Meeting Minutes for April 30, 2012

Call to Order and Approval of Minutes

• The meeting was called to order.
• Guests Joe Butler, Tom Zeller, and David Greenberg were introduced for the Mobile Security Report.
• Motion to receive the minutes from the last meeting without modification was made, seconded, and carried.

Old Business and New Business

• CDS update (Kim) – Announced the CDS retreat in May. The CDS is also looking at data repositories & the types of data for which they’re suitable.
• Incident update (Kim) – We have not experienced a serious incident (other than “normal” things) since the last update.
• Memo to President's Cabinet (Tom) – VPs Applegate and Wheeler sent a communication to the President’s cabinet. Mark Bruhn, Tom, and Merri Beth have been invited to attend Chancellor Bantz’s Council of Deans meeting to give a brief overview of the Information Security & Privacy Program and the Risk Council.
• Program Update (Merri Beth) – Still pursuing the “12 domains in 12 months” communications and videos (Merri Beth). Domains covered so far include Risk Assessment and Treatment (Feb), Policy Administration (Mar), and Organization (Apr). The Asset Management domain is on deck for May followed by the Human Resources domain in June, and the Physical and Environmental Domain in July.
  • MaryFrances asked whether we are coordinating with relevant offices, such as Capital Assets. Merri Beth explained that the assets to which the program refers in the Asset Management domain aren’t necessarily the same as those we would normally think of as “capital” (i.e. $5k+). Some are, obviously, but in addition, for information security and information privacy purposes, we will often need to manage other assets that do not count as “capital assets” according to IU policy. We tried to make this clear on the domain web page and link to the capital assets policy there for those physical assets over $5K; however, she will review the domain web page again to make sure this is clear.
  • Domain resources and links are continually being added and revised. The Council will be informed of significant developments or changes.
  • Our first year communication focus is on our LSP/IT Professional community as well as the Committee of Data Stewards through Kim.
  • Administration will hear about the program via the memo that will be sent.
• University Policy Web Site (Kim) – The university policy site (http://policies.iu.edu/) is now live. It is meant to be a central repository for all university policies. Format of policies is being standardized. The search engine is in transition but should be finalized soon.
• Governance Risk and Compliance Update (Merri Beth):
  • Training - Almost every compliance activity needs training & signed agreements. We have acquired an e-learning tool to provide an infrastructure for units to leverage for these purposes. We’re calling it E Train. A Compliance Exchange group/list has also been formed over the last couple of years (approx. 80 people) and has been advising on training system requirements.
  • Compliance Tracking – Acquisition of a Governance, Risk, & Compliance (GRC) tool is in the works. We are hoping to get GRC funding by July 1 to pick one of the 2 finalist products. Some of the tools capabilities were discussed (ex. self assessments, checklists, metrics and statistics, etc.). We have a list of 15 initial projects proposed for the GRC from poll of the Compliance Exchange and IT Managers lists. Example: Third Party Information Sharing Risk Assessments.

Update on Classified Research

Marcia Gonzalez – Marcia discussed with university export staff. So as far as we know, no such research is occurring at the university. Any such research that might occur should not be under the purview of our people in their role as faculty members, but would rather be on a personal/private consulting basis.

Update on Top Five Gaps Projects

• Major IT Facilities Review & Network Management Review (Tom) – The first item was called major “data center” review. It was expanded to major “IT facilities” to include telecomm hubs, etc. The Council received a PDF of the project plan for both of these reviews. Major steps for these reviews and progress were discussed.
• Roles and Responsibilities Standard (Merri Beth) – Reviewed roles and responsibility document (https://protect.iu.edu/cybersecurity/policies/ISPP-25/25.1 ). This was a long detailed document (difficult to get through). Therefore the formatting/presentation of this document has been improved by breaking out the roles/responsibilities to their own pages (http://protect.iu.edu/cybersecurity/policies/ISPP-25/25.1). Wasitis asked if there is central coordination these roles. MBL – there’s currently no central coordination of roles in our decentralized environment. Currently coordination is encouraged through communication and spot checks by Internal Audit.
• Risk Assessments (Kim) – The risk assessment referred to by the program is below the level of enterprise risk management. Our thinking at this point is that we need a couple levels of assessments; a ground level/tactical quick assessment tool for units to determine necessary information and technology safeguards, and a more unit level risk assessment tool to help our units think about risk from the perspective their unit business processes. Both would be from an information security & privacy perspective and complement each other.
• Policy Communication Process (Kim) – The Communications Office has been engaged to insert messages into other communications. We are still looking/thinking about creative ideas to increase awareness. Tom asked about the role the Policy Advisory Committee could play. Once the policies are all gathered into one web site (policies.iu.edu) perhaps there could be some kind of assessment as to what are the most important policies to communicate. It was noted that the PAC is still a fairly new group.

Mobile Security Report

The report of the Mobile Security Committee was distributed prior to the meeting. The meeting was running a bit ahead of schedule so Eric & David gave a few introductory comments and provided context on mobile security. An implementation team is being formed to implement key recommendations from the Mobile Security Report. We are continuing in the direction of requiring safeguards on mobile devices (including personally owned) that people choose to use to access university information. The focus is on protecting data regardless of the device from which it is accessed. Target implementation target is August 2011 (or possibly later in the fall). Tom Zeller and Joe Butler went into more detail regarding the mobile security committee and report after joining the meeting. The mobile environment/risks at IU were also discussed. Technical capability to manage device safeguards will initially be thin, but is expected to grow as the mobile space matures.

Wrap-up and Next Steps

• Next meeting is scheduled for 6/25/2012.
• The Council will then move to a quarterly schedule.

Action Items

• Merri Beth will look at language and make necessary adjustments to Asset Management domain and other communications so that the goal of this domain is not confused with Capital Assets.
• Merri Beth will look at roles with respect to responsibility to determine how delegation would work with these roles.
• Mary Frances will look for policy that deals with fiscal officer accountability.

Meeting Information

Date

April 30, 2012

Time

2-4pm

Location

Poplars 017, Video Bridge 223739

Attendees

In person

Tom Davis (Chair)
Merri Beth Lavagnino (Co-Chair)
Mary Frances McCourt
Kim Milford
Eric Cosens (staff)
Mike Gardner
Jeff Lambright

Via video

Doug Wasitis
Philip Cochran
Laurie Sullivan (for Jim Kennedy)
Marsha Gonzales
Joe Butler (Guest - UITS)
Tom Zeller (Guest - UITS)

Via Audio/phone

David Greenberg (Guest - UISO)

Absent

Joe Scodro
Joan Hagen
Jim Kennedy (Laurie Sullivan attended in place)
Dan Rives
Chris Viers