Transcript Document
Information Security The University of Texas at Dallas Education – Partnership – Solutions ISC Meeting April 10, 2015 Information Security [email protected] Information Security The University of Texas at Dallas Education – Partnership – Solutions Information Resources Update Presented by Information Resources Management Information Security The University of Texas at Dallas Education – Partnership – Solutions CISO Update Presented by Nate Howe Information Security The University of Texas at Dallas Education – Partnership – Solutions Information Security Office Initiatives Education – Partnership – Solutions • Firewall architecture review and reduction of “global allow” • Identity Finder – disabled monthly scanning • WordPress administrative pages • SANS Securing the Human videos Information Security The University of Texas at Dallas Education – Partnership – Solutions New Information Security and Acceptable Use Policy • 6 month collaborative drafting process, including more than 75 reviewers • Replaces all “policy” documents formerly published by ISO • Outlines expectations for secure use of University data and computing resources • http://policy.utdallas.edu/utdbp3096 Information Security The University of Texas at Dallas Education – Partnership – Solutions Policy Highlights • Convenient reference table covering applicability to personal and University data, on personal or University equipment • Updated language for data classification: confidential, controlled, and public data • References standards, rather than incorporating technical details into policy • All portions of the policy are subject to exemptions Information Security The University of Texas at Dallas Education – Partnership – Solutions Coming Soon: Standards • Will detail specific configuration requirements for key technologies in use across campus • • The first set of standards will cover: – – – – Desktops and laptops Mobile computing devices Servers Web applications • We will be seeking input from technical specialists on campus Information Security The University of Texas at Dallas Education – Partnership – Solutions 2-Factor Authentication Presented by Nate Howe & Brian McElroy Information Security The University of Texas at Dallas Education – Partnership – Solutions Information Security Office Problem to be Solved Education – Partnership – Solutions • Direct deposit routing number changed • Passwords can be obtained if recovery questions are predictable based on social media research • Phishing victims provide username and password by email or fraudulent website Information Security The University of Texas at Dallas Education – Partnership – Solutions Information Security Office Education – Partnership – Solutions Information Security The University of Texas at Dallas Education – Partnership – Solutions Information Security Office Education – Partnership – Solutions Information Security The University of Texas at Dallas Education – Partnership – Solutions What is 2-Factor Authentication? • 3 Categories of authentication elements: • Something you know • Something you have • Something you are Information Security The University of Texas at Dallas Education – Partnership – Solutions What is 2-Factor Authentication? • 3 Categories of authentication elements: • Something you know (username, password, PIN, questions and answers) • Something you have (ATM card, SecureID keychain, mobile phone) • Something you are (fingerprint, retina, voice) Information Security The University of Texas at Dallas Education – Partnership – Solutions What is 2-Factor Authentication? • Video of Duo: • https://www.youtube.com/watch?v=tPLxe9HUDjY Information Security The University of Texas at Dallas Education – Partnership – Solutions What is 2-Factor Authentication? • Traditional authentication only uses elements from the first category, such as username and password • Reduced risk when using more elements from the first category, referred to as “multifactor authentication” • Further risk reduction when using elements from two categories • Authentication model should match the risk; ATMs use two factors because most people like cash Information Security The University of Texas at Dallas Education – Partnership – Solutions Scope • 2-Factor is the right thing to do for our high risk connections • UT System memo defines August 31, 2015 target for: • High-value PeopleSoft transactions, in particular direct deposit • VPN remote access • Remote administrative tasks [via external SSH] Draft Timeline March Budget Proposal April -Initial committee meetings -Product decision May Awareness campaign June Moat & Mote for Admins - SSH July Cisco VPN August September PeopleSoft Direct Deposit Change Letter to UT System 9/1 Information Security The University of Texas at Dallas Education – Partnership – Solutions Cloud Storage Update Presented by Brian McElroy Information Security The University of Texas at Dallas Education – Partnership – Solutions Cloud Storage Update • We have reviewed and approved several storage providers for various use cases • We endorse box.com for the most allowed purposes • This month we are launching utdallas.edu/cometspace • Table indicating allowed use cases • Frequently Asked Questions • Link to our box.com instance Information Security The University of Texas at Dallas Education – Partnership – Solutions Box.com • The service is live – https://utdallas.app.box.com • Login using your NetID and password • 100GB storage quota • Departmental shared folders are available • 500+ early adopters are already using the service • Very few questions, even with our FAQs not available yet Information Security The University of Texas at Dallas Education – Partnership – Solutions Questions & Discussion Information Security [email protected]