The UW–Madison Information Security Team (MIST) is collaborative group of campus IT staff and management with a common interest in promoting information security at UW Madison.
Members provide communication, guidance and leadership for campus-wide security issues and initiatives and serve an advisory group to the UW–Madison Chief Information Security Officer.
At a glance
Documents
Meeting agenda, minutes, presentations
Charter • Wiki • Google Drive (Access required, click the “Request access” button when prompted)
MIST Collaborative Guidelines
Support the IT Security Principles of:
- Security is a shared responsibility
- Security is part of the development life cycle
- Security is asset management
- Security is a common understanding
Actively participate in reviewing and discussing IT Security Strategy, IT Policies and IT security tools and processes.
Communicate broadly and deeply within your campus organization as well as with the CISO and UW–Madison IT Security Team.
Consider and balance broad cross-campus perspectives and local perspectives.
Be respectful and inquisitive of differing options.
Be supportive internally and externally of decisions established by this group.
Roles, goals, expectations & responsibilities
Roles
Sponsors
UW-MIST has 3 sponsors: the Chief Information Security Officer, a designated member of the IT Steering Committee, and the UW–Madison Chief Information Officer, who also serves as the executive sponsor. They are responsible for directing and prioritizing efforts of the group, reviewing and responding to UW-MIST reports, selecting the community chairperson, and reporting to and collaborating with the IT management advisory groups.
Chairpersons
UW-MIST will have 2 chairpersons: the Deputy Chief Information Security Officer and a member of the campus’s distributed IT community, serving a 2-year term. Members provide nominations for the community chairperson to the current chairs, who act as facilitators in the chair-selection process. Chairs objectively present the nominations to the sponsors, who make a selection. The community chairperson may serve more than 1 term, but those terms may not be consecutive. Terms begin on Feb 1 of even-numbered years.
Chairpersons, in conjunction with the executive committee, are responsible for overseeing subcommittee work, recruiting and maintaining a membership that is representative of campus, and directing or delegating work assigned to the facilitator. They are also responsible for calling meetings, recording and communicating decisions, reporting to the sponsors, and ensuring an inclusive discussion. Chairpersons will ensure the distribution of agendas and discussion materials at least 48 hours prior to plenary meetings. Chairpersons will also ensure discussions are inclusive of various perspectives and opinions.
Appointed Members
Appointed by departmental Dean or Directors, these members provided decision-making authority through voting on advisory direction provided to the CISO. They are also the official contact point for their division or department. These members may temporarily delegate their responsibility.
Community Members
Additional departmental members or others interested technologists or managers interested in providing insight on how proposed IT security strategies, IT policies or IT security tools and processes may impact campus or their operations. These members may be self-identified, identified by appointed members, sponsorship, the chairpersons or the CISO. These members do not have voting rights.
UW–Madison IT Security Members
Members of the UW–Madison IT Security Team may attend meetings for the purpose of sharing information, listening to topics that may impact their responsibilities and to network with other membership. These members do not have voting rights.
Overall Goals & Expectations
- Provide IT security leadership for campus
- Help establish campus IT security priorities
- Be engaged in team activities
- Help set meeting agendas and share issues, challenges and solutions
- Communicate broadly and deeply within your campus organization
- Actively represent your organization (and campus)
- Attend UW-MIST meetings
Overall Responsibilities
- Assisting in the technical coordination of IT security activities across the campus
- Working across other university groups such as NAG, MTAG, IMLG, etc.
- Being actively involved in creating new policies and standards as well as developing new security tools and techniques
- Assisting with coordinating university-wide communication and training initiatives in basic security practices
Meeting Documents
See the full range of MIST meeting documents.
MIST Google Drive
(Access required, click the “Request access” button when prompted)
Charter
This is an accordion element with a series of buttons that open and close related content panels.
Charter
UW–Madison Information Security Team Charter
Years 2018–2019
Purpose
This charter defines the shared direction, guiding principles, membership, and roles and responsibilities for the UW–Madison Information Security Team (UW–MIST) and its subcommittees.
Authority
The following individuals have authorized UW–MIST to operate in the capacity defined within this charter:
| Title | Role |
|---|---|
| Chief Information Officer (CIO) | Executive Sponsor |
| IT Steering Committee (ITSC) Representative | Sponsor |
| UW–Madison Chief Information Security Officer (CISO) | Sponsor |
Mission
Continuously improve the overall cybersecurity posture of UW–Madison, and of all of the individuals in the UW–Madison community, by providing recommendations, feedback, and advice to our Sponsors and University leadership, and by championing cybersecurity to every corner of campus.
