May 2019 - USHE-ISO - lists.utahtech.edu

IT Security Appropriations
by Andrew Goble 05 Jun '19

05 Jun '19

Hi all, Apologies in advance for this somewhat lengthy email. tl;dr version: There is some money to spend for security and we need to propose how best to do so. Action items at the end. Our funding position has become clearer after the Regents and CIO meetings the last couple of weeks. There is one million in ongoing funding that the CIOs have been directed to put towards USHE security efforts. Specifically, the CIOs are looking at the following areas: Endpoint Protection Layer 7 Firewalls IT Security Staffing (in that order) We have been tasked to get a proposal on how to get the most bang for our buck with this money together in time for the CIO retreat in mid-July. The CIOs feel like endpoint is the best place to start as several institutions are ready or close to ready to jump on that. For layer 7 firewalls, their intent is either getting hardware in place where it's still lacking or possibly combine negotiation and subsidize the cost of Palo Alto subscriptions. Finally, the CIOs would at least like to get a picture of where everyone is at with IT security staffing and identify greatest needs, although it may be unlikely that there will be funds to do much there. We identified a small working group at our May 10th meeting to work together on Endpoint options, I have Matt, Cody, Mark, Jon, James, Florian, and myself marked down as willing to participate on that group. Please correct me if I missed anybody or need to add others. We'll need to mobilize soon. So, action items for each school, please send me: 1. A best-case scenario count for endpoints you would expect to cover (I have rough counts on endpoint from SLCC 3500, SUU, 2000, DSU, 2300, USHE/BoR 1500, Weber 5000, UofU 73000. Please correct me if I've got bad numbers.) 2. Current status / deployment of layer 7 firewalls 3. Approximate FTE count dedicated to IT security functions I'll compile and send this back out to the group. For DSU I can report the following: 1. No current endpoint solution and 2300 endpoints 2. Palo Alto 5220 series with Threat subscription at network perimeter, older layer 4 FWs at distribution and data center. 3. 1 FTE dedicated to security. Thanks, Andrew Andrew Goble Information Security Officer Dixie State University - Saint George, Utah goble(a)dixie.edu 435.652.7963

