Seminar 14P - Diamonds and Paper Clips: Steps Needed to Make Your University Cybersecure (separate...

8/11/2019 Seminar 14P - Diamonds and Paper Clips: Steps Needed to Make Your University Cybersecure (separate registration is required) (242305306)

http://slidepdf.com/reader/full/seminar-14p-diamonds-and-paper-clips-steps-needed-to-make-your-university 1/54

Professor P.W. Jeffreys University of Oxford

!"#$%&' )*+

!"#$%&'( #&' *#+,- ./"+(0 12,+( 3,,',' 2% 4#5, 6%7-

8&"9,-("2: .:;,-<(,=7-,

!"#$%"&'(") !+,-&.) !#+%+#'+/01"

+',-"..,' +&/0 1 2"3'"4.56 !"78"#9"' 5:)*




+'"0/;" 8, !"#$%&'<"# $%&'() *++,-. //

!

01*+23-4 5+6789:; < .1=+8-*+-: 3.+-69+5> 9-62749-. 7-9=+859,+5

?32@5 1-A

! BCD 5:+E5 :1 6;F+8G5+6789:;H> I+E38:*+-: J18 K18@ 3-4 L+-591-5

MNEAOOPPP/.6MQ/.1=/7@OE8+55R3-4R*+493O-+P5R3-4RJ+3:78+5OL3.+5OCDG5:+E5G

:1G6;F+8G5+6789:;/35ES

!

?M+ L7F296 '+8=96+5 T+:P18@ UL'TV> B1-+ 21.9632 -+:P18@W F35+4 1- 9-475:8;5:3-43845W 3-4 3 *18+ 1E+- 3-4 61*E+,,=+ X)? *38@+:E236+ 3: :M+ M+38: 1J :M+

"# E7F296 5+6:18H

! B)1*F3,-. J837472+-: +G*392W 3 8+69E+ 1J 8+32 P1824 61-:8125H> 0+34 1J

);F+8 '+6789:; 3-4 Y+5E1-5+W 0+8 Z3[+5:;H5 Y+=+-7+ \ )75:1*5

Z15: 1J :32@5W PM925: 9*E18:3-:W M34 29N2+ E836,632 8+2+=3-6+ :1 7-9=+859,+5]

!

^)8+3:+ 3 5+6789:; 895@G3P38+ 672:78+]/_

?M+- *; :32@ ,:2+4A B01P :1 *3@+ 7-9=+859,+5 6;F+8G5+678+H

Slide 2




!"#$%&' ?../#7@,%.<

Slide 4

Information Security (IS) Operation of Seminar

IS is not IT; has to be ‘separate’ Interrupt at any time! be challenging!

Roll-out of IS very much depends onway University is devolved / culture

Inevitably we will cross into other areasof IS (*)

Information Security " Cyber Security Flexible in what we cover

IS requires local accountability (“unit”) Will, however, aim to meet seminardeliverables

IS must be facilitator not inhibitor Not all aspects of an ISMS will becovered, e.g. incident response

Inevitable that there will be resourcecontention, so IS has to operate and

deliver pragmatically

Allocate time to work in groups to identifyour information asset diamonds using

tool

Strong practical focus

{Happy to meet after Seminar to discuss}




A%-,'#&@,% !"B/'$84 >. C49"' !"B/'$84

Slide 5

https://reader010.{domain}/reader010/html5/0610/5b1d4289369a8/5b1d428c69cf3.png




A%-,'#&@,% !"B/'$84 D/.$%".. C&."

!

XJ :M+ "-9=+859:; 9-=+5:5 9- *18+ X' 5:3a O X'9*E81=+*+-: E23- G PM3: P922 F+ 4+29=+8+4 9-

8+:78-b

!

Y+23:+4 Q7+5,1-A M1P 41 ;17 *+3578+ 5766+55 1JX' E81.83**+ 3c+8 Cd *1-:M5b

23%+#10/1 45"$'+/$ 6 7"1 1+ 8"0#1 +9 2: 0&'(-1.;

Slide 6




J=NC?N!J OJA!C GP&##4M

!

09.M+8 (4763,1- X-J18*3,1- '+6789:; )17-692 U0(X')V *95591- 95A

! :1 9*E81=+ 9-J18*3,1- 5+6789:;W 43:3 E81:+6,1-W 3-4 E89=36; E81.83*5

368155 :M+ M9.M+8 +4763,1- 5+6:18!

K1-4+8J72 X' 8+51786+]

!

MNEAOOPPP/+476375+/+47OJ1675G38+35G3-4G9-9,3,=+5OE1296;G3-4G5+6789:;O

6;F+85+6789:;G9-9,3,=+

!

?112@9:5A!

I3:3 )23559g63,1- ?112@9:

! I3:3 X-694+-: T1,g63,1- ?112@9:

!

Z+-:189-. ?112@9: T+Ph

!

T3,1-32 );F+8 '+6789:; eP38+-+55 Z1-:M Y+51786+ #9:

! ?112@9: J18 T+P )X'%5 T+Ph

!

e449,1-32 ?112@9:5

!

