Information Asset Classification Communications Forum

1. Information Asset ClassificationCommunications Forum Theresa A. Masse, State Chief Information Security Officer Department of Administrative ServicesEnterprise Security Office

2. Agenda • Policy Overview • Community of Practice Update • Enterprise Information • Agency Plan • Methodology and Agency Plan • Clearinghouse and Q&A • Wrap up

3. Policy - Overview Information will be classified and managed based on its confidentiality, sensitivity, value and availability requirements. • Identify an Information Owner or Owners • Owner responsible for: • Initial Classification • Decisions regarding information management • Review and reclassification if appropriate • Proper retention and disposal • Statewide information • Agency information

4. Policy – Classification Levels • Level 1, Published - Low-sensitive information, will not jeopardize the privacy or security of agency employees, clients and partners. Examples: Press releases, brochures, pamphlets, public access Web pages, and materials created for public consumption. • Level 2, Limited - Sensitive information, may jeopardize the privacy or security of agency employees, clients, partners. Examples: Enterprise risk management planning documents, published internal audit reports, names and addresses that are not protected from disclosure.

5. Policy – Classification Levels • Level 3, Restricted – Sensitive information , unauthorized access could result in financial loss or identity theft. Examples: Network diagrams, personally identifiable information, other information exempt from public records disclosure. • Level 4, Critical - Extremely sensitive, potential to cause major damage or injury. Examples: Disclosure that could result in loss of life, disability or serious injury or regulated information with significant penalties for unauthorized disclosure, information that is typically exempt from public disclosure.

6. Policy - Compliance Time Line • Plan developed by June 30, 2009 • Level 4 identified and protected by December 31, 2009 • All other policy provisions completed by June 30, 2010 Note: Agencies are required to comply with the Oregon Consumer Identity Theft Protection Act (Senate Bill 583, 2007 Legislative Session)

7. Community of Practiceand DHS Approach Kyle Miller Department of Human Services

8. Community of Practice • Membership Representatives • Human Services • Consumer and Business Services • Forestry • Corrections • Transportation • Education • Administrative Services

9. Community of Practice Goals • Methodology document that contains best practices and links to tools and resources • Best practices for classification • Elements of information asset management • Recommendations for user awareness • Recommendations regarding policy

10. DHS Approach • Survey approach • Information exchange • Forms development • Other Initiatives

11. Enterprise Information Bret West Department of Administrative Services

12. Enterprise Information • What enterprise information does DAS “own”? • HR • Payroll • Financial • Contracts • DAS-Owned Facilities • State Network • Others

13. Enterprise Information • What does ownership mean? • DAS is responsible for determining classification levels • DAS is responsible for communicating classification levels to stakeholders • Ownership rests with DAS until information is transferred to another agency • At that point, agencies will be responsible for ensuring security

14. Enterprise Information • What does ownership mean? • Business partners (in this case DAS divisions) are responsible for classifying information assets • This is not a technology issue!

15. Enterprise Information • Example: Statewide Financial Management Application Data • The application itself will be classified at Level 4 • Combination of data elements puts the state and individuals at risk • Specific elements or reports will be classified according to the statewide policy guidelines

16. Enterprise Information • Example: Statewide Financial Management Application Data (continued) • Specific elements or reports will be classified according to the statewide policy guidelines • Currently, SFMS staff have labeled reports “confidential” or “not confidential” based on data included • Further work will be done to classify these reports according to appropriate levels

17. Enterprise Information • When will the classifications be available? • Our goal is to have all Level 4 data classified by July 1, 2008 • Our draft internal policy requires all Level 3 data to be classified by January 1, 2009 and all Level 2 data classified by July 1, 2009.