4 3

Re: [USHE-ISO] IT Security Appropriations
by James Wilkinson 31 May '19

31 May '19

SLCC... 1. After evaluation of several options, SLCC is currently evaluating options to purchase CrowdStrike for 3500 endpoints. And it has come down to two possible scenario. Either we purchase CrowdStrike off state contract via SHI or failing that we are planning to put out a RFP which we will share and provide for anyone who is interested in the option to purchase off this agreement. The details to make this decision should become clear in the next couple weeks. 2. Currently SLCC has a Palo Alto 7050 with an On-Site-Spare utilizing two VSYS, one for the perimeter and one for the data center. All firewalls in the chassis share licensing which consists of URL defense, Threat and Wildfire. In addition SLCC utilizes 28 additional firewalls of various models, including PA3020(4), PA820(5), PA500(13), PA220(4) and Cisco ASA(3)... used for remote site Data Centers, PCI, DR and CSIS labs. Panorama is also deployed for firewall management and logging. The majority of the support and licensing is up for renewal as of 3/2020 although we are also currently evaluating the costs associated with replacing the various models as they reach there EOL dates and would certainly be interested in a consortium renewal. 3. 3 FTE James Wilkinson | SLCC On 5/30/19, 4:24 PM, "USHE-ISO on behalf of Andrew Goble via USHE-ISO" <ushe-iso-bounces(a)lists.dixie.edu on behalf of ushe-iso(a)lists.dixie.edu> wrote: CAUTION: This is an external message from: ushe-iso-bounces(a)lists.dixie.edu. If you have questions regarding its validity, please review how to identify suspicious emails. Hi all, Apologies in advance for this somewhat lengthy email. tl;dr version: There is some money to spend for security and we need to propose how best to do so. Action items at the end. Our funding position has become clearer after the Regents and CIO meetings the last couple of weeks. There is one million in ongoing funding that the CIOs have been directed to put towards USHE security efforts. Specifically, the CIOs are looking at the following areas: Endpoint Protection Layer 7 Firewalls IT Security Staffing (in that order) We have been tasked to get a proposal on how to get the most bang for our buck with this money together in time for the CIO retreat in mid-July. The CIOs feel like endpoint is the best place to start as several institutions are ready or close to ready to jump on that. For layer 7 firewalls, their intent is either getting hardware in place where it's still lacking or possibly combine negotiation and subsidize the cost of Palo Alto subscriptions. Finally, the CIOs would at least like to get a picture of where everyone is at with IT security staffing and identify greatest needs, although it may be unlikely that there will be funds to do much there. We identified a small working group at our May 10th meeting to work together on Endpoint options, I have Matt, Cody, Mark, Jon, James, Florian, and myself marked down as willing to participate on that group. Please correct me if I missed anybody or need to add others. We'll need to mobilize soon. So, action items for each school, please send me: 1. A best-case scenario count for endpoints you would expect to cover (I have rough counts on endpoint from SLCC 3500, SUU, 2000, DSU, 2300, USHE/BoR 1500, Weber 5000, UofU 73000. Please correct me if I've got bad numbers.) 2. Current status / deployment of layer 7 firewalls 3. Approximate FTE count dedicated to IT security functions I'll compile and send this back out to the group. For DSU I can report the following: 1. No current endpoint solution and 2300 endpoints 2. Palo Alto 5220 series with Threat subscription at network perimeter, older layer 4 FWs at distribution and data center. 3. 1 FTE dedicated to security. Thanks, Andrew Andrew Goble Information Security Officer Dixie State University - Saint George, Utah goble(a)dixie.edu 435.652.7963 -- USHE-ISO mailing list USHE-ISO(a)lists.dixie.edu https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.dixie.edu_cgi-2Db…

1 0

Regents Policy R840
by Andrew Goble 30 May '19

30 May '19

One other thing, Regents policy R840 was passed at the last Regents meeting, affecting use of personal email addresses for institutional business. https://higheredutah.org/policies/r840-institutional-business-communication… Thanks, Andrew

1 0

ISO Meeting Follow-up
by Andrew Goble 14 May '19

14 May '19

Hi all, Per our discussion Friday: 1.) System-side negotiation of a endpoint-protection contract (contingent on availability of that unallocated performance funding): The Board of Regents is meeting this Friday (May 17), and the CIOs the following Friday. We should have a pretty good idea about whether that funding is in play by the time of the CIO meeting. Seats for endpoint protection: SLCC - 3500 SUU - 1500 Dixie - ~1500 UHEAA/BoR - 1500 Not everyone had numbers available at the meeting. For those interested in participating in a potential endpoint protection contract, please fill in the blanks of how many endpoints/seats you would want to include. Products with the most interest/research done at this point were Crowdstrike, Cisco AMP, and Microsoft ATP. If I missed one we talked about, let us know. 2.) With six schools now on Palo Alto, we also are talking about approaching Palo Alto / VARs about negotiating Palo Alto subscriptions together as well. This makes sense whether new funding materializes or not as shared negotiation may save us money we are already spending. 3.) Finally, with the current assessment cycle wrapping up, the assessment team will put together a proposal for the next round. We plan to continue the penetration test model, but find ways to reasonably include all or most of the CIS controls as part of the assessment process. Thanks, Andrew

