Transcript Steve Garner Ag Communications Services IT Manager Concentration on Securing ‘Sensitive Data’  Social security numbers  Youth data  Credit Card/Financial Info  Home Addresses, DOB.

Steve Garner
Ag Communications Services
IT Manager
Concentration on Securing
‘Sensitive Data’
 Social security numbers
 Youth data
 Credit Card/Financial Info
 Home Addresses, DOB
Securing PII data
Personal
Professional
 Account List
 Account numbers
 Passwords
 User IDs
 Academic Records
 Grades
 Student Information
 Company name
 Transcripts
 Financial Data
 Quicken files
 Taxes
 Cancelled checks
 Legal Documents
 Birth certificates
 Passports
 Credit Card photos
 SSN/PUID
 Recommendation letters
 Academic challenge materials
 Research Data
 Names of children
 Survey results
Why are we doing this?
 LAWSUITS?
 Lost/stolen computing devices/data
 Hackers and Malware
 Must reduce the number of electronic files available
 Protect our clientele
 Assure them that PII is safe with CES
Acceptable Use Policy
 The UK Acceptable Use Policy contains official
guidelines for the responsible use of information
technology resources at the University.
 The Acceptable Use Policy describes your rights and
responsibilities when using and accessing university
resources.
 Acceptable Use Policy
http://www.uky.edu/regs/files/ar/ar10-1.pdf
Layered Defense
 Update Software
 Use Antivirus Software
 Use Strong Passwords
 Secure your Physical Environment and Encrypt
Sensitive Data
 Keep Wireless Devices Secure
 Practice Online Safety
 Back Up Your Data
Update Software
 Operating Systems and Applications
 Auto Update Win XP and Win 7
 Update software on mobile devices too
 Restart Computer ? YES!!!
Antivirus Software
 Keep Forefront up to date
 Microsoft Forefront can be downloaded at
http://download.uky.edu
Sensitive Data Locations?
 My Documents, Ctyfile, and other folders on hard
drives/media, Access databases
 Email
 Folders
 Sent items
 Archives
 Deleted items/Trash
 Backups on portable media
 Flash drives
 Servers
What to do
 Delete unneeded files
 Empty recycle bin
 Print and store information then delete source file
 Consolidate needed files to minimize locations
 Encrypt and/or password protect sensitive files
 Don’t keep inactive old devices around
 Wipe old hard drives before reusing hardware or
disposal
Password Guidelines
 Don’t always use the same password
 Don’t share your passwords
 Don’t email it to anyone for any reason
 Use Strong Passwords
 At least 8 characters long
 Avoid dictionary words, phrases, quotes, etc.
 Mix of upper and lower case letters
 Use number and non-letter characters
File Protection
 Password protect/encrypt Office files that contain
sensitive information
 Can encrypt any file/folder on computer
 Encrypt sensitive information that HAS to be stored
Encryption
--The process of converting messages, information, or data
into a form unreadable by anyone except the intended
recipient.
encryption—crypt—comes from the Greek
word kryptos, meaning hidden or secret
About 1900 BC An Egyptian scribe used non-standard
hieroglyphs in an inscription. This is the first documented
example of written cryptography.
So nothing new about encryption!
Automatic Encryption
 BitLocker
 Windows 7
 Secures entire drive in background
 TrueCrypt
 Free open-source disk encryption
 www.truecrypt.org
What is True Crypt
 Free open-source disk encryption software for
Windows, Mac OS X
 Main Features: Creates a virtual encrypted disk
within a file.
 Encryption is automatic, real-time (on the fly)
and transparent.
 Parallelization and pipelining allow data to be
read and written as fast as if the drive was not
encrypted.
 Hidden volume
Mobile device Security
 Password protect the login
 Encrypt sensitive data
 Automatic Encrypted flash drives are available
 Physically secure with lock
 Location Services: find myiPhone(iPad, etc.) also
similar products for Android devices(Prey)
Public Wireless
•
•
•
•
•
•
•
Airports
Hotels
Coffee Shops
Bookstores
Neighbors Access Point
Use UK’s site licensed VPN Client
http://download.uky.edu
Cisco VPN Client for Windows
Practice Online Safety
 Only download what you trust, and even then be




wary.
Limit what you download to your work computer
Don’t accept downloads from strangers
What else are you getting with the “free” stuff?
“Free” music and file sharing programs are wide
open doors for hackers.
Backup Your Data
 It’s not a matter of IF, it’s a matter of when.
Non-technical Protections
 Lock your doors
 Hide your valuables
 Make your device hard to lose
 Attach to keychain
 Lanyard
 Whatever helps
Questions?