Download ppt

The Impact of Evolving IT
Security Concerns On Cornell
Information Technology Policy
General Context
• Cornell is not unique – and remains plagued by
a growing spectrum of IT security concerns.
• In response Cornell has:
– Created a security program
– Is in the process of developing a suite of university
policies to better stanchion Cornell’s ability to
effectively address new security challenges.
The Cornell IT Policy – Past, Present and Future
Policy Review
• RESPONSIBLE USE OF ELECTRONIC COMMUNICATIONS
– Became policy in 1995
• Cornell University expects all members of its community to
use electronic communications in a responsible manner. The
university may restrict the use of its computers and network
systems for electronic communications, in response to
complaints presenting evidence of violations of other
university policies or codes, or state or federal laws.
• Parts of this policy are now reflected in new policy
development – it will likely be refined to focus on just issues
of abuse in the future.
Policies Under Development
• Reporting Electronic Security Incidents
– In Draft (August 29th 2003)
– Reason for Policy
• [To enable] prompt and consistent reporting of
electronic security incidents protects and
preserves these resources by enabling expeditious
action in the event of such an incident, and aids
the university in compliance with applicable law.
Reporting Electronic Security Incidents Procedures
• “If you suspect that an electronic security
incident may have occurred or may be imminent,
you are expected to take the actions detailed …”
– Contact local support provide or the Cornell Network
Operations Center
– Local support provide is obligated to collect relevant
information and report to Security.
– Security Office will open a problem report and has the
authority to “perform any action necessary …”
Security Of Information Technology
Resources
• Draft (August 29th 2003)
• Reason for Policy
– [As] the university must preserve its information
technology resources, comply with applicable laws
and regulations, comply with other university or unit
policy regarding protection and preservation of data,
and fulfill its missions. Toward these ends, faculty,
staff, and students must share in the responsibility for
the security of information technology devices.
Security Of Information Technology
Resources…
• Establishes the principle that every IT device
connected to the Cornell network must have at
least one individual managing the security of
that device.
• Defines roles (Users, Local Support Providers,
Security Liaison, Unit Heads, IT Security
Director)
Security Of Information Technology Resources Procedures
• Users
– If no support provider user is obligated to:
• Secure host (strong passwords, virus updates, etc)
• Allow access by Security office
– If there is a local support provider, then:
• Report all electronic security incidents to your local
support provider immediately, as detailed in
University Policy 5.4.2, Reporting Electronic
Security Incidents.
Security Of Information Technology Resources Procedures
• Support Providers Is Obligated To:
– Secure hosts under their control
– Report incidents and allow access
• Unit Security Liaison Is Obligated To:
– Act as the unit point of contact with IT Security
Director
– Implement a security program consistent with
requirements of this policy …
Security Of Information Technology Resources Procedures
• Unit Head
– Obligated to appoint Unit Security Liaison
• IT Security Director
– The IT Security Director is the university office
with the authority to coordinate campus
information technology security …
Network Registry
• Draft (Nov 4th 2003)
• Reason for Policy
– To enhance the maintenance and security of
the university network, and to alleviate
potential legal liability, the university supports
the creation of a central registry of devices
connected to the university network.
Network Registry –
Procedures
• All devices on the network must be
registered to a central database
– All applicable information for a given device,
such as MAC address, IP, responsible party,
location …
– Implied is the development of an online
registration service
Policy on Authentication and
Authorization
• Status: Impact Statement
• Policy goal is to facilitate a comprehensive
strategy for controlling electronic access and
coordinating deployment of university
authentication and authorization mechanisms.
– Define owner(s)
• Advisory board
– Authentication vs Authorization
– Exception process
NUBB
• Not a university policy – however …
– Users of the network are responsible for
network fees – even if their system is
compromised.*
• Defines a “responsible party.”
• Huge impact on system awareness
• Single most positive impact on securing systems at
Cornell to date.
Other Polices Worth Noting
• 1) Access to Electronic Mail. 2) Access to
Network Log Data.
– Both define “owner” and process for access to
information
– Trying to address the issue of “privacy”
• Escrow of Encryption Keys
– Approved Policy
• Focused on administrative data
Deployment Concerns
• Creation of the registration database
• Automation of the incident reporting and
tracking process
• Education (Users, Support Providers,
Security Liaisons)
• Campus participation
Closing Thoughts
• Policy development process is as important as
the finished product
• Key themes are:
–
–
–
–
Responsible party
Clearly understood processes for reporting
Formal authority of the Security Office
Development of tools to enable the smooth realization
of these new polices.
• URL:
– http://www.cit.cornell.edu/oit/policy/drafts/