1 0

Fw: WebEx links and final agenda
by Andrew Goble 09 May '19

09 May '19

FYI, Final NISST Agenda for those not on both lists. Thanks and see you tomorrow, Andrew ________________________________ From: ushe-nisst-request(a)lists.utah.edu <ushe-nisst-request(a)lists.utah.edu> on behalf of Shawna Murray <Shawna.Murray(a)uvu.edu> Sent: Thursday, May 9, 2019 12:06 PM To: ushe-nisst(a)lists.utah.edu Subject: [ushe-nisst] WebEx links and final agenda Here are the WebEx meeting invites for each of the sessions. clm Final Agenda Main Session 9:00 am · CIO Update - Bret Ellis · Common Metrics - Eddie Sorensen · Central Service Infrastructure Reporting - Casey Moore · USHE Security Assessments - Trends and Findings - Andrew Goble and Matt Lorimor Lunch 1:00 pm Breakouts: · USHE Information Security Officers Meeting - Meet in SLCC training room · Systems AD admins - John Madsen and Collin Bunker * PKI, not just SSL for Web Servers * SCCM – Cloud Management Gateway, Automated Service of Windows 10 and Microsoft Office * AzureAD * AD Architecture * Suggestions for future sessions · Network - Steve Palfreyman and Jonathan Karras * Discuss survey from Jonathan. * EAP-TLS implementation/on-boarding. Make this a discussion. I can come up with some question to pose to the group. Possibly via survey beforehand. * Monitoring discussion. Steve do you want to come up with some questions to ask the group on this topic? * Power discussion. I can create some discussion questions for this. * SDN/network program-ability. This topic falls into the first one somewhat. We can see where the discussion with the preso goes. · AV / Classroom – UVU rep - Eddie Sorensen * Get to know each other. * Share biggest pain points. * What knowledge resources do we all have that can be shared. What conferences do you attend. * List the categories that you have set standards it. Like projectors, large screens, control systems, doc cameras etc. … * Purchasing challenges, Areas for establishment of state type contracts. * Areas to get training * Employee retention

1 0

FW: • USHE Information Security Officers Breakout
by TB225D-E OIT Training Lab 08 May '19

08 May '19

WebEx details for our meeting on Friday, if you would like to attend remotely. ________________________________ From: TB225D-E OIT Training Lab Sent: Wednesday, May 8, 2019 12:27:13 PM (UTC-07:00) Mountain Time (US & Canada) To: TB225D-E OIT Training Lab; Casey Moore Subject: • USHE Information Security Officers Breakout When: Friday, May 10, 2019 1:00 PM-4:00 PM. Where: https://slcc.webex.com/slcc Join Webex meeting<https://slcc.webex.com/slcc/j.php?MTID=mf5960ea6d9f3338bdeb23e58b03f8cde> Meeting number (access code): 925 603 871 Join by phone +1-415-655-0002<tel:%2B1-415-655-0002,,*01*925603871%23%23*01*> US Toll Global call-in numbers<https://slcc.webex.com/slcc/globalcallin.php?serviceType=MC&ED=778890837&to…> Can't join the meeting?<https://collaborationhelp.cisco.com/article/WBX000029055> IMPORTANT NOTICE: Please note that this Webex service allows audio and other information sent during the session to be recorded, which may be discoverable in a legal matter. By joining this session, you automatically consent to such recordings. If you do not consent to being recorded, discuss your concerns with the host or do not join the session.

1 0

ISO Meeting 5/10
by Andrew Goble 01 May '19

01 May '19

Hi all, Updates on our meeting for next week: Location: Salt Lake Community College - Technology Building (TB) Professional Development Center (TB 2nd Floor) Taylorsville Redwood Campus 4600 South Redwood Road, Salt Lake City Utah 84123 Campus Map: https://map.concept3d.com/?id=726#!m/111101?ce/11089,9198?bm/?ct/11618,10607 Park in the Visitor Parking lot North of the Student Center – Code: 68789444 You’ll use the code along with your License Plate at one of the Kiosks in the parking lot The NISST meeting will begin at 9:00 - 12:00 All are welcome to attend the NISST portion of the meeting, or just come for the ISO meeting. The NISST agenda is mostly finalized and I'll forward a copy of it when I get it for those of you who are not on both lists. Our ISO meeting will start after lunch, at 1:00 ISO Meeting Tentative Agenda: Legislative initiative (yes, its back) and other strategies for funding USHE infosec efforts Security Assessments Fiscal year 18/19 and next cycle "Bang for the buck" infosec tools / practices Thanks, Andrew

1 0