Y95@ *3-3.+*+-: J83*+P18@

Slide 8




Q,/%; P&90" )

! A%8',;/B" 4,/'."0- GL: ."B,%;. #&RS 70"&."TM

! T3*+W ,:2+ 3-4 7-9=+859:;

! X' +5:3F295M+4 36,=9:;b I+4963:+4 X' 8+51786+ Ui?(V

! '+89175 X' 9-694+-:5 9- 235: ;+38b

! X5 ;178 7-9=+859:; 6+-:83295+4 18 4+=12=+4b

Slide 9




!/'>"4 5 GUM

3/

X' 36,=9:; E89*3892; F35+4 9- X? 4+E38:*+-:bF/ %E+83,1-5 F35+4 1- X' 5:3-4384 < PM96Mb

6/ I1 ;17 75+ 0(X') 18 +Q79=32+-: 8+51786+b

4/ X5 (*+8.+-6; Y+5E1-5+ ?+3* E38: 1J X' :+3*b

+/

I1 ;17 M3=+ 3 8+61.-95+4 3-4 3.8++4 9-694+-:8+5E1-5+ E816+55b

J/ X5 I3:3 L81:+6,1- E38: 1J X' :+3*b

./ I1 ;17 M3=+ 3 "-9=+859:; X' L1296; 59.-+4 1a F;

M9.M+5: 2+=+2 61**9N++b

Slide 10




!/'>"4 L GUM

3/

K1724 ;17 53; ;17 M3=+ 4+29=+8+4 O 38+ 4+29=+89-.3- X'Z'b

F/ X5 :M+ X'Z' 7-9=+859:;GP94+b

6/ I1 ;17 M3=+ 3- X-J18*3,1- e55+: Y+.95:+8b

4/

e8+ ;17 3F2+ :1 623559J; e55+:5b+/ I1 ;17 M3=+ 3- X' 895@ 8+.95:+8b

J/ )3- :M+ 7-9=+859:; 53; 9: 95 3F2+ :1 94+-,J; 9:5 *15:

=3273F2+ e55+:5b

./

XJ 51W 95 9: 3F2+ :1 355+55 :M+ F9..+5: 895@5 8+23:+4 :1

:M+5+ 3-4 3-4 *9,.3:+b

Slide 11



Professor P.W. Jeffreys University of OxfordSlide 12

A%-,'#&@,% !"B/'$84

+"'.7"B@>"




V&4"'. ,- A%-,'#&@,% !"B/'$84

Slide 13

Personal Access

Based on Dahmann & Baldwin, 2008




?0"'8 B$'B/0&8"; 8W',/FW Q/.."00 X',/7 0$.8 Y 5L'; 2&% 5:)*<

Motivation for the attack was cited as the MOD funding

of some research at QML published in The Guardian

dated 7th January 2014

Slide 14




V&4"'. ,- A%-,'#&@,% !"B/'$84 Z ["4Y0,FF$%F

Slide 15

Personal Access

(1) Anonymous

(2) Attack

‘Network’?

(3) Credentials?

(4) " Assets

(2) Attack‘people’?




N%$>"'.$84 \.,''4\ -,' ],9. "#&$0 #$.8&^" G.7'$%F 5:)*M

Slide 16

“A university has apologised after

sending out confidential details aboutthousands of job applicants to users

of its job site.

The email attachment contained the

names of 4,751 applicants for jobs at theUniversity - and whether they were

successful.

The document - seen by the BBC - was

sent out at the weekend. It contained

applicants' full names and gender, the

position they had applied for and

whether they were offered the job.

The university said it was carrying

out an urgent investigation and

has notified the Information

Commissioner”

http://www.bbc.co.uk/news/uk-

england-nottinghamshire-27471508




V&4"'. ,- A%-,'#&@,% !"B/'$84 Z ["4Y0,FF$%F

Slide 17

Personal Access

(2) Asset not

‘controlled’

(3)" Inappropriate

access

(1) Not attack,

but user mistake




_$"`. * GPW"." &'" %,8 '"B,';";M

! I95675591- 1J ;178 J78:M+8 X' 9-694+-:5 9- 61-:+S: 1J

23;+85 ]

Slide 18




_$"`. a GUM

! BX' L+85E+6,=+H 5M1P5 :M3: 5+6789:; -++45 :1 F+

61-594+8+4 3: -7*F+8 1J 2+=+25W F7: PM+8+ 41 P+

-++4 :1 J1675 178 +a18:5 *15:b

Slide 19




A!E! Z '"0&@%F 8, A! D/.$%".. C&."

"2,*3:+2;W X'UZ'V *75: -&B$0$8&8" 8W" /%$>"'.$84 8, #""8 $8.

!8'&8"F$B ,9]"B@>". :M817.M +-5789-. )/X/e/ 1J 9:5 9-J18*3,1-

355+:5 O 43:3

!

X-62749-. G +-5789-. 8+E7:3,1- 8+*39-5 .114

i18 51*+ 3749+-6+5W 9: *9.M: F+ F+N+8 :1 4+5689F+ :M95 35 A

!

Bi36929:3,-. :M+ 7-9=+859:; :1 7-4+8:3@+ 8+5+386MW

:+36M9-. 3-4 34*9-95:83,1- +a+6,=+2; 3-4 53J+2;H

Slide 20




_$"`. c GUM

! KM3: 6876932 +2+*+-: P1724 ;17 53; 95 *9559-. J81*

:M+ 495675591- 51 J38b

! X5 9: *9559-. J81* ;178 7-9=+859:;b

Slide 22




D'"&^ Z 70"&." 9" 9&B^ 94 )*SL:W




A%-,'#&@,% !"B/'$84 E&%&F"#"%8 !4.8"#

8&"9,-("2:<B"', ?77',&BW d




HR-,';e. A!E! ?77',&BW

?M8++ E89*38; 61*E1-+-:5A

C/ "-9=+859:; X' L1296;

! j1632 X' L12969+5 G kP9:M 895@ 355+55*+-:5k

! )122+6,-. 9-J18*3,1- 355+:5W 623559J;9-. 355+:5W 895@

355+559-. 355+:5W *9,.3,-. 895@5

! (-5789-. BF759-+55H 1J 7-9:5 J36929:3:+4 F; X'

d/

X-J18*3,1- '+6789:; eP38+-+55l/ )1-:8125 3-4 X' '+8=96+5

=>? 0/@ =A? 0#" B&+/$10/1$CD 0,$+ 0$%"&1$ +9 =E?

