Call to Order and Approval of Minutes (5 Minutes)
July 2013 meeting minutes were approved via email.
Old Business and New Business
- CDS update (Kim) – The CDS web site (http://datamgmt.iu.edu) is being redesigned and will use the UITS-provided web content management system. The plan is to have all of the current content migrated to the new site by May 2014, and then the site itself will be improved over time. Work also continues on the Business Intelligence environment, with a focus on governance around access control. Kim and Eric are also rewriting the data management policy (http://datamgmt.iu.edu/policies.shtml). And, finally, a list of cybersecurity breach insurance practices of other higher education institutions is being collected and will be shared with the council.
- Incident update (Kim).
- Program Update (Tom) - A new version of ISO 27000 was released in September 2013. Primary changes were content moving between domains, with the addition of two domains (content moved from existing domains to create new ones). No pressing need to re-align our Program with this new version. In addition, the National Institute of Standards and Technology (NIST) released its Cybersecurity Framework in February of 2014. It presents an interesting alternative approach regarding how we could approach our Program. However, since it’s a new framework, for now we should just monitor how broadly it is adopted (it is a voluntary standard) and determine if it would be a more appropriate framework to use as the basis for our Program (instead of the ISO).
- University Policy Web Site and/or Policy Advisory Council (PAC) update (Kim) – The new principles of ethical conduct (http://principles.iu.edu) has been posted. Our IT Acceptable Use Agreement (AUA) was founded in these principles, even though the AUA was written long before the principles of ethical conduct statement was published.
Two-Factor Authentication (Jacob Farmer)
Jacob Farmer, UITS Manager of Identity Management Systems, provided the council with an overview of a Two-Factor Authentication proposal currently under consideration by UITS senior leadership. Jacob provided background on our current One Time Password (OTP) token, its use, and common multi-factor authentication techniques (something you know, something you have, and something you are). The current OTP solution is fundamentally adequate. However, replacing OTP with a more robust two-factor authentication solution provides many benefits. For example, a more robust solution would allow IU to integrate strong authentication into “high value” transactions (e.g., direct deposit changes, grade entry, beneficiary changes) and would provide users non-OTP token alternatives (e.g., phone calls, text messages, mobile device applications) to use for the second factor. The council will consider this proposal and issue a statement to UITS senior leadership.
University Student Services and Systems (USSS) Data Exposure (Jim Kennedy)
A recap of the data exposure was provided to Risk Council members.
Wrap-up and Next Steps
Reference
Next meeting: July 23, 2014
Meeting Information
Date
March 12, 2014
Time
1:00pm
Location
Poplars 017, Video Bridge 227451
Attendees
In Person
Jim Kennedy
Stew Cobine
Chris Swafford
Tom Davis (ch)
Jacob Farmer (guest)
Via video
Leslie Pfeffer
Joe Scodro
Doug Wasitis
Kim Milford
Eric Cosens
Via Audio/phone
Phil Cocran
Eric Swank
Dan Rives
Absent
Joan Hagen
Jeff Lambright
Chris Viers