Call to Order and Approval of Minutes
Passed motion to approve minutes of prior meeting as received.
Old Business and New Business
- CDS update (Kim) – Committee of Data Stewards typically meets monthly to discuss issues related to institutional information (ex. privacy), and vetting proposals (ex. mobile security). CDS has recently been reviewing UITS systems vis-à-vis suitability of controls/safeguards for different classifications of data (ex. OnBase, SharePoint). Plan to begin developing matrices and tools for system owners to self-assess their safeguards.
- Incident update (Kim) – The total number of 2012 incidents were fairly typical, although slightly higher than the previous couple of years. The number of “botted” hosts rose significantly. Stolen computers/hardware were down slightly (although we saw an uptick in January 2013). Compromised accounts rose from 400 in 2009 to 2,000 in 2012. Sensitive data exposures remained fairly consistent. Copyright complaint notices decreased significantly from September to December 2012. Cost associated with remediating an incident can be significant. As an example, one web compromise of K-12 student information cost approx. $60,000.
- University Policy Web Site and/or Policy Advisory Council (PAC) update (Kim) – In response to trustee concerns, a policy draft on the provisioning of IT services, IT-28, has been developed. It focuses on mitigating cyber risks and reducing cost/redundancy across the university by requiring units to leverage core/common IT infrastructure and services where such leverage makes sense (i.e. to the greatest degree practicable). The draft is beginning to circulate among stakeholders.
- Program Update: 12 domains in 12 months (Merri Beth) – Awareness effort is progressing. The Domain 10 video has been posted. The Domain 11 video has been recorded and will soon be posted. An identity verification document has been added to the Security and Privacy Program.
- Governance Risk and Compliance (GRC) and E Training Update (Merri Beth) - Merri Beth is working on Data Privacy Month to publicize and put program together (https://protect.iu.edu/privacy/training/dataprivacyday ). Three privacy awareness training modules have been purchased and loaded into the E Training system. Their availability will be publicized soon. HIPAA materials have also been loaded into the E Training system. The GRC system is in a holding pattern, due to waiting on Kuali activity to subside. GRC system will initially include modules for HIPAA security and privacy assessment, a process for retiring storage devices, and a process for third-party vendor assessment for situations involving critical information.
Internal Audit - Audit Plan and Risk Council Implications (Gardner)
- IAUD builds an audit plan based on risk after interviewing key individuals across the university. The goal is to focus on the right things. Mike shared the general issues and plan related to information security and privacy that IAUD came up with after their most recent assessment. A significant part of the current audit plan relates to IT general controls, cloud computing, disposal of equipment, significant systems/applications (ex. Time, and Kuali financial conversion), and HIPAA. Mike encouraged feedback from the council on significant topics/issues that may not be reflected in the audit plan, and for suggestions to improve the risk assessment/audit planning process.
- Over the last few years there have been several “messy” audit reports, and the trustees have noticed continued IT findings, in large part inherent in our decentralized environment. The IT-28 policy draft Kim mentioned has been developed to address the findings often found in IT general controls audits.
- The council discussed their potential involvement in the risk assessment/audit planning process, and the consensus was that a special meeting of the council with Internal Audit to focus on risk assessment/audit planning would be time well spent.
Transborder Data Flow Assessment (Lavagnino and Viers)
This is a significant issue typically dealt with by privacy officers of large organizations. One of the most prominent privacy requirements for the university is that of the European Union. The EU’s data directive requires certain safeguards if data is to be transferred to the U.S. under certain circumstances. However, the directive doesn’t apply if an individual transfers their own data/data about themselves to another country. However, it could come into play during the student recruitment process if IU seeks to transfer such information either ourselves or by a contracted third-party provider (ex. info/contact cards filled out by prospective students, then taken back to the office and entered into an IU system/transferred to IU). Merri Beth and Chris are working together to analyze the requirements, risk, and the current process to promote IU’s compliance. Dan Rives raised the issue of foreign citizens and U.S. citizens working for IU in foreign countries. A small group is also working on a project to look at this situation and identify the regulations involved.
Information Handling Standards (Lavagnino and Milford)
Merri Beth shared selected draft information handling standards and gave an overview of their history, development, and current status (drafts). What’s the appropriate way to move this information forward (i.e. tipsheets?, guidelines?, recommended practices?, checklists?)? Gardner was concerned that there’s no requirement to follow the guidance, and wondered how it would be kept up to date. The council recognized the value of the information and would like to see it move forward in some form. Discussed various ways to move forward, make format more useful, create awareness, etc.
Update on Top Five Gaps
- Major IT facilities review (Davis) – Contacted technicians across the university responsible for managing network components and major IT facilities. Analyzed safeguards that should be in place. Identified risks. Listed findings and recommendations for these areas. Tom shared the resulting documents as a check to make sure that this is what the council intended when they prioritized this gap. Although numbered, the recommendations in the docs are not intended to be in priority order. How do we judge the cost/benefit of the recommendations? A cost analysis of the recommended safeguards has not been done. Tom will talk with the team about approaching facility/service owners to develop cost estimates.
- Roles and Responsibilities (Lavagnino) - Working to revise to make these documents more usable so we can make them a standard. GRC access is also by role. So we’re using the same titles there to test their practicality.
- Risk Assessment (Milford) – The context of this gap is to help units assess their own risk rather than enterprise level risk. There are different approaches ranging from narrative to more quantified. We are looking at different models (i.e. factor analysis of information risk, FAIR). One challenge is to develop a tool/method that is simple enough for units to use, and yet provides useful information at an appropriate level of detail. Will share more at a future meeting.
- Policy Communication (Milford) – We have had some challenges with staffing/resources/availability. Our sense is that our recent communications on the Mobile Security Initiative went well. Merri Beth noted that many corporations have a formal process (via GRC) whereby all employees certify that they’ve seen/read new policies. This benefited Morgan Stanley recently in a case where an employee went “rogue,” and they could prove that the employee had been made aware of the relevant policy/law multiple times. However, universities are very different than corporations in terms of organization, variety of employees, etc. So, how do we effectively communicate with our people within the context of the university culture in an age of information overload? Could something similar to FODS (Fiscal Officer Development Series) be developed for the Information & IT area?
Wrap-up and Next Steps
Next meeting April 22, 2013Action Items
Relative to major IT facilities review gap, Tom will talk with the team about approaching facility/service owners to develop cost estimates for addressing recommendations.
Meeting Information
Date
January 23, 2013
Time
1-3pm
Location
Poplars 017, Video Bridge 223739
Attendees
In Person
Tom Davis (Co-Chair)
Merri Beth Lavagnino (Chair)
Eric Cosens (staff)
Dan Rives
Robert Gardner
Kim Milford
Julie Aders (attending for Jim Kennedy)
Stewart Cobine
Philip Cochran
Chris Viers
Jeff Lambright
Doug Wasitis
Via Video
Philip Cochran
Via Audio/phone
Joe Scodro
Absent
Joan Hagen
Jim Kennedy
Marcia Gonzales