2019 3rd Edition – May
Here we are at Memorial Day Weekend! Golly, it seems like winter just ended less than a month ago! That could be since our last snowfall, Winter Storm Xyler, brought snot to the Great Plains, Midwest, Great Lakes and the interior of the Northeast the last weekend of April. THE GROUNDHOG WAS WRONG!!!
I also know that winter stayed too long as I have not produced a CISO’s Perspective blog since February, three weeks after Groundhog Day. So here we go. This time let’s focus on what happened over the elongated winter 2018-2019.
Information Security Program and 2018-1021 Cybersecurity Strategy
After 18 months of working in committee, teams, and the editing and socialization process, our Chief Information Officer, Lois Brooks, had the opportunity to review and approve our Information Security Program and 2018 – 2021 Cybersecurity Strategy. A fresh look at the Strategy we launched in 2015, a cross-campus committee began reviewing progress and updating the strategic components of the document starting in August 2017. Seeking to keep the momentum of evolution we started, the committee and five work teams checked progress on the original strategic elements and carefully crafted updates and new objectives and goals, along with addressing challenges and opportunities.
In April of 2018, the UW System Administration released their first ever Information Security Program. UW-Madison came alongside that program and articulated our version of an Information Security Program that deals with the unique issues, diversity and volume of information security related activity. The end result is a combined Information Security Program and 2018-2021 Cybersecurity Strategy.
As we go into the summer of 2019, the Office of Cybersecurity will publish a report and update components of the Strategy.
Cybersecurity Initiatives
Another major endeavor going on since 2017 caught a fresh breeze last October when University leadership invested in 17 Cybersecurity Initiatives. This investment included additional staff to manage cybersecurity and healthcare related risk assessments conducted by the Governance, Risk Management and Compliance team, new tools to detect vulnerability, assess risk and manage security events that occur across campus, new cybersecurity awareness and training materials, and badly needed cyber infrastructure upgrades.
In addition, the Office of Cybersecurity is engaging the cybersecurity professionals across campus to improving firewall management, develop a continuous diagnostics and mitigation program, and work toward implementing the tools and processes necessary to meet the UW System Administration’s 2 Year Work Plan ( which you can read about in the Information Security Program and 2018-2021 Cybersecurity Strategy.
Endpoint Management and Security
Finally, a dedicated group of IT and security experts have been working on improving endpoint management and security tools on campus. This effort includes identifying ways to reduce the nearly 160 different endpoint related services offered by central and distributed IT organizations and to provide a common set of tools that are budgeted, supported, and managed as common cybersecurity services and report metrics to the Cybersecurity Operations Center. From this initiative, we have a much better chance to identify adverse events, protect our high-risk data that contains Restricted or Sensitive information, detect when a cybersecurity event is happening, and respond appropriately to minimize damage and then recover from the event stronger than we were.
The Endpoint Management and Security procurement are making major strides in May with well over 2o vendor submissions that address endpoint management (Lot A), security (Lot B) and university-owned mobile device management (Lot C). More news will be coming out after the set of products are determined in early June.
What’s Next?
Stay tuned – the 2019 Lockdown Technology and Cybersecurity Conference is right around the corner with a new half day Cybersecurity 101 track and the introduction of a Cyber Lab to test your hacking skills – more to come in the next edition of CISO’s Perspective!
Next Blog: Lockdown 2019 – Living in a Cyber World