office of campus information security
Download
Skip this Video
Download Presentation
Office of Campus Information Security

Loading in 2 Seconds...

play fullscreen
1 / 9

Office of Campus Information Security - PowerPoint PPT Presentation


  • 99 Views
  • Uploaded on

Office of Campus Information Security. Stefan Wahe ([email protected]) Sr. Information Security Analyst. Driving a Security Architecture by Assessing Risk. Realizing our Principles. Answering the question, “Why?” To have a common understanding of building a secure architecture.

loader
I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
capcha
Download Presentation

PowerPoint Slideshow about ' Office of Campus Information Security' - eldon


An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.


- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
office of campus information security

Office of Campus Information Security

Stefan Wahe ([email protected])

Sr. Information Security Analyst

Driving a Security Architecture by

Assessing Risk

realizing our principles
Realizing our Principles
  • Answering the question, “Why?”
  • To have a common understanding of building a secure architecture.
  • Developed based on NIST 800-27,, ISO 20071, CIC schools, and other publications.
ocis it security principles
OCIS IT Security Principles

Security is Everyone’s Responsibility

  • Security is Part of the Development Life Cycle
    • Information Privacy and Assurance; Usability; and Defense in Depth.
  • Security is Asset Management
    • Classify Information; Least Privilege; and Separation of Duties.
  • Security is a Common Understanding
    • Due Diligence; Manage Threats, Risks, and Costs; and Incident Management.
risk assessment process
Risk Assessment Process

Step 1: Letter of Engagement

Step 2: Conduct the Assessment

Step 3: Draft Report on Findings

Step 4: Communicate Findings

Step 5: Re-Assess

building a common understanding managing risk
Building a Common Understanding: Managing Risk

Impact

Likelihood

Risk

Mitigation Controls

$ Care $

$

example question
Example Question
  • Does the system maintain Configuration Management methodology that includes:
    • A documented process for reviewing, approving and implementing changes
    • Version control for software system components
    • Timely identification and installation of all applicable patches for any software used in the provisioning of the CS.
common gaps
Common Gaps
  • Common Security Gaps (examples)
    • The system infrastructure needs to be segmented with robust firewall controls.
    • Encryption controls and key management procedures should be implemented for data at rest.
    • Restricted data needs to be sanitized in non-production environments.
    • Intrusion detection, prevention and log management devices should be installed and maintained with appropriate alerting processes.
integrating a security culture
Integrating a Security Culture
  • Awareness and Training
    • SANS Secure Web Development
  • Policy Development and Best Practices
    • Restricted Information Management Practices
    • Desktop Encryption Policy
  • Centralized Resources
    • Security Event Management
    • Network Management
    • Desktop Tools
    • PKI
questions
Questions
  • How can we help you?

42

ad