Affiliated Information Security Collaborative. An Affiliated Enterprise Approach to Information Security Deans and Vice Presidents Meeting April 17, 2014. Establishment of an Affiliated Security Collaborative .
An Affiliated Enterprise Approach to Information Security
Deans and Vice Presidents Meeting
April 17, 2014
There is consensus among UMB and UM Medicine IT Network CIOs and technology leaders that an enterprise-wide, collaborative Information Security Program and Assessment Plan needs to be established and implemented;
It is the responsibility of IT Leaders to establish and administer an Information Security Program that adheres to Federal, State, University, and other mandatory security rules, requirements and guidelines in order to protect the confidentiality, integrity, and availability of data;
IT leaders will establish and share operational policies, practices, and procedures that result in effective information security and the protection of information assets, protected health information, and patient and employee personal information;
The IT leaders will establish an Information Security Working Group as a means of coordinating activities that respond to information security vulnerabilities and risks, and cyber-attacks, that cross operational intersections.
Each organization is responsible for developing, implementing, monitoring and funding their respective security program.
Participants understand the importance of harmonizing security program efforts across the enterprise and pledge to share all pertinent information needed to ensure the security posture of each organization and the combined IT systems and infrastructure which represent the “affiliated enterprise”.
UMB as the core IT data network infrastructure and Internet Service Provider for the medical campus will serve as the coordinating body for the enterprise Security Collaborative.
The Affiliated Security Collaborative is a multi-organizational structure formed to facilitate information sharing and coordination of effort to expedite an organized response to security events.
Affiliated Enterprise Model:Information Security
UMB Information Security
UM Medicine IT Network
Information Security Working Group
Affiliated Enterprise Services
Collaboratively assess, identify, and report on any information security risk or vulnerability;
Define common areas of risk as they relate to information security at appropriate operational intersections;
Share information security strategies, processes and practices that adhere to local, state, and federal regulatory rules and requirements in order to avoid duplication of effort;
Share technology platforms and information security knowledge among technology professionals in order to broaden knowledge and expertise;
Collaborate on the improvement and strengthening of information security policies, practices, and solutions, and ensure coverage across the enterprise;
Develop a global communication strategy to promote and expand information security awareness across the UMB affiliated enterprise.
Continuous Security Monitoring
Announcing and communicating the Information Security Collaborative and Assessment Plan;
Forming the Information Security Working Group (ISWG)
Members of the ISWG will work to:
Develop an inventory of information technology and data assets;
Apply a uniform classification category for each data asset;
Run network scans to identify any existing vulnerability;
Investigate servers and computers to determine if they contain sensitive data: SSNs, PHI, PCI;
Check network and server/computer configuration and firewall rules to determine if they comply with security standards.
Conducting a thorough and complete risk/vulnerability assessment, using a detailed checklist, for any found sensitive, high-risk data on computers or servers;
Work with the operational leaders to determine the existence of any non-electronic, hardcopy records that contain sensitive data, e.g., SSNs, PHI, PCI;
Analyzing the information collected to determine the actual risk to the critical assets and propose appropriate mitigation for areas identified as weak or procedures not implemented;
Preparing a report of the findings; including a list of assets, threats and vulnerabilities; risk determination; recommended controls; and cost benefit analysis; to be shared with each organization’s executive leadership
Performing a final review of information security best practices, processes and procedures with the unit.
Announce the information security affiliated collaborative initiativeApril 2014
Develop a high-level plan for the affiliated enterprise-wide information May 2014
security collaborative; and create the information security
Initiate the assessment plan and activities in UMB schools, June 2014
and UM Medicine IT network
Complete the assessment plan and activities for UMB central offices:
Registrar; Institutional Research and Accountability; Financial Aid; Financial
Services; Human Resource Services; Sponsored Projects Accounting and
Compliance; Public Safety; Parking ServicesAugust 2014
Complete the Assessment Plan and Activities in Schools and UM Medicine IT Network TBD