Call to Order and Approval of Minutes
- Minutes from last meeting were approved with no further revisions.
- Lavagnino introduced guest Ryan Chizum, new Compliance Integration Analyst.
Old Business and New Business
Domains 1-10 have been reviewed, revised, endorsed, and prioritized.
Milford gave an update from the Committee of Data Stewards (CDS) and reviewed recent incidents.
- The CDS meets monthly. Currently working on a draft policy to formalize the process for handling information sharing with third parties. They are also wrestling with the Business Intelligence (BI) initiative and how combined data elements and metadata should be managed, handled, etc. Kim also updates the CDS on the activities of this Council.
- Review/summary of recent incidents
- Our office handled approx. 20 k incidents in 2011; roughly 5 k per quarter. These are incidents in general. These are not all security breaches. This total also includes things like copyright complaints, policy/privacy/security questions, reports of misuse/abuse, exposures that are not sensitive/personal information, etc.
- Main source of security compromises are drive-by downloads that exploit third party application vulnerabilities (i.e. Adobe software vulnerabilities). It’s important to keep software updated by applying patches. Secunia PSI is one tool we have to assist with this.
- Lost or stolen devices continue to be an issue. We saw a higher number of unencrypted lost/stolen mobile devices in 2011, as well as police requests for us to watch for stolen devices. We can do some automated monitoring for stolen devices on our network if we know the MAC address of the stolen device.
- Had several email preservation requests. We track these because they’re time consuming.
- A department’s server was compromised because the vendor’s default password had not been changed.
- It was highlighted that Exchange/Outlook public folders can be an inadvertent source of exposures.
- We have already seen some web site hacking in 2012.
Domains 11 & 12 - Review and Prioritization of Gaps
- Wasitis asked if Title IV financial aid reporting should be on the list of compliance obligations linked from Domain 12. Lavagnino reminded the Council that the Information Security and Privacy Program relates to obligations/requirements that have specific information security and/or information privacy requirements only. That’s one reason Title IV requirements might not be on the list. It was noted that HITECH will need to be added. Lavagnino will follow-up on the Title IV question with Jennifer Stevens at the suggestion of Jim Kennedy.
- Gardner had a question on meaning of 4th bullet from bottom on Domain 12 – Audit Considerations – “In order to minimize interference during the information systems audit process, and to maximize the effectiveness of such audits, protections are needed to safeguard operational systems and audit tools.” The common interpretation of this item seems to be, “do no harm,” that is, ensure that audit testing/scanning doesn’t interfere w/system operations, or as Davis suggested, protect systems/audit tools to ensure integrity of audit process.
- Broke into groups and did gap prioritization exercise for domains 11 & 12.
First Deliverable
Davis shared the idea of addressing a memo from the Council to VPs Applegate and Wheeler recapping the Council’s progress and delegates’ support of the program. Rives suggested that we consider addressing such a memo to senior management in general; not just those 2 VPs (either address those VPs and cc everyone else or send to all senior mgmt). There was a general agreement to address such a memo more broadly.
All Domains Gaps Prioritization
- Davis and Lavagnino reviewed the list of top gap priorities for all domains. The intention is to prioritize these to guide our work going forward.
- Between now and the next meeting expect a Doodle poll to prioritize first/second level priorities.
Wrap-up and Next Steps
Next meeting: March 7, 2012
Action Items
- Lavagnino will follow-up on Title IV question with Jen Stevens per Jim Kennedy.
- Chairs will consult ISO for more guidance on Domain 12 Audit Considerations question posed by Gardner. Lavagnino will draft some wording and pass it by Gardner prior to adding it to the Program.
- Draft memo highlighting Council’s progress and support of the program for distribution to senior management.
- Send out Doodle poll to prioritize domain gap priorities.
Meeting Prep Materials
- See Oncourse for meeting prep materials.
- See external link: https://protect.iu.edu/privacy/program/safeguards/11
- See external link: https://protect.iu.edu/privacy/program/safeguards/12
Meeting Information
Date
January 25, 2012
Time
2pm
Location
Poplars 017
Attendees
In Person
Tom Davis (Chair)
Mike Gardner
Jim Kennedy
Jeff Lambright
Merri Beth Lavagnino (Co-Chair)
Kim Milford
Dan Rives
Chris Viers
Eric Cosens (staff)
Sherrie L. Denney (staff)
Scott Wilson (staff)
Ryan Chizum (guest)
Via Video
Doug Wasitis
Via Audio/phone
None
Absent
Joe Scodro
Joan Hagen
Marcia Gonzales
Philip Cochran
Mary Frances McCourt