Slide 25




G)M A%-,'#&@,% !"B/'$84 +,0$B4 &%; P,,0^$8d

Slide 26

Y+61.-95+4 3EE8136M J18 5+m-. E1296; 9- 4+=12=+4 18.3-953,1-

U$38:-+8VA

! )8+3:+ 3 .+-+896 X' L1296;

!

$39- X' L1296; +-4185+*+-: F; M9.M+5: 37:M189:;

!

Y+Q798+ +36M 7-9: :1 1P- 3 21632 9*E2+*+-:3,1- 1J :M+ X' L1296;

!

X-6274+5 21632 X' 895@ 355+55*+-:

!

L81=94+ :1125 3-4 57EE18: :1 *3@+ 9: M3EE+-

"-9=+859:; X-J18*3,1- '+6789:; L1296;

! eEE81=+4 F; )17-692 1- n o72; dDCd!

MNEAOOPPP/9:/1S/36/7@O*+493O.21F32OPPP9:5+8=96+51S367@O5+6,1-9*3.+5O5+6789:;OX-J18*3,1-R'+6789:;RL1296;RdDCdRDp/E4J

! )122+.+5 U5+E383:+ 2+.322;V < +-4185+4 +Q79=32+-: X' E1296;




JR8'&B8. -',# N%$>"'.$84 A! +,0$B4 G5:)5M d

l/l 0+345 1J 4+E38:*+-: 38+ 8+5E1-59F2+ J18 9-J18*3,1- 5+6789:;

P9:M9- :M+98 4+E38:*+-:5/

q/l ?M+ 895@ 355+55*+-: 5M1724 94+-,J; :M+ 4+E38:*+-:H5

9-J18*3,1- 355+:5> 4+g-+ :M+ 1P-+85M9E 1J :M15+ 355+:5> 3-4

623559J; :M+*W 3661849-. :1 :M+98 5+-59,=9:; 3-4O18 689,6329:; :1 :M+

4+E38:*+-: 18 "-9=+859:; 35 3 PM12+/

r/CA 03=9-. 61*E2+:+4 3 895@ 355+55*+-: 1J :M+98 9-J18*3,1- 355+:5W

4+E38:*+-:5 5M1724 483P 7E :M+98 1P- 9-J18*3,1- 5+6789:; E1296;W

5+m-. 17: 3EE81E893:+ 61-:8125 3-4 E816+478+5W 9- 3661843-6+ P9:M

:M+ ?112@9:/ X-J18*3,1- 1P-+85 *75: F+ 53,5g+4 :M3: :M+ 61-:8125

P922 8+476+ 3-; 8+594732 895@ :1 3- 366+E:3F2+ 2+=+2/

Slide 27

G5M A - @ ! $8 ? +




G5M A%-,'#&@,% !"B/'$84 ?`&'"%".. +',F'&##"

Slide 28

YOU ARE

THETARGET!

w w w . i t . o x . a c

. u k / i n f o s e c /




H%0$%" A%-,'#&@,% ?`&'"%".. E,;/0"

Slide 29

! 09.M29.M:5 9*E18:3-: 61-594+83,1-5 3-4 9-J18*3,1- 5+6789:; 895@

! %a+85 3 *9S:78+ 1J 9-J18*3,1-W 57EE18,-. 8+51786+5 3-4 635+ 5:749+5

!

?3@+5 3EE81S9*3:+2; qr *9-7:+5 :1 61*E2+:+ 3-4 63- F+ 41-+ 9- 5+=+832B59m-.5H

!

)1*E72518; 9- "-9=+859:; e4*9-> X-:+8-32 e749:185 :M9-@ 9: 5M1724 F+

7-9J18*2; 61*E72518;

!

dDDD 5:3a M3=+ :3@+- :M+ 1-29-+ 61785+ U'+E:+*F+8 dDCqV

I+59.-+4 9- 61223F183,1- P9:M g=+ "#

"-9=+859,+5 3-4 675:1*95+4




GLM V&78,7 1W,0" =$.B J%B'47@,% !"'>$B"

Slide 30

!

X)% 8+61**+-43,1- < 23E:1E5 +-68;E:+4

^X: 95 :M+ "-9=+859:; 1J %SJ184H5 E1296; :1 +-578+ :M3: 43:3 1- E18:3F2+ 4+=96+53-4 *+493 576M 35 23E:1E5 3-4 "'` 4+=96+5 38+ 3EE81E893:+2; E81:+6:+4 J81*

7-37:M1895+4 366+55] X- E38,67238W PM+8+ :M+ 2155 1J 43:3 61724 6375+

43*3.+ 18 495:8+55 :1 9-49=947325 +-68;E,1- 5M1724 F+ 75+4 7-2+55 :M+ 43:3

63- F+ 1:M+8P95+ 5+678+4/_

! "-9=+859:; e4*9-95:83,1- *3-43:+4 :M3: 322 "-9=+859:; E786M35+4

23E:1E5 38+ +-68;E:+4 759-. :M+ 6+-:832 KI( 5+8=96+

!

)+-:832 KI( 5+8=96+ P+-: 29=+ 9- %6:1F+8 dDCl

!

"-9=+859:; e4*9- 23E:1E5 +-68;E:+4

!

I9=9591-5 3-4 6122+.+5 61*E2+:+4 51*+ 23E:1E +-68;E,1-5

$ $ $; - ;




N%$>"'.$84Y`$;" A!E! &8 HR-,';

!

%78 39* M35 F++- :1 +5:3F295M X' F35+29-+ 368155 322 7-9:5 UdV3-4 UlV

!

X'Z' E81.83**+ 498+6:+4 3: F89-.9-. 7-9:5 UCrDSV 7E :1

61**1- 2+=+2 9-62749-. 21632 895@ 355+55*+-:W F; E81=949-.A

! L12969+5

! '7EE18:

!

eP38+-+55 :839-9-.

