Information Security

Business Affairs
High risk servers and applications operated by the University: Attain and sustain adoption of the Minimum Security Standards across all such servers and applications, allowing for exceptions and measured against per-standard adoption goals.

Business Affairs
Develop Minimum Security Standards and publish adoption guidance for cloud-based systems (IaaS, PaaS, and SaaS).

Business Affairs
Implement infrastructure to enable opt-in client certificate provisioning for simplified and strengthened user authentication via campus web single sign-on.

Substantially expand the University's capability to proactively detect compromised servers, endpoints, websites, and user accounts.

By October 1, 2017, create a list of specific detectable behaviors that are indicative of compromise. Implement detection mechanisms for five or more of these behaviors by April 30, 2018. Generate automated reports of new detections. Establish a comprehensive detection-response workflow for one or more of these detection classes.

Deploy production Bro and ELK infrastructure to analyze full-scale campus network traffic with a capacity for 18 month log retention by December 31, 2017.

Ensure that all critical system logs identified as of August 1, 2017 are feeding into Splunk or ELK by December 31, 2017.