About
UW–MIST is a community of individuals at UW–Madison interested in advancing the cause of cybersecurity. Membership is open, and varied, and includes cybersecurity professionals appointed by divisions, departments, or units, as well as students, faculty, or staff interested in IT security. The team meets monthly to discuss timely, interesting, or relevant matters relating to cybersecurity, make recommendation to governance and the Office of Cybersecurity, and share techniques and best practices with other members. In addition to the monthly plenary meetings, UW–MIST commissions various permanent and ad-hoc subcommittees that generate additional discussions and recommendations on more specific and focused areas of expertise.
Guiding Principles and Values
- We must act as good stewards of resources that support the overall mission of the University.
- A culture of cybersecurity-awareness is an essential part of any cybersecurity program.
- The best discussions and recommendations come from a warm, welcoming, inclusive, and spirited community.
- Individual engagement in cybersecurity is beneficial for everyone.
- Consensus—whether through legitimate, reason-based persuasion, compromises, alternatives, or a combination thereof—is the best way for our community to make decisions.
- Our community owes the campus our judgement, expertise, and proper representation of all viewpoints, regardless of our alignment with a specific division, department, or unit.
- We support a culture that identifies and bolsters data protection opportunities, specifically in the areas of availability, integrity, and confidentiality.
- We must act as champions for cybersecurity best practices in our divisions, departments, and units, and for the entire campus.
Structure, Membership, and Responsibilities
UW–MIST is an open and welcoming community, driven primarily by consensus building and the idea that the community has a membership-of-equals. It, however, does provide structure that guides direction setting and decision-making, as to facilitate a highly effective team.
Sponsors
UW–MIST has three sponsors: the UW–Madison Chief Information Security Officer (CISO), a designated member of the IT Steering Committee (ITSC), and the UW–Madison Chief Information Officer (CIO), who also serves as the executive sponsor. They are responsible for directing and prioritizing efforts of the group, reviewing and responding to reports provided by UW–MIST, selecting the community chairperson, and reporting to and collaborating with the IT Management Advisory Groups.
Chairpersons
UW–MIST will have two chairpersons. One chair is the UW–Madison Deputy Chief Information Security Officer (D-CISO). The other is a member of the UW–Madison’s distributed IT community, serving a two-year term. Members provide nominations for the community chairperson to the current chairs, who act as facilitators in the chair selection process. Chairs objectively present the nominations to the Sponsors, who make a selection. The community chairperson may serve more than one term, but their terms may not be consecutive. Terms begin on February 1st of even numbered years.
Chairpersons, in conjunction with the Executive Committee, are responsible for overseeing subcommittee work, recruiting and maintaining a membership that is representative of campus, and directing or delegating work assigned to the Facilitator. They are also responsible for calling meetings, recording and communicating decisions, reporting to the sponsors, and ensuring an inclusive discussion. Chairpersons will ensure the distribution of agendas and discussion materials at least 48 hours prior to plenary meetings. Chairpersons will also ensure discussions are inclusive of various perspectives and opinions.
Executive Committee
The UW–MIST Executive Committee is responsible for charting the direction of UW–MIST, in accordance with this charter and the UW–Madison Cybersecurity Strategy,[1] via solicitation of content and creation of agendas for plenary meetings. In addition to establishing meeting agendas, the Executive Committee is also responsible for distributing communications to membership, and formalizing subcommittees to work on specific efforts. Members include the CISO, Chairpersons, Facilitator, and three to five Chair-or-Sponsor-invited members representing the wider membership. Other members may attend agenda planning meetings, and participate fully in discussion.
Facilitator
The CISO will appoint a facilitator for UW–MIST to meet the group’s logistical needs. The facilitator is responsible for organizing plenary and Executive Committee meetings, per the Chairs’ instruction. This includes reserving appropriate meetings spaces, and publishing meeting agendas. The facilitator is also responsible for publishing notes from plenary and Executive Committee meetings. The facilitator and Chairpersons will coordinate to define the facilitator’s responsibilities and duties.
Membership
UW–MIST membership is comprised of any faculty, student, or staff member with an interest in cybersecurity, and a willingness to participate in open discussions about cybersecurity at UW–Madison. Members join the community in a variety of ways: a division, department, or unit lead may appoint them, they may participate on their own recognizance, or a sponsor, chair, or member may recruit them by some other means.
