- USHE-ISO - lists.utahtech.edu

CrowdStrike licensing
by Mark Walton 22 Apr '20

22 Apr '20

Has anyone actually purchased CrowdStrike off of the SLCC RFP purchase? Other than SLCC of course. It's time for SUU to renew, and I asked our contact which pricing would be better, going off our original contract or using the SLCC bid, and he wasn't aware of the SLCC bid or the ability for the other institutions to get that pricing. I do recognize that CrowdStrike is a large entity with a lot of moving parts. So my question is, who should I be contacting to get a quote based on the SLCC RFP? Is that a CompuNet thing since that appears to be the reseller that responded? Does anybody have the contact that knows something about that RFP? Mark

3 2

USHE ISO Meeting
by Andrew Goble 13 Feb '20

13 Feb '20

Hi all, The NISST group is planning on meeting at Dixie State on February 27th and 28th. There will be a general session and several breakouts. I know its likely some of us will be planning on attending NISST for one reason or another. Is there interest in an USHE ISO meeting on one of those days in tandem with NISST during the breakout sessions? Thanks, Andrew

2 2

USHE Palo Alto Enterprise License and Support Agreements
by Andrew Goble 17 Oct '19

17 Oct '19

Hi all, Specifically for those of you who are running Palo Alto, there's been some developments in investigating a system-wide enterprise license and support agreement. It looks initially promising as in some significant cost savings on licensing and credits for "time served" according to where we are all at in our existing separate cycles. There are some details that still need to be sorted out. They are working to get a semi-final proposal in time for the CIOs to review at their December meeting. Just a heads up that Palo Alto and Compunet may be reaching out to you on getting some expected growth/refresh estimates which will go into their calculus on how they would propose to set up an agreement with USHE. Existing VAR relationships for hardware purchases would remain unaffected, I'm told. Side note for Weber: If you have any interest in looking at Palo Alto equipment in the next 3 years, we could include you in the growth estimates for the enterprise agreement. Thanks, Andrew

1 0

Palo Alto Enterprise License Agreement
by Andrew Goble 14 Aug '19

14 Aug '19

Hi all, For those of us running Palo Alto gear... there's been some discussion leading to an opportunity to explore a enterprise-license agreement with Palo Alto. What that would entail is looking at all of our existing contracts and hardware installs and coming up with a proposal for an agreement for the entire System. The proposal would give us credit for where we all are in our current contract lengths. As I understand it, an ELA would cover all support and licensing, including a percentage of hardware growth during the terms of the ELA. Assuming that an ELA would provide significant cost-savings and/or additional value in the form of being able to license more features, is there any heartburn with anyone in exploring this? We have no obligation to move forward as a System on anything if we don't like the way it turns out, we can just keep the status quo if that is the better option. The only concern that I would float is that I've been talking with Palo Alto and CompuNet, who I believe is the VAR that 4 of us have been using for Palo Alto purchases, with 2 other schools using other VARs. I would not want to damage any established relationships for anybody with this exercise. Palo and CompuNet claim they'll be mindful of that issue as they look into an ELA proposal. Thoughts? Thanks, Andrew

2 2

Endpoint Working Group
by Andrew Goble 05 Jun '19

05 Jun '19

For those planning on participating in the Endpoint working group, we need to get moving. A couple of action items we need to work out: * Identify a couple of people to take the lead on coordinating the working group. (I plan to participate in the group, but I don't think I can take a lead role, due to time constraints and the fact that several of you are much further down this road than DSU is) * Identify what solutions are out there that we are interested in pursuing. (again, I think we have a good handle on this but need to all be on the same page) Thoughts? If necessary we can try to schedule a call for late this week or early next. Thanks, Andrew