!

)1-:8125

Slide 31

! I _$ KGUM




!/'>"4 I _$"`. KGUM

! 01P *3-; M3=+ 341E:+4 3 F/-("#$-1.GH-@"

3EE8136MW 59*9238 :1 :M95W :1 9*E81=+ 9-J18*3,1-

5+6789:;b

!

03=+ ;17 5766++4+4 9- +5:3F295M9-. 21632 X' E12969+5P9:M 895@ 355+55*+-:5 61-476:+4b

! 035 :M+ E81.83**+ F++- 5766+55J72W 3-4 PM3:

P1724 ;17 53; 38+ :M+ *39- 49s672,+5b

Slide 32

Q f @ H - ;e A!E! ? W O$ W




Q"f"B@,%. ,% HR-,';e. A!E! ?77',&BW O$8W"'8, d

X- 184+8 :1 M+2E 7-9:5 61*E2; P9:M "-9=+859:; X' L1296;W %SJ184 83-A

! 355+: 94+-,g63,1- 3-4 895@ P18@5M1E5W 4+=+21E+4 1-29-+ 8+69E+5W

4167*+-:+4 895@ F+5: E836,6+W P18@+4 P9:M 7-9:5

GI F+J -$ 0 $09"# %,0&") H" 80(" ,+&0, %+,-&-"$ K"-/7 -3%,"3"/1"@) H" 80("

/+1 K""/ L/"@ K. 18" 2MJ) 30/. $10N 0#" 35&8 3+#" 2: 0H0#") H" 80(" 0

@"L/"@ 0/@ "N"&'(" H0. 1+ @"0, H-18 -/&-@"/1$) ;O

01P+=+8W 8+36M+4 3 E19-: PM+8+ P94+G5E8+34 4+29=+8; 1J 61*E1-+-:

UCV 1J X'Z' 95 E81=9-. :1 F+ 3 6M322+-.+

! T1 "# 7-9=+859:; M35 5766+55J72 9*E2+*+-:+4 7-9=+859:;GP94+ X'Z'> 95

:M95 +Q7322; :87+ 9- :M+ "'b!

")jH5 I3:3 '3J+ 03=+- M35 F++- 5766+55J72

KM; 95 7-9=+859:;GP94+ X'Z' 4+29=+8; 51 49s672:b

Slide 33

Q f @ H - ;e A!E! ? W O$8W 8




d Q"f"B@,%. ,% HR-,';e. A!E! ?77',&BW O$8W"'8,

Y+351- 51 6M322+-.9-.A

Z3-3.+*+-: 5:876:78+ 95 8+Q798+4 F+J18+ X'Z' 63- F+9*E2+*+-:+4 +a+6,=+2; G

2/ "$$"/&") /+1 K"-/7 0K," 1+ @"%,+.P B2/9+#30'+/ Q-$<

R0/07"3"/1 Q"7-3"C 6 ES M.K"# T$$"/'0,$

01P+=+8W :M+8+ 95 .81P9-. 5766+55 9- 1-+ I9=9591-W PM;b

! `1384 57EE18:W X' .1=+8-3-6+W X' +a18:

Slide 34



NN[ C 9 ! $8 + 0$ D $ g 2 0 5:)5




NN[ C49"' !"B/'$84 +,0$B4 D'$"g%Fh 2/04 5:)5

Slide 36

^$9=+- :M+ 9*E18:3-6+ 1J 7-9=+859,+5 :1 :M+ "#

+61-1*; 3-4 :1 +61-1*96 E815E+89:;

9- .+-+832W 9: 95 +55+-,32 :1 9-68+35+ :M+ 2+=+2 1J3P38+-+55 1JW 3-4 8+5929+-6+ :1W

6;F+8 :M8+3: 9- :M+ 5+6:18/_

^);F+8 5+6789:; 63- 322 :11 1c+- F+ :M17.M: 1J 35 3-

X? 9557+W 83:M+8 :M3- 3 5:83:+.96 895@ *3-3.+*+-:

9557+/

?M+ 6;F+8 :M8+3:5 J369-. 7-9=+859,+5 :143; P922 -1: F+

512=+4 :M817.M 9-=+5:*+-: 9- :+6M-121.; 321-+W F7:

:M817.M 61-6+8:+4 895@ 355+55*+-: PM96M 8+572:5 9-A

7-9=+859,+5 94+-,J;9-. PM96M 689,632 9-J18*3,1-

355+:5 -++4 :1 F+ E89189,5+4 J18 E81:+6,1-> 3-4 :M+

+5:3F295M*+-: 1J 3 6;F+8 895@ 1=+859.M: 5:876:78+ 3:

5+-918 2+=+2/_

NN[ C 9 ! $8 ; N $ $@ i 5:)L




NN[ C49"' !"B/'$84 &%; N%$>"'.$@".h i,>S 5:)L

Slide 37

^"-9=+859,+5 M3=+ :1 4+=+21E 6;F+8 5+6789:; *14+25

:M3: :38.+: 3EE81E893:+ 3-4 7',7,'@,%&8" 5+6789:;

61-:8125 3: =72-+83F2+ 355+:5_

^X-5,:7,1-5 5M1724 61-594+8 PM1 9- 3- 9-5,:7,1-

B1P-5H 18 B61-:8125H 43:3 G 9- 184+8 :1 +5:3F295M 62+38

29-+5 1J 355+55*+-:W 36617-:3F929:; 3-4 *1-9:189-.

