2008-2009 LR&TS Annual Report - Learning Resources Services ...

Learning Resources & Technology Services – Annual Report FY09
Information Technology Security
The Information Technology (IT) security coordinator
works with all parties involved (internal and external) to
provide a consistent and coordinated response to ITrelated
security issues, from virus outbreaks and identity
theft to unauthorized use of university IT resources. The
IT security area also coordinates security assessment and
reviews of university IT services, resources and policies.
Summary of FY09 accomplishments
IT security incidents continued to grow, both in quantity
and complexity. New case logs were up nearly 50
percent over FY08; this followed a 70 percent increase
the previous year. The number of inquiries not requiring
a documented case log also grew. Questions ranged from
proper disposal of storage media and data destruction
to appropriate use of computers. As IT security issues
became more ubiquitous, IT Security interacted with an
increasing number of internal and external groups.
FY09 Goals
Manage growth and complexity of IT data security incidents.
•
dents during FY09, which was nearly a 50 percent
Investigated and documented 142 IT security inci-
increase from FY08. Incident response continued to
involve both campus and third party contacts.
Coordinate efforts with MnSCU and state agencies on behalf of SCSU.
• Participated in the MnSCU IT Security Guidelines
working group and IT Security Steering Committee.
• Participated in the newly formed Security Training
Advisory Group (STAG) at the request of the
MnSCU Office of the Chancellor.
• Assisted as a campus IT security contact for the
MnSCU-wide Payment Card Industry (PCI) assessment
program.
Raise awareness of MnSCU security standards and move toward
compliance verification.
• Assisted with and answered questions about the
MnSCU Information Security Awareness program
offered through Desire2Learn.
Coordinate security review/consulting for various campus entities.
• Assisted the Business Computer Information
Systems department in completing the National
Security Agency application for recognition as a
National Center of Academic Excellence in Information
Assurance Education.
• Arranged for ongoing secure destruction and
disposal of hard drives and other storage media with
the existing campus recycling contractor.
• Consulted with the College of Education on securely
handling confidential data.
• Worked with Public Safety on security for its IT
network and new parking ramp system.
• Collaborated with both campus and corporate
Sodexo support staff to assess and improve the
security of their campus Point of Sale (POS) systems.
• Reviewed the new Blackboard/Campus Card implementation
plans for proper security measures.
• Reviewed the findings from the 2008 MnSCU
Information Security Assessment of Non-Academic
Business Units on campus. Based on the review, an
IT Security Small Group was formed to 1) prioritize
the concerns identified, and 2) document follow-up
action taken. Work will continue into FY10, following
up with departments identified.
• Participated in the Campus Emergency Notification
Communication subcommittee.
Provide a consistent and timely incident response on behalf of SCSU.
• Continued to build relationships with Public Safety,
local law enforcement and the county attorney’s office.
• Assisted the Stearns County Attorney’s office with a
successful prosecution of a theft case involving campus
property; this case took about 14 months to resolve.
• Continued to work with the Special Advisor to
the President as requested to assist with incident
responses and data requests.
• Complied with all requests from Student Life and
Development to suspend certain students’ LR&TS
accounts as a result of disciplinary procedures.
Provide IT security education/best practices to campus audiences.
• Educated students and employees through one-toone
opportunities.
• Sent communications to campus warning of spam,
fraudulent e-mails and peer-to-peer (P2P) file sharing.
• Introduced Check Point encryption software to
campus.
Statistics:
See Appendix Z
50