1 0

IT Security Appropriations
by Andrew Goble 05 Jun '19

05 Jun '19

Hi all, Apologies in advance for this somewhat lengthy email. tl;dr version: There is some money to spend for security and we need to propose how best to do so. Action items at the end. Our funding position has become clearer after the Regents and CIO meetings the last couple of weeks. There is one million in ongoing funding that the CIOs have been directed to put towards USHE security efforts. Specifically, the CIOs are looking at the following areas: Endpoint Protection Layer 7 Firewalls IT Security Staffing (in that order) We have been tasked to get a proposal on how to get the most bang for our buck with this money together in time for the CIO retreat in mid-July. The CIOs feel like endpoint is the best place to start as several institutions are ready or close to ready to jump on that. For layer 7 firewalls, their intent is either getting hardware in place where it's still lacking or possibly combine negotiation and subsidize the cost of Palo Alto subscriptions. Finally, the CIOs would at least like to get a picture of where everyone is at with IT security staffing and identify greatest needs, although it may be unlikely that there will be funds to do much there. We identified a small working group at our May 10th meeting to work together on Endpoint options, I have Matt, Cody, Mark, Jon, James, Florian, and myself marked down as willing to participate on that group. Please correct me if I missed anybody or need to add others. We'll need to mobilize soon. So, action items for each school, please send me: 1. A best-case scenario count for endpoints you would expect to cover (I have rough counts on endpoint from SLCC 3500, SUU, 2000, DSU, 2300, USHE/BoR 1500, Weber 5000, UofU 73000. Please correct me if I've got bad numbers.) 2. Current status / deployment of layer 7 firewalls 3. Approximate FTE count dedicated to IT security functions I'll compile and send this back out to the group. For DSU I can report the following: 1. No current endpoint solution and 2300 endpoints 2. Palo Alto 5220 series with Threat subscription at network perimeter, older layer 4 FWs at distribution and data center. 3. 1 FTE dedicated to security. Thanks, Andrew Andrew Goble Information Security Officer Dixie State University - Saint George, Utah goble(a)dixie.edu 435.652.7963

4 3

Re: [USHE-ISO] IT Security Appropriations
by James Wilkinson 31 May '19

31 May '19

SLCC... 1. After evaluation of several options, SLCC is currently evaluating options to purchase CrowdStrike for 3500 endpoints. And it has come down to two possible scenario. Either we purchase CrowdStrike off state contract via SHI or failing that we are planning to put out a RFP which we will share and provide for anyone who is interested in the option to purchase off this agreement. The details to make this decision should become clear in the next couple weeks. 2. Currently SLCC has a Palo Alto 7050 with an On-Site-Spare utilizing two VSYS, one for the perimeter and one for the data center. All firewalls in the chassis share licensing which consists of URL defense, Threat and Wildfire. In addition SLCC utilizes 28 additional firewalls of various models, including PA3020(4), PA820(5), PA500(13), PA220(4) and Cisco ASA(3)... used for remote site Data Centers, PCI, DR and CSIS labs. Panorama is also deployed for firewall management and logging. The majority of the support and licensing is up for renewal as of 3/2020 although we are also currently evaluating the costs associated with replacing the various models as they reach there EOL dates and would certainly be interested in a consortium renewal. 3. 3 FTE James Wilkinson | SLCC On 5/30/19, 4:24 PM, "USHE-ISO on behalf of Andrew Goble via USHE-ISO" <ushe-iso-bounces(a)lists.dixie.edu on behalf of ushe-iso(a)lists.dixie.edu> wrote: CAUTION: This is an external message from: ushe-iso-bounces(a)lists.dixie.edu. If you have questions regarding its validity, please review how to identify suspicious emails. Hi all, Apologies in advance for this somewhat lengthy email. tl;dr version: There is some money to spend for security and we need to propose how best to do so. Action items at the end. Our funding position has become clearer after the Regents and CIO meetings the last couple of weeks. There is one million in ongoing funding that the CIOs have been directed to put towards USHE security efforts. Specifically, the CIOs are looking at the following areas: Endpoint Protection Layer 7 Firewalls IT Security Staffing (in that order) We have been tasked to get a proposal on how to get the most bang for our buck with this money together in time for the CIO retreat in mid-July. The CIOs feel like endpoint is the best place to start as several institutions are ready or close to ready to jump on that. For layer 7 firewalls, their intent is either getting hardware in place where it's still lacking or possibly combine negotiation and subsidize the cost of Palo Alto subscriptions. Finally, the CIOs would at least like to get a picture of where everyone is at with IT security staffing and identify greatest needs, although it may be unlikely that there will be funds to do much there. We identified a small working group at our May 10th meeting to work together on Endpoint options, I have Matt, Cody, Mark, Jon, James, Florian, and myself marked down as willing to participate on that group. Please correct me if I missed anybody or need to add others. We'll need to mobilize soon. So, action items for each school, please send me: 1. A best-case scenario count for endpoints you would expect to cover (I have rough counts on endpoint from SLCC 3500, SUU, 2000, DSU, 2300, USHE/BoR 1500, Weber 5000, UofU 73000. Please correct me if I've got bad numbers.) 2. Current status / deployment of layer 7 firewalls 3. Approximate FTE count dedicated to IT security functions I'll compile and send this back out to the group. For DSU I can report the following: 1. No current endpoint solution and 2300 endpoints 2. Palo Alto 5220 series with Threat subscription at network perimeter, older layer 4 FWs at distribution and data center. 3. 1 FTE dedicated to security. Thanks, Andrew Andrew Goble Information Security Officer Dixie State University - Saint George, Utah goble(a)dixie.edu 435.652.7963 -- USHE-ISO mailing list USHE-ISO(a)lists.dixie.edu https://urldefense.proofpoint.com/v2/url?u=http-3A__lists.dixie.edu_cgi-2Db…