F+:P++- :M+ 4+6+-:83295+4 E81476,1- 3-4 75+ 1J

43:3 3-4 :M+ 9-5,:7,1- :M3: 5M38+5 :M+ 615:5 1J

5+6789:; J39278+5_

^?M+ 94+-,g63,1- 3-4 :38.+,-. 1J 5+6789:; 61-:8125

3: 6+8:39- :;E+5 1J 43:3 63- 1-2; F+ 36M9+=+4 P9:M :M+

36,=+ 9-=12=+*+-: 1J 61-:8122+85 1J 43:3_

^?M+5+ .817E5 38+ F+5: E236+4 :1 94+-,J; 355+:5W

355+55 PM96M :;E+5 1J 61-:8125 P922 F+ *15:

3EE81E893:+_

AC?J1 ? ;$8 A $ W8 i 5:)L




AC?J1 ?/;$8 A%.$FW8.h i,>S 5:)L

Slide 38

̂Auditors working in IT reveal that everybusiness will have their security compromised

! businesses need to prioritise on protectingwhat information and data is important to them –

their ‘crown jewels’.

“Most businesses don’t get the basics right

It is estimated that up to 80% of security breaches could be prevented byimplementing basic good practices in cyber security. People continue to be theweakest link in implementing effective security.

“Businesses should focus on their critical information assets

Businesses cannot sustain an approach of protecting all their information at alltimes. Instead, businesses increasingly need to prioritise their information assets

and focus their resources on their ‘crown jewels’.”

http://www.icaew.com/en/about-icaew/newsroom/press-releases/2013-press-releases/auditors-identify-that-every-

businesses-online-security-will-be-compromised

! ' " I _$" . jGUM



Professor P.W. Jeffreys

University of Oxford

!/'>"4 I _$"`. jGUM

! 01P *3-; M3=+ 341E:+4 3 !#+%+#'+/01" 3EE8136M :1

9*E81=9-. 9-J18*3,1- 5+6789:;b

! KM3: P1724 ;17 53; 95 :M+ *15: 9*E18:3-: 49a+8+-6+W

3-4 PM3: 95 -++4+4 :1 *3@+ 3 !#+%+#'+/01" 3EE8136MP18@b

! 01P P1724 ;17 5+: 3F17: 5:38,-. 576M 3- 3EE8136Mb

Slide 39

+',7,'@,%&8" ?77',&BW





+',7,'@,%&8" ?77',&BW

!

^Y95@GF35+4 E89189,5+4 3EE8136M :M3: J36929:3:+5 4+29=+8; 1J

7-9=+859:; 5:83:+.96 1F[+6,=+5_

! ?+5:5 J18 E81E18,1-3:+ 3EE8136MA

! PM96M 9-J18*3,1- 355+:5 < 9J 61*E81*95+4 G P1724 E8+=+-:

':83:+.96 1F[+6,=+5 F+9-. 4+29=+8+4b

!

PM96M 355+:U5VW 9J 57a+8+4 7-37:M1895+4 366+55 O 61*E81*95+4 < *9.M: 6375+ 576M 3 57F5:3-,32 9-694+-: 9: P1724 8+572: 9-

*3:+8932 6M3-.+ J18 :M+ 7-9:b e-4 G PM1 63889+5 8+5E1-59F929:;b

!

?M+ :35@ 95 :1 g-4 :M+5+ 493*1-4 9-J18*3,1- 355+:5> :M95 .9=+5 3-3-5P+8 :1 :M+ 9-9,32 `/)/ Q7+5,1-

Slide 40

A!E! +',7,'@,%&8" ?77',&BW





A!E! +',7,'@,%&8" ?77',&BW

?M8++ E89*38; 61*E1-+-:5A

C/ "-9=+859:; X' L1296;

! j1632 X' L12969+5 G U7',7,'@,%&8" '$.^ &.."..#"%8.U

! )122+6,-. 9-J18*3,1- 355+:5W 623559J;9-. 355+:5W 895@

355+559-. 355+:5W *9,.3,-. 895@5

! (-5789-. BF759-+55H 1J 7-9:5 J36929:3:+4 F; X'

d/ X-J18*3,1- '+6789:; eP38+-+55

l/ )1-:8125 3-4 X' '+8=96+5

Slide 41

P`, +',7,'@,%&8" ?77',&BW".<





P`, +',7,'@,%&8" ?77',&BW".<

C/ e5@ O 8+Q798+ U5+2+6:+4V 7-9:5 :1 75+ -+P 2/9+#30'+/

U$$"1 V++, :1 94+-,J; :M+ 9-J18*3,1- 355+: 493*1-45 O

9.-18+ :M+ E3E+8629E5 ! X- +a+6:W 68+3:+5 7-9:H5 *3-3.+*+-: 5:876:78+ 1- :M+ t;

! ?112 7-4+8P+-: 5766+55J72 :+5,-. :M95 57**+8

! MNEAOOPPP/9:/1S/36/7@O9-J15+6O95:112@9:O895@355+55*+-:O

9-J18*3,1-355+:*3-3.+*+-:Ou4/+-/CrvvDl

d/

e55+55 5+2+6:+4 *3[18 6122+.93:+ "-9=+859:; 355+:5 368155

6122+.93:+ "-9=+859:; < '"k/$'". X' .1=+8-3-6+ :1 J36929:3:+

! i18 +S3*E2+A 5:74+-: 34*95591-5W 4+=+21E*+-: O 327*-9

355+:5W XL 355+:5

! L81=94+ 6+-:832 5127,1- :1 J36929:3:+ 61-:812 1J 355+:

! X' :+3*A BK922 41 :M95 P9:M ;17H

Slide 42




University of OxfordSlide 43

A%-,'#&@,% ?.."8 P,,0

P,,0 &>&$0&90" 8, ;,`%0,&;<





P,,0 &>&$0&90" 8, ;,`%0,&;<

MNEAOOPPP/9:/1S/36/7@O9-J15+6O95:112@9:O895@355+55*+-:O

9-J18*3,1-355+:*3-3.+*+-:Ou4/+-/CrvvDl

!

e9*9-. :1 :3@+ F9. 5:+E :1P3845 E81E18,1-3:+ 3EE8136M 759-. 3 59*E2+ :112

!

