DCC Meeting Notes — Wednesday, February 8, 2012
Please feel free to listen to an audio recording of the meeting.
David Sherry, CISO: PII (personally identifiable information) and Announcements including and updates on the Information Security Group (ISG).
• The web certificate service from InCommon is now online. This is a fully funded enterprise certificate service. The Help Desk has been experiencing turnaround times of 8-10 minutes from the provider, Comodo. You will get reminder messages when the certificate nears expiration.
• Eduroam started 12/16. This services visiting folks from other institutions as well as our folks going to other universities. Brown’s Eduroam wiki page.
• Identity finder was released; this software will scan any computer for personally identifiable information. DCCs, please talk this up with your departments. Encourage people to run it. CIS collