UW System Information Security Brief to Information Technology

UW System Information Security Brief to Information Technology Management Council Katherine Mayer 15 October 2018

Linkages Administrative Excellence Commitment to Operational Reform and Excellence (CORE): Operational excellence through the transparent standardization, consolidation and streamlining of non-instructional operations where it makes sense

Digital Strategy - Goals • Establish a unifying strategic layer to enable 2020 FWD in an increasingly digitally-enabled world • Provide direction for future digital investments and roadmaps • Clarify decision-making authority, scope, and process for digital initiatives Mission 2020 FWD Digital Strategy Governance Implementation Why are we here? Where should we put our focus? What are the opportunities? Who has influence and who decides? How do we get there?

Information Security (IS) Strategic Priorities Enterprise Approaches • Define roles, responsibilities, integration and actions to protect UWS networks in a unified manner • Expand collaboration and partnerships Standardized Security Capabilities Enterprise Approaches Standardized Security Capabilities Workforce Resiliency IS Awareness IS Risk-Based Decision Making • Define/refine governance structure(s) • Leverage/align IS risk focus with ERM IS Risk-Based Decision Making • Balance prescription with individual institution capability deployment • Reduce/eliminate duplication • Focus on high priority IS actions IS Awareness • Leadership • Outreach • Communications clarity

Workforce Resiliency • Employment of IT professionals expected to grow 28% from 2016 -2026* HDLD High Demand Low Density • Can only fill 1/3 of IT jobs with current IT grads* • By 2024, 4. 4 M unfilled IT jobs* • Digital transformation rests on talent development • Competitive advantage demands life long learning • Soft skills gain prominence amid intelligent machines * Bureau of Labor Statistics Human Capital Focus

Enterprise Investment for Blocking and Tackling • Advanced Malware Protection (AMP) − Prevention, detection and response to threats at the endpoints • Cloud. Lock − Detection of cloud data breaches and malware • Umbrella − Stops phishing and malware earlier (before endpoints) • Stealth. Watch − Deep visibility across the network (normal v. anomalous) Piloting an incentive-based enterprise funding model 6

Additional System-wide Efforts Underway • Multi-factor authentication implementation • General Data Protection Regulation Assessment (GDPR) complete • Cyber liability insurance renewal • Assisting institutions with policy implementation • Building out an information security team • Refining governance structures − Dissolution of the Information Assurance Council (IAC) − Redefining Technology and Information Security Council (TISC) 7

What’s Next? • Continued Cisco deployments throughout UW System • Develop a risk management assessment process focused on information security risk • Develop cyber security metrics for reporting to leadership in partnership with Madison • Incorporate specific GDPR assessment recommendations into IS work plan • Policy development and vetting − Existing policy updates − Data privacy − Asset management − Network protection − Security monitoring • Human capital development 8

Questions? 9