Cyb yber er Sec ecurity rity @ UN @ UNC Industr stry y Based - - PowerPoint PPT Presentation
Cyb yber er Sec ecurity rity @ UN @ UNC Industr stry y Based ed Broadening dening Information rmation Operat rations ns Denni nis s Schmid idt Assistant Vice Chancellor for Information Security and Privacy and Chief Information
Industr stry y Based ed Broadening dening – Information rmation Operat rations ns
Denni nis s Schmid idt Assistant Vice Chancellor for Information Security and Privacy and Chief Information Security Officer
July ly 2019
– Assistant Vice Chancellor, Information Security and Privacy, and Chief Information Security Officer – 22 years at UNC – Retired Naval Officer (24 years active)
– Manager, Security Operations – 15 years at UNC
– Manager, Risk Team – 3.5 years at UNC
– Security Architect – 12 years at UNC
– 19,117 Undergraduates – 10,894 Graduate & Professional
A Large and Complex Enterprise
Millions of personally-identifiable records 1,600+ sensitive/mission-critical computer servers on campus 81 Departments have registered sensitive data servers
Billions of Intrusion Attempts Hundreds of Unique Phishing Campaigns Hundreds of Compromised Accounts 60 Sensitive / Mission Critical Incidents
– On average we daily perform:
connection attempts daily via our firewalls:
Month
Total Denies Average/day
August 2018
11.2 Billion 361.3 Million
September 2018
11.8 Billion 393.3 Million
October 2018
16.9 Billion 545.2 Million
November 2018
11.5 Billion 376.6 Million
August through November
51.4 Billion 421.3 Million
F5 LB
DNS Aruba FW RENCI 121 Ports Blocked Business School VPN 121 Ports Blocked Wireless Office 365 Touchnet (Payments) HR Recruitment Departmental FirewallAthletics Finance Human Resources ITS …
www WordPress CloudAppsF5 ASM Reputation Services
Grey Heller Firewall ITS Operations Center
Security operations
system incidents and malfunctions
devices and systems
Manning Data Center
Research
Franklin Data Center
Flywheels
Source: http://www.sourceups.co.uk/hot-aisle-cold-aisle-cooling-explained/
– Spear phishing is becoming very common – Recent increases in “impersonation phishing”
– Vishing (phishing by phone) is not as common, but still an issue
effective defense to date
Office 365 completed in December 2018
– Migrated 56,000 accounts in 9 months – Required for all faculty, staff, and students
– Enrolled 56,000 faculty, staff and students – Protection for ConnectCarolina, VPN, administrative accounts, student bill payments, self service bank deposits, etc.
Compromised accounts 2017 2018 2019 January 4 81 1 February 53 36 1 March 133 15 April 67 12 May 247 11 June 148 27 1 July 643 117 August 332 64 September 134 19 October 97 4 November 337 1 December 72
– Increased firewall coverage – Domain Names Service (DNS) filtering (Akamai) – Enhanced Intrusion Prevention Service (IPS) – Wi-Fi Firewalling
Attacks Blocked Automatically: Firewall (Monthly totals)
rolling out in May 2019
– Compliance increase from 7% to 24%
November 2018
assessments for federal and state studies
– NIST 800-171/53 Assessments – Vendor assessments
recruiting and retention of qualified security staff challenging
2019
Local Known Sensitive Data Incidents
threat
– Standardization – Compliance with Security policies – Visibility of Risks – Uncontrolled Proliferation of data, servers and storage
Committee Committee Enterprise Applications Coordinating Committee Remedy Advisory Council Communication Technologies Coordinating Committee Information Security Coordinating Committee Enterprise Data Coordinating Committee CIO Advisory Committee Carolina Computing Initiative (CCI) Committee Research Computing Advisory Committee IT Infrastructure Coordinating Committee
Group Group Deans of Research & Directors of Centers/Institutes University Committee for the Protection
Enterprise Resource Planning (ERP) Sponsors CERTIFI (PCI Advisory) ConnectCarolina Executive Committee IT Executive Council (ITEC) Faculty Advisory Committee (FITAC)
areas
presentations, collaboration with peer institutions to gain knowledge.
Regulatory requirements
– HIPAA – State Auditors – ISO 27001/2 – NIST 800-53/NIST 800-171 – NIST CSF – PCI – GDPR – Incident Lessons Learned
– ITEC – IT Infrastructure Coordinating Committee – ISO Advisory Committee
How we determine the balance between data security and user accessibility
the basic mission of the University and constituents will find work arounds
figure out how best to get to YES.
8/23/2019 35
education
controls 10.Continue migrating systems behind firewalls 11.Expand tools and licenses, including vulnerability and preventative tools
12.Improve monitoring, detection and alert systems to support rapid response 13.Engage campus IT community to design IT systems that are safe 14.Work with System Office to help leverage economies of scale 15.Support training, desirable culture, flexible work schedule to recruit and retain IT security staff