Members attend the monthly plenary meetings, having reviewed any discussion or presentation materials in advance. They also actively participate in the community outside of meeting, in particular by reading and contributing to conversations occurring on the community’s mailing list. Members also aid the Office of Cybersecurity in setting and advancing a consistent cybersecurity strategy for campus. Outside of the community, members advance the agenda of cybersecurity to the entirety of campus, in particular, by conveying best practices and lessons-learned from the community to their own division, department, or unit. Members appreciate and value a wide range of perspectives, and represent those perspectives both inside and outside of the community, and are respectful of everyone attempting to improve cybersecurity, even if there is a disagreement over opinions or methods.
Commissioned Members
Divisions, department, and unit leads appoint Commissioned Members, who provide decision-making authority on advisory directions provided to the Sponsors. Units must appoint a Commissioned Member if they wish to ensure they are properly represented. In addition, the Sponsors may appoint one faculty member and one student to serve as Commissioned Members. These members may appoint their own proxies, and do so by informing the Chairs. Commissioned Members participate in all plenary meetings, represent their division, department, or unit, and participate in official voting. Commissioned Members are encouraged to recruit new Community Members.
Community Members
Community Members participate in UW–MIST not as an appointee, but on their own recognizance. Sponsors, Chairs, and Members encourage others, who have shown an interest in IT security on campus, to participate as Community Members. Community Members participate fully in discussions, consensus building, and other activities, and only differ from Commissioned Members in that they are not eligible to participate in official votes. Staff in UW–Madison Office of Cybersecurity and the Division of Information Technology (DoIT) may participate fully as Community Members.
Meetings
UW–MIST will meet monthly , but the Executive Committee may adjust scheduling as needed. The Executive Committee will be accountable for generating and ensuring the distribution of meeting agendas and minutes. Members are to review the material and be prepared for the meeting and potential discussion.
Voting
UW–MIST will strongly favor a consensus-driven decision making process to ensure everyone in the community is involved. However, in the unlikely event a formal vote needs to be conducted, Commissioned Members and Chairpersons will cast one vote per person (not position). Sponsors and Community Members will not cast votes. A vote is successful if more than half of the voting-eligible members present answer the question in the affirmative, and fails otherwise. Votes may only take place when there is a quorum of seven voting-eligible members.
Subcommittees
UW–MIST uses subcommittees to focus a select group of members on a particular issue that requires more work or discussion than is possible in plenary meetings. These groups are responsible for adopting their own charters and appointing their own chairpersons, in consultation with the Executive Committee and any relevant sponsors. They must also provide periodic report-outs to the entire community. Subcommittees must provide any work they generate to common repository, open to all of UW–MIST. It is up to each subcommittee and its sponsors to invite members outside of the community, if needed.
Permanent Subcommittees
UW–MIST establishes permanent subcommittees to address topics of perpetual interest, as determined by the entire community. The Executive Committee serves as a sponsor for all permanent subcommittees, and these subcommittees will report to the Executive Committee, as requested.
Information Security Communications
The Information Security Communications (ISCOM) committee focuses on how to engage the community in communicating information security concepts, strategies, procedures, and metrics.
Continuous Diagnostics and Mitigation Team
The purpose of the Continuous Diagnostics and Mitigation (CDM) Team is to provide recommendations towards the implementation and ongoing maintenance of a comprehensive and consistent CDM program. A successful CDM program consists of a knowledgeable community that leverages processes and tools to identify and resolve potential security alerts in a timely manner. Currently, the Advanced Threat Protection (ATP) Steering Committee covers the responsibilities of the CDM team, and they will transition into the permanent CDM role once they have completed the ATP work outlined in their charter.
Credentials Steering Committee
The Credentials Steering Committee examines the current security of UW–Madison authentication credentials as compared to best practices and current recommendations, such as those published by NIST, SANS, inCommon, and others. This includes exploring how to increase the security of credentials, guided by standards.[2] The committee considers costs and benefits to assure that recommendations of the team are practical to implement. MIST jointly sponsors this committee, along with other relevant and interested campus parties.
Ad-hoc Subcommittees
UW–MIST establishes ad-hoc subcommittees to address timely or one-off areas of focus. UW–MIST charters these subcommittees to research and write a report or recommendation on a specific topic, and they dissolve once they have completed their charge.
Charter Certification
Commissioned Members and Sponsors must each certify the Charter as binding. Certification expires after two years. The Executive committee is responsible for reviewing any amendments to the certified Charter, as well as for starting the review and recertification process as the Charter’s current certification expires. Commissioned Members and Sponsors must each certify any amendments to the already certified Charter. Amendment certifications last until the Charter’s current certification expires. Recertification, following the same process of the original certification, may take place at any time, and expires two years after the date of the recertification.
[1] e.g. NIST Special Publication 800-63-3: Digital Identity Guidelines