?112H5 39*A

!

X4+-,J; 493*1-4 9-J18*3,1- 355+:5W 7-9: F; 7-9:

! )23559J; 355+:5 3.39-5: 3.8++4 689:+893

!

e55+55 :M8+3: 3.39-5: 355+:5!

I+:+8*9-+ 1=+8322 895@ 355+55*+-:

!

I+694+ PM+:M+8 895@ 366+E:3F2+

!

L81=94+ 8+51786+ 9J -1: 366+E:3F2+

WG Q"%"01 EXS '3"$ GI

)1-595:5 1J 5+: 1J 5M++:5]

Slide 44

A - @ ? 8 Q $ 8 P 0 G!W 8 :M





Professor Paul W. Jeffreys, HT 2014

Thank you.

This tool is licensed as Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License (CC BY-NC-SA 4.0) http://creativecommons.org/licenses/by-nc-sa/4.0/

Permissions beyond the scope of this license may be available at [email protected]; Paul W. Jeffreys

Information Asset Register Tool, v0.99

This tool enables you to identify your crown jewel information Assets and ensure they are adequately protected. By 'Assets' we mean lists or documents or tables or spreadsheets holdinginformation which has value to your unit (either electronically or in filing cabinets), and if compromised would risk damaging your unit.

Contained in this spreadsheet tool:

Sheet 1: Instructions to complete a register of assets for you department, faculty, college or centre

Sheet 2: A register of assets - cells shaded yellow need to be completed

Sheet 3: Explanation of columns in register

Sheet 4: Explanation for classifying assets

Sheet 5: Further details explaining the Information Asset Register, and instructions for optional risk assessment and full risk management

Sheet 6: More detailed Information Asset Register enabling mitigation of risks to be managed

Sheet 7: Example of completed Sheet 2

*** The requirement is to complete Sheet 2, nothing else ***

This tool enables you to: identify and record your most important information Assets; assign those accountable for the Assets; and classify or evaluate the Assets you identify. The

tool enables you to achieve these goals relatively quickly; alternative approaches are available and this is not the only means of producing an Information Asset Register for your Unit.

The tool will improve with time, please send proposals for improvement to: [email protected] . It is intended that the tool should be used annually.

For those who would like to do further risk mitigation of your information Assets, the tool offers further functionality using Sheets 5 and 6.

Any questions: [email protected]

When your Information Asset register (Sheet 2) is complete, you are asked to send it to [email protected].

There is a requirement on the University to establish a collated information Asset register.

A%-,'#&@,% ?.."8 Q"F$.8"' P,,0 G!W""8 :M

Slide 45

A%.8'/B@,%. G!W""8 )M





A%.8'/B@,%. G!W""8 )M

Slide 46

Instructions for Completing Information Asset Register (Sheet 2)

Information Asset Register Tool, v0.99

Professor Paul W. Jeffreys, HT 2014

Instructions for Completing Information Asset Register (Sheet 2) for Your Unit:

The Tool is used in two phases. Steps 1-3 are completed, after consultation within the Unit, by a person charged with collecting information Assets for your Unit. Steps 4-5, which evaluate the collectedinformation Assets, are undertaken by the Head of Unit or by the Unit's group of senior members or Governing Body (the "Senior Team").

Step 1: Insert name of department / faculty / division / college / Unit; date; name of person supplying information on Sheet 2:

Name of Unit:

Date:

Person:

Step 2: Go to Sheet 2; review entries in the 'Information Assets' column:

The Information Asset Register in Sheet 2 has a standard set of entries. You are encouraged to tailor the spreadsheet to convert it to a form that is useful for you. For some units some / manyof the Asset entries may not be relevant. Remove entries that are not relevant to your unit and add entries which have been missed (three rows are left empty for you to add your own).Typically you should aim for a total of no more than 10 information Assets. You may wish to split one of the existing entries if too generic, or make the entry more specific (e.g. in entry 6 -

specify which part of internal documentation is sensitive and requires protection). Pre-entered text should be updated, as necessary.{Entries made to Sheet 2 are automatically copied to Sheet 6, from where further risk analyses can be made. If you plan to use Sheet 6 then take care to preserve the integrity of the

spreadsheet. If you need to remove an Asset from the Sheet, do not delete the row, instead blank or over-write it.}

> When Step 2 is complete, you will have a set of key information Assets, which, should they be lost, stolen, compromised, or are not available - would damage your unit's operation

Step 3: On Sheet 2; turn to the next column 'Person Accountable for Information Asset':

The Person Accountable is the local person responsible for ensuring that appropriate steps are taken to ensure the Asset is suitably protected and is in a position to explain how the Asset ismanaged to ensure it is secure. Add names of those accountable for the information assets. This is a crucially important step in the process.{It may be useful to identify both a 'Person Accountable' as well as 'A Person Who Will Actively Manage the Asset'. If this is the case, add both names to the column on the spreadsheet.}

> When Step 3 is complete, people will have been identified as being accountable for, and managing, each of your unit's information Assets

Remaining Steps must be undertaken by the Unit's Senior Team (together with those who have completed steps 1- 3)

It is vitally important that the unit's Senior Team complete steps 4 and 5. Their involvement enables 'crown jewel information assets' to be identified, assessed and protected.