1 0

Regents Policy R840
by Andrew Goble 30 May '19

30 May '19

One other thing, Regents policy R840 was passed at the last Regents meeting, affecting use of personal email addresses for institutional business. https://higheredutah.org/policies/r840-institutional-business-communication… Thanks, Andrew

1 0

ISO Meeting Follow-up
by Andrew Goble 14 May '19

14 May '19

Hi all, Per our discussion Friday: 1.) System-side negotiation of a endpoint-protection contract (contingent on availability of that unallocated performance funding): The Board of Regents is meeting this Friday (May 17), and the CIOs the following Friday. We should have a pretty good idea about whether that funding is in play by the time of the CIO meeting. Seats for endpoint protection: SLCC - 3500 SUU - 1500 Dixie - ~1500 UHEAA/BoR - 1500 Not everyone had numbers available at the meeting. For those interested in participating in a potential endpoint protection contract, please fill in the blanks of how many endpoints/seats you would want to include. Products with the most interest/research done at this point were Crowdstrike, Cisco AMP, and Microsoft ATP. If I missed one we talked about, let us know. 2.) With six schools now on Palo Alto, we also are talking about approaching Palo Alto / VARs about negotiating Palo Alto subscriptions together as well. This makes sense whether new funding materializes or not as shared negotiation may save us money we are already spending. 3.) Finally, with the current assessment cycle wrapping up, the assessment team will put together a proposal for the next round. We plan to continue the penetration test model, but find ways to reasonably include all or most of the CIS controls as part of the assessment process. Thanks, Andrew

1 0

Fw: WebEx links and final agenda
by Andrew Goble 09 May '19

09 May '19

FYI, Final NISST Agenda for those not on both lists. Thanks and see you tomorrow, Andrew ________________________________ From: ushe-nisst-request(a)lists.utah.edu <ushe-nisst-request(a)lists.utah.edu> on behalf of Shawna Murray <Shawna.Murray(a)uvu.edu> Sent: Thursday, May 9, 2019 12:06 PM To: ushe-nisst(a)lists.utah.edu Subject: [ushe-nisst] WebEx links and final agenda Here are the WebEx meeting invites for each of the sessions. clm Final Agenda Main Session 9:00 am · CIO Update - Bret Ellis · Common Metrics - Eddie Sorensen · Central Service Infrastructure Reporting - Casey Moore · USHE Security Assessments - Trends and Findings - Andrew Goble and Matt Lorimor Lunch 1:00 pm Breakouts: · USHE Information Security Officers Meeting - Meet in SLCC training room · Systems AD admins - John Madsen and Collin Bunker * PKI, not just SSL for Web Servers * SCCM – Cloud Management Gateway, Automated Service of Windows 10 and Microsoft Office * AzureAD * AD Architecture * Suggestions for future sessions · Network - Steve Palfreyman and Jonathan Karras * Discuss survey from Jonathan. * EAP-TLS implementation/on-boarding. Make this a discussion. I can come up with some question to pose to the group. Possibly via survey beforehand. * Monitoring discussion. Steve do you want to come up with some questions to ask the group on this topic? * Power discussion. I can create some discussion questions for this. * SDN/network program-ability. This topic falls into the first one somewhat. We can see where the discussion with the preso goes. · AV / Classroom – UVU rep - Eddie Sorensen * Get to know each other. * Share biggest pain points. * What knowledge resources do we all have that can be shared. What conferences do you attend. * List the categories that you have set standards it. Like projectors, large screens, control systems, doc cameras etc. … * Purchasing challenges, Areas for establishment of state type contracts. * Areas to get training * Employee retention

1 0