ITD Information Security October 19, 2015

Size: px

Start display at page:

Download "ITD Information Security October 19, 2015"

Elmer Poole
5 years ago
Views:

1 ITD Infrmatin Security Octber 19, 2015

2 Cntents Intrductin... 3 Synpsis... 3 ITD Security Team... 3 Cunty Emplyees... 3 Malware Prtectin... 4 Physical Security... 4 Data... 4 Internet... 4 Micrsft Office

3 Intrductin The threat t infrmatin systems frm hackers and malware is cnstantly changing and evlving at a rapid pace. As the technlgy leader fr Alameda Cunty, the Infrmatin Technlgy Department (ITD) recgnizes the imprtance f building a rbust and sustainable defensive psture that adapts t the cmplex Infrmatin Security threat landscape. The apprach t Infrmatin Security must be cmprehensive in scpe t address all aspects f Infrmatin Technlgy systems and the emplyees that use them. T address the threats t Alameda Cunty s systems and data, ITD has made significant investments in Infrmatin Security and currently spends $1.2 millin annually tward data security. It is expected that this amunt will increase by $500,000 per year in fiscal 2015/2016. This dcument prvides a synpsis f the many area where ITD has invested in creating a strng apprach t Infrmatin Security. Synpsis ITD Security Team ITD has always placed emphasis n Infrmatin Security thrugh initiatives in its varius technlgy teams. T ensure that the Cunty is staying abreast and cunter acting new security threats, ITD is creating a team that is dedicated t Infrmatin Security. This grup will assess threats and wrk with the current ITD staff t mitigate risk t Cunty systems. ITD is hiring a dedicated Senir Infrmatin Security Specialist t prvide security leadership and champin security initiatives. ITD is identifying resurces frm existing technlgy teams t fcus n security and participate in the Security Team effrts. All ITD emplyees, including the Security Specialist and Security Team members, must pass an extensive backgrund check perfrmed by the Cunty Sheriff. The functin f the Security team: Assess threat and risk t Cunty systems and data. Suggest and implement security systems. Perfrm audits and testing f existing systems. Create Infrmatin Security plicies and prcedures. Cunty Emplyees The first line f defense fr Infrmatin Security starts with each Cunty emplyee. Emplyees must be educated n security awareness and must be cautius when access the Internet and . The Cunty must als utilize strng authenticatin mechanisms when emplyees access Cunty systems. Fr all ITD managed systems that require authenticatin, ITD enfrces strng passwrd plicies. Passwrds must be at least eight characters in length and use alpha, numeric and special characters. ITD is implementing an emplyee security awareness training prgram. This prgram will require Cunty staff t cmplete n line security training n a regular basis. All Cunty emplyees must cmply with the ITD Cmputer Use Plicy.

4 Malware Prtectin Malware is ne f the mst rapidly changing threats t Infrmatin Systems acrss the wrld. The ptential f data lss and file damage psed by malware is very significant. ITD prvides anti virus prtectin fr the Cunty and has made investments t enhance the Cunty s anti malware systems and prcedures. ITD prvides the desktp anti virus client fr Alameda Cunty. ITD leverages the Clud prtectin prvided by its anti virus vendr, which prvided real time updates in respnse t malware threats. This year, ITD implemented a new advanced malware prtectin system. This system crrelates, scans and analyzes data frm multiple surces, including the desktp anti virus client, Internet web brwsing and . The system will alert and take practive actin against malware threats. ITD utilizes multiple prtectin technlgies t filter spam and virus infected . Physical Security ITD has implemented security systems and prcedures t prvide physical prtectin t systems and data hsted inside the Cunty Data Center lcated in the Cunty Administratin Building. Data There are armed guards statined at the entrances t the Cunty Administratin Building. Physical Access Cntrl systems and prcedures have been implemented: The Cunty Badge System allws access t the Cunty Data Center nly t ITD authrized persnnel. Staff access t the Data Center is recrded and lgged in the badge reader system. Guest access is clsely mnitred and all guests must lg int ITD s ipad based system prir t gaining entry t the Data Center. Guest are physically escrted int and ut f the Data Center and their activity is mnitred by a 24/7 Data Center Operatins staff. All Data Center drs are mnitred by surveillance cameras, which recrd and stre vide f persnnel entering and exiting the Data Center. The crnerstne f data security is t backup, retain and recver data in case f emergency. Nt nly des data need t be backed up and retained, a system must be in place t purge data frm system that are being retired. All systems in the Cunty Data Center are backed up and the data is retained fr a perid that is apprpriate fr each system. Data is sent ff site t ensure recverability if there is extensive damage t the Cunty Data Center. ITD is migrating t a Clud based backup system that will allw fr an imprved data recvery psture and cst savings. Data is scrubbed frm retired Cunty wrkstatins thrugh ITD s Tech Reuse prgram. Data is scrubbed frm retired ITD servers and strage prir t salvage. Internet Web Site Prtectin

5 Intrusin Preventin SurceFire Firewalls Encryptin f infrmatin traversing the Internet (web sites) Penetratin testing Micrsft Office 365 Gv t Clud Security Cmpliance

Disaster Recovery. Practical Applications. Eric LaFollette. Director of Information Resources Lake County Clerk of Courts

Disaster Recovery. Practical Applications. Eric LaFollette. Director of Information Resources Lake County Clerk of Courts Disaster Recvery Practical Applicatins Eric LaFllette Directr f Infrmatin Resurces Lake Cunty Clerk f Curts Presentatin Outline Imprtance f a plan Disaster Recvery Scenaris Disaster Recvery Basics Lake