Step 4: On Sheet 2; review Current Mitigations column:

The Senior Team is required to review entries in the Current Mitigations column (more detail is given in the comment box for each cell). The entries may reflect more advanced controls than arecurrently in place in your Unit. Use this comparison to assess the state of the controls you currently have in place to protect the Assets.{It is important that a genuine assessment is made, does your unit have suitable mitigations / protections in place for each Asset? Understanding this will enable you to complete the next step.}

?.."8 Q"F$.8"' Z !W""8 5





?.."8 Q"F$.8"' Z !W""8 5

Slide 47

University of Oxford: Information Register Pro FormaPaul W. Jeffreys

ID Information Asset

PersonAccountable for

Information AssetPotential Threat Against Information Asset Consequence if Information Asset is Breached

Current Mitigation / Control to Protect Information

Asset

Current

Prob.

Current

impact

Current

risk rating

1

HR Systems and Assets - details heldby Unit relating to staff containingpersonal and confidential details

including recruitment documentation,CVs, letters of recommendation

Unauthorised access to, theft, or loss of staffrelated assets; compromise to integrity ofassets, unavailability of assets to authorisedusers

Unauthorised access to staff related assets will resultin a submission to the Information commissionerwhich may lead to censure and fines.Reputational impact may lead to cessation of funding

from Research Councils and other bodies, andpossibility of not attracting best staff.

Person accountable for asset identifies, assesses anddocuments all HR systems (including paper), reviewswho is authorised to interact and under whatconditions, undertakes checks to ensure personaldata is adequately protected, checks compliance with

policies.

Zero Zero 0.00%

2

Student Systems and Assets - detailsheld by Unit relating to students

containing personal and confidentialdetails including recruitment

documentation, CVs, letters of

recommendation

Unauthorised access to, theft, or loss ofstudent related assets; compromise to integrityof assets, unavailability of assets to authorisedusers

Unauthorised access to student related assets willresult in a submission to the Informationcommissioner which may lead to censure and fines.Reputational impact may lead to financial and legal

impact, and possibility of not attracting best staff.

Person accountable for asset identifies, assesses anddocuments all Student systems (including paper),reviews who is authorised to interact and under whatconditions, undertakes checks to ensure personaldata is adequately protected, checks compliance with

policies.

Zero Zero 0.00%

3Development and alumni Assets

held by Unit

Unauthorised access to, theft, or loss of assetsrelated to Donors and Alumni; compromise tointegrity of assets, unavailability of assets toauthorised users

Unauthorised access to development related assetswill result in a submission to the Informationcommissioner which may lead to censure and fines.Reputational impact may lead to serious financialimpact, and damage relations with benefactors

Person accountable for asset identifies, assesses anddocuments all Development systems (includingpaper), reviews who is authorised to interact andunder what conditions, and undertakes checks toensure personal data is adequately protected.

Zero Zero 0%

4Examination papers Assets

developed, held, and marks recorded

Unauthorised access to, theft, or loss of assetsrelated to examinations; compromise tointegrity of assets, unavailability of assets toauthorised users

Reputational impact predominantly, leading topossibility of not attracting best students

Person accountable identifies, assesses anddocuments all information related to exam preparationand marking, reviews who is authorised to interactwith the exam Assets and under what conditions

Zero Zero 0%

5Research Data and Intellectual

Property Assets

Compromise of integrity of research dataassets or lack of availability; particularly -unauthorised access to IP assets

Reputational impact predominantly for research dataand possibility of not attracting the best researchers;financial impact predominantly relating to IP

Person accountable identifies, assesses anddocuments all research data owned by the Unit inOxford and elsewhere, reviews Access methods tothe Assets ) and whether secure, and undertake

checks to ensure all aspects of confidentiality, integrityand accessibility are preserved.

Zero Zero 0%

!"#$%&' )*+ JR"'B$."< !70$8 $%8, F',/7. GL: #$%.M





!"#$%&' )*+ JR"'B$."< !70$8 $%8, F',/7. GL: #$%.M

! L81E15+ .817E5 1J 3817-4 :M8++ E+1E2+

!

I+694+ 1- B7-9:H J18 PM96M ;17 P922 94+-,J; 3-4 623559J;9-J18*3,1- 355+:5

! %-+ ;17 @-1P 8+351-3F2; P+22W E8+J+83F2; 3634+*96

! "5+ 'M++: d :1 68+3:+ 5+: 1J X-J18*3,1- e55+:5

!

K18@ :M817.M 9-5:876,1-5 1- 'M++: CA

! Y+*1=+ e55+:5 9J -1: 8+2+=3-:W 344 1:M+85

! )1-594+8 1P-+85M9E 1J 355+:5

!

X*3.9-+ -1P :M3: ;17 38+ 5+-918 *3-3.+*+-:W 3-4 895@355+55 :M+ 355+:5

!

T30-, &+%. +9 :%#"0@$8""1 1+P %05,OY"N#".$Z-1O+[O0&O5<

Slide 48

Q"./08. -',# !"#$%&' )*+ JR"'B$."< 6GUM





Q"./08. -',# !"#$%&' )*+ JR"'B$."< 6G M

! I93*1-45A

!

KM96M 355+:5 M3=+ :M+ M9.M+5: 895@ 5618+b! T` :M+5+ P922 F+ I93*1-4 355+:5 :M3: 38+ 3: 895@

! K1724 ;17 53; :M+ 895@ 2+=+2 P1724 F+ 61-594+8+4

366+E:3F2+W 18 5M1724 3449,1-32 *+3578+ F+ :3@+-b

! K1724 ;17 53; :M+ g-49-.5 38+ .+-+896 18 5E+69g6 :1

:M+ 7-9: 8+=9+P+4b

Slide 49

HR-,';e. Q"./08. !, l&'





HR-,'; . Q"./08. !, l&'d

!

?112 .+-+8322; P+22 8+6+9=+4 3-4 3EE8+693:+4

! Z18+ 3 E81*E: J18 +=3273,1- :M3- 3 89.94 E816+478+

!

X4+-,J;9-. 1P-+85M9E 1J 355+:5 M35 F++- :896@; 9- E236+5!

