1 july 08, 2010 information security officer meeting
Post on 20-Dec-2015
219 views
TRANSCRIPT
1
July 08, 2010
Information Security Officer Meeting
Meeting Agenda
----- Topics -----
Opening10 minutes
Topics:
OIS Management Changes
Cyber Exercises – Cyber Storm III
Legislation
2010 Federal Grants
DNSSEC – A technical discussion
ISO Basic Training – It’s for everyone, not just the newbie
Enterprise Information Security Awareness Web Application
Public Scorecard
Policy
90 minutes
Q&A and Closing20 minutes
4
OIS Management Changes
5
Cyber Exercises
6
Cyber Exercises
California Cyber Exercise
August 12, 2010
7
Cyber Exercises
“The last major cybersecurity exercise conducted by DHS was held in 2008. Cyberstorm III is slated to include a number of international computer emergency readiness teams (CERTS), including representatives from Australia, New Zealand, Canada and the United Kingdom. Officials from Japan and nine European nations have also been invited to participate.
Previous Cyberstorm exercises focused on attacks attempting to take down the Internet or spread malicious software on high priority government systems. Cyberstorm III is expected to test the processes and roles in place while simulating a cyberattack against the underlying control systems of country's critical infrastructure – power grids, dams and systems that protect energy facilities.”
-- 15 Jun 2010 | SearchSecurity.com
CyberStorm III
8
Legislation
9
Pending Legislation
AB 1899
• Transparency.
• State agencies to post specific audit information.
• OCIO and DGS to post specific summary information regarding contracts awarded to the state.
• Governor's Office to post specific financial information.
10
Pending Legislation
AB 2091
• Public Records Act (PRA) exemption.
• Information Security records that would reveal vulnerabilities or would increase the potential for an attack on an information system.
• A very limited and targeted exemption.
11
Pending Legislation
AB 2408
• Governor’s Reorganization Plan clean-up bill
• Codifies Executive Order S-10-03
• Name change – OCIO to California Technology Agency
• Extends the OCIO’s sunset set date from 2013 to 2015
12
Pending Legislation
AB 1055
• State Chief Information Officer - fingerprints and criminal history checks.
• OCIO employees and contractors that have access to sensitive or confidential information.
• Conviction of crimes related to dishonesty, fraud, or deceit and is substantially related to the duties of the person.
• There is an appeals process.
13
2010 Federal Grants(Proposed)
OIS Grant Requests
• Threat Vulnerability Management Program
• Enterprise Vulnerability Assessment Service
• Statewide PCI Compliance
• CA Information Sharing and Analysis Center
• State and Local Government Training
• Content Learning Management System
14
2010 Federal Grants(Proposed)
• Online Incident Management System
• Enterprise Certificate Authority
• Enterprise Disaster Recovery
• Forensics Lab
• Enterprise Security Operations Center
Endorsement Letter for OIS Grant Request and Commitment for Joint Participation on Awarded Projects
15
SecureDNS - DNSSEC
16
SecureDNS - DNSSEC
17
SecureDNS - DNSSEC
18
SecureDNS - DNSSEC
19
… ca.gov
… state.ca.us
SecureDNS - DNSSEC
The DNSSEC project is an 18+ month, $1.353 million, federally funded project that will advance the integrity and availability for California’s Internet capabilities.
All entities that use one of the zones named above for either world wide web or email addressing will need to stay informed and involved.
20
SecureDNS - DNSSEC
End-State:
• A functional DNS governance program and oversight committee.
• California DNS infrastructure that is capable of signing DNS requests.
• The sub-domains with “ca.gov” and “state.ca.us” will all have been vetted for appropriateness and only
those approved and fully documented will remain active.
21
SecureDNS - DNSSEC
End-State (continued):
• All State of California entities that host internal DNS services will have the necessary technology to
support DNSSEC.
• A comprehensive DNS management process, complete with procedures and standards, will be operational.
22
SecureDNS - DNSSEC
What will the project need from departments?
• A point of contact at your department.
• Where necessary, hardware refresh.
• Software to manage DNS signing keys.
• Time to test and test, then test some more.
• Commitment.
23
SecureDNS - DNSSEC
• This is not only a technology project, it is also an enterprise governance project.
• This project will impact not only state entities, it will require commitment of time from counties and cities.
• Testing will be the most important phase of the SDLC.
• Service interruptions are unacceptable.
24
ISO Basic Training
• Six to seven hours of in-person training on OIS’ expectations for all ISOs and Agency ISOs.
• Required for all new ISOs.
• Required for all current ISOs in management or supervisor classifications.
• The first class will be held July 15th at 1325 J Street.
• This class will help establish future curriculum.
• There will be an annual refresher course (also required).
25
Enterprise Information Security Awareness Web Application
26
Public Scorecard
27
Public Scorecard
http://www.cio.ca.gov/OIS/Government/activities_schedule.asp
28
Public Scorecard
• There will be no surprises. You and your management will be fully aware of the scores before publication.
• First Scorecard will be published on our website in late July 2010.
29
Future Policies
• Security Reporting Scorecard Policy Letter
• Infrastructure Consolidation Scorecard
• Cloud Computing
• Privacy
30
Questions