Classify information that is obviously public. Identify information that is Highly Restricted.

Do you really need it? You need permission to use it.

…then Restricted We can help you, if needed.

Whatever’s left is either obviously confidential or it’s not obvious.

The information steward makes the call on public vs. confidential.


What to do when there’s a breach

Information Security Breaches

make headlines

“Servers containing

sensitive health information

stolen”

“Box of applications to

university mistakenly

thrown away”“Briefcase containing

sensitive student information lost”


Despite your best efforts, there’s been a breach

Server Memory stick with grades Information sent to wrong recipient Student assignments


What do I do?


Incident Security Breach Response Procedure (http://www.adm.uwaterloo.ca/infosec/guidelines/breachprocedure.html)

Computer Security Incident Response Procedure (http://ist.uwaterloo.ca/security/policy/ir.shtml)

Information Security Breach Circumvention of security controls Unauthorised use of information Unintended exposure of information

Purposes Legislation Identifying the cause(s) and prevention

http://www.adm.uwaterloo.ca/infosec/guidelines/breachprocedure.html

http://ist.uwaterloo.ca/security/policy/ir.shtml

Incident Security Breach Response Procedure

• What happened?

• Act with care, but act with speed

Contain / identify scope

• Nature of breach• What was disclosed• To whom• And, for how long• Advise others

Contact the privacy

coordinator to advise re:


Notice – what it might entail

Restricted Information Personal information Personal health information Information subject to non-disclosure Passwords or private encryption keys

Notice Extent and specifics Steps individuals should take to protect themselves Immediate and long term solutions Privacy Commissioner of Ontario / FIPPA


What’s the purpose of all this?

Individuals may need to protect

themselves

Legislation

It’s the right

thing to do


Results

Best PracticesLocal users. Others at UW.

Lessons Learned?

Changes to procedures? Useful information to share?Investigation

Have notice requirements been met? Review circumstances of the breach.


Final thoughts

Shared responsibility

Treat others’ personal information as you would wish others to treat yours


staying ahead of the storm: know your role in information security before a crisis hits

Documents

sure information

information steward

integrity of information

information securitystatement

information flows

confidential information

hoarding information

information custodians