B?M+ F9..+5: 9557+ J36+4 P35 .+m-. E+1E2+ :1 :M9-@ 3F17: 43:3

5+6789:; 35 51*+:M9-. 1:M+8 :M3- 3- X? E81F2+* 3-4 *18+ .+-+8322; :1

J1675 1- 9557+5 1:M+8 :M3- 7-37:M1895+4 366+55 :1 9-J18*3,1- F;

*32969175 :M984 E38,+5H

!

I93*1-4 9-J18*3,1- 355+:5 94+-,g+4 UF35+4 1- 895@ 5618+VA

C/ I3:3 8+23,-. :1 5:74+-:5

d/ I+=+21E*+-: 3-4 327*-9 43:3

l/

L3;*+-: )384M124+8 I3:3

q/ X-J18*3,1- M+24 9- 0Y 5;5:+*5

Slide 50

l"";9&B^ ,% A%-,'#&@,% ?.."8 P,,0< ):GUM





l"";9&B^ ,% A%-,'#&@,% ?.."8 P,,0< ):G M

!

I1+5 :M+ E89-69E2+ 75+4 F; :M+ ?112 P18@b! )1724 9: F+ 4+=+21E+4 :1 P18@ 9- ;178 7-9=+859:;b

Slide 51

!/##&'4





!/##&'4

!

X' `759-+55 )35+A 9-=+5: U*18+V 9- X' 3-4 J36929:3:+ 7-9=+859:; :1 *++: 9:5

5:83:+.96 1F[+6,=+5 U*18+ +a+6,=+2;V :M817.M +-5789-. 681P- [+P+2

9-J18*3,1- 355+:5 O 43:3A )/X/e/

!

UX- "#V e %#+%+#'+/01" 3EE8136M 95 +55+-,32A

! ^Y95@GF35+4 E89189,5+4 3EE8136M :M3: J36929:3:+5 4+29=+8; 1J 7-9=+859:;

5:83:+.96 1F[+6,=+5 F; J16759-. 1- 493*1-4 9-J18*3,1- 355+:5_

! X4+-,g+5 493*1-4 355+:5W 623559g+5W 8+=9+P5 61-:8125W 355+55+5 895@W

61*E38+5 3.39-5: 895@ 3EE+,:+

!

?P1 E1559F2+ E81E18,1-3:+ 3EE8136M+5A

!

K9:M17: X' .1=+8-3-6+ O *3-3.+*+-: 5:876:78+A P18@ 3: 7-9: 2+=+2 3-4

75+ 3 -+P X-J18*3,1- e55+: :112 :1 g-4 493*1-4 9-J18*3,1- 355+:5 <

:112 +5:3F295M+5 *3-3.+*+-: 5:876:78+ 1- :M+ t;! K9:M X' .1=+8-3-6+A J1675 1- 94+-,J;9-.W 623559J;9-.W 3-4 E81:+6,-.

8+61.-95+4 493*1-4 9-J18*3,1- 355+:5 75+4 368155 :M+ 7-9=+859:;

Slide 52

Q"./08. -',# ./'>"4. 8&^"% ;/'$%F !"#$%&'





Q"./08. -',# ./'>"4. 8&^"% ;/'$%F !"#$%&'! L+86+-:3.+ P9:M X' E89*3892; 9- X? 4+E38:*+-:A nrw UF7: 5:81-. =9+P5 :M3: X' M35 :1 F+61*+

5+E383:+4 J81* X?V

! L+86+-:3.+ P9:M X' 36,=9:; F35+4 1- X' 5:3-4384A llw

! Z15: E1E7238 X' ':3-4384A X'%dp@

! L+86+-:3.+ :M3: 75+ 0(X') 18 1:M+8 ?112@9:A dDw

! X5 X? (*+8.+-6; Y+5E1-5+ ?+3* E38: 1J X' ?+3*A =389+4 3-4 .+-+8322; x34 M16x

3883-.+*+-:5 9- E236+

! L+86+-:3.+ P9:M 8+61.-95+4 3-4 3.8++4 X-694+-: Y+5E1-5+ L816+55A dDw

! L+86+-:3.+ P9:M 43:3 E81:+6,1- E38: 1J :+3*A dDw

!

L+86+-:3.+ P9:M 59.-+4 1a 7-9=+859:; X' E1296;A drw! L+86+-:3.+ 39*9-. :1 4+29=+8 7-9=+859:;GP94+ X'Z'A CDw

! L+86+-:3.+ :8;9-. :1 9*E81=+ X' 368155 PM12+ 7-9=+859:; U59*9238 :1 %SJ184VAprw

! L+86+-:3.+ P9:M 9-J18*3,1- 355+: 8+.95:+8A lrw

! L+86+-:3.+ 3N+*E,-. :1 623559J; 355+:5A drw

! L+86+-:3.+ P9:M X' 895@ 8+.95:+8A CDw

!

L+86+-:3.+ PM+8+ 7-9=+859:; 63- 94+-,J; *15: =3273F2+ 9-J18*3,1- 355+:5A Crw! L+86+-:3.+ PM+8+ 7-9=+859:; 63- 94+-,J; *15: =3273F2+ 355+:5 3-4 E+8J18* 895@

355+55*+-:A lw

eEE81S9*3:+2;A lDw 7-9=+859,+5 M3=+ -1 8+61.-95+4 4+4963:+4 X' +a18:W 3EE81S9*3:+2; yDw

M3=+ D/r Gl i?(W 3-4 CDw M3=+ *18+ :M3- li?(

Slide 53

Seminar 14P - Diamonds and Paper Clips: Steps Needed to Make Your University Cybersecure (separate...

Documents

Transcript of Seminar 14P - Diamonds and Paper Clips: Steps Needed to Make Your University Cybersecure (separate...