18. ODOT’S SECURITY FABRICAddressing Information Security Lisa Martinez Oregon Department of Transportation

19. Where do you begin? • Establish a “First-Strike” project team to develop your initial roll out strategy • Make sure you have the right blend of business and information technology representatives • Review and consolidate standards across all of the DAS Enterprise Information Security policies and Senate Bill 583 • Develop a “final draft” of an agency-wide assessment tool to determine where your agency is in meeting, partially meeting, or not meeting the consolidated standards • Pilot tool in a few areas to gather information on resources and time required to assess across your agency

20. Where do you begin? (cont.) • Make sure you have the support and commitment of your agency Director and his/her direct reports • Provide enough information so they understand the work effort required by their managers and employees • Have them provide names of appropriate staff to assist on a project team • Make sure that you use them to reinforce agency commitment if you encounter problems

21. Where do you begin? (cont.) • Take time to understand how other initiatives underway in your agency interlace with Information Security • Can you demonstrate benefit to other initiatives with regard to information gathering, business process mapping, and similar tasks • Be willing to share information with other project teams • Don’t overlook everyday work processes – they may be an easy opportunity to help with culture change

22. Where do you begin? (cont.) • Communicate to managers and employees why this initiative is important • Make it real by giving real life examples • Utilize internal communication tools such as newsletters, intranet pages, etc. • Acknowledge that this will take time and is not an overnight process • Consider an Information Security “hotline” • Identify Available Resources

23. ODOT Progress Report • “First Strike” Project Team established consisting of business and information technology staff and contracted project manager • Identified standards across policies and SB 583 • Developing assessment tool, criteria to measure current state against standards, glossary of terms and background materials • Identified two business areas to pilot tool • Preparing presentation for Director and his direct reports to affirm support and commitment and solicit business resources

24. Identified Key Business Challenges and Opportunities Reliant on Business Line Subject Matter Experts Competes with Other Priorities Undefined Roles and Responsibilities Requires Routine Review and Assessment to Manage Risk Reduce Agency Risk Potential to Improve Business Processes Recognize and Develop Partnerships Develop and Share Best Practices Successful Implementation Results in Improved Agency Compliance Identify Business Contacts for Each Division, Region, and Branch

25. Gather Requirements and Identify Gaps Subject Matter Experts from Lines of Business • Project Team: • Review Results • Rank Gaps Based on Risks and Priorities • Develop Blueprint of Implementation Plan High Opportunity High Risk Low Opportunity Low Risk

26. Available Resources • Statewide Community of Practice (CoP) Workgroup on Information Assets Management Policy • Tool development • Information asset classification architecture methodology • Risk assessment tools • Communication tools • Will continue sharing process documents • Web site resource • ODOT IS Tech Management Research • Inventory and identify capabilities of current information security tools • Research capabilities of other security tools, for example data leakage • Business Line Best Practices

27. Information Asset Classification John Koreski Department of Corrections

28. Methodology • Information Asset Classification Methodology • Identify information assets • Identify the owner • Conduct an impact assessment • Determine the classification • Document classified information assets • Provide education and awareness • Maintain classification and conduct continuous review

29. Security • Organization Security • Legal Implications

30. Recommended Strategy to Implement the Office of Legal Affairs Phase 1: • Identify LIO and PIOs 1/08 • Create Training • Deliver Training 3/08 • DOJ/DOC key staff • Management • Other impacted staff • Create Tracking Mechanisms • Establish Measures • Complete Phase 1 12/08 12 mos.

31. Recommended Strategy to Implement the Office of Legal Affairs Phase 2: • Info. Asset Identification4/08 • Project Mgmt. Methodology • Archive E-Mail Project • Transporting Info. Assets Project • Complete Phase 2 6/09 15 mos.

32. Recommended Strategy to Implement the Office of Legal Affairs Phase 3: • Begin Grant Admin. Strategy 7/09 • Hire Info. Security Officer (ISO) • See handout for duties • Hire Records Officer (RO) • See handout for duties • Complete Phase 3 1/11 18 mos.

33. Recommended Strategy to Implement the Office of Legal Affairs Phase 4: • Electronic Records Management • Enterprise Content Management • Timeline: approximately 1/11 – 7/11

34. Clearinghouse and Wrap Up Theresa A. Masse, State Chief Information Security Officer Department of Administrative ServicesEnterprise Security Office

35. Policy Resources • A clearinghouse-type Web site with links to best practices and tools/templates • www.oregon.gov/DAS/EISPD/ESO/IAC.shtml

36. Thank You • Other Questions • Contact: • Eva.Doud@state.or.us 503-378-3071 • Cinnamon.S.Albin@state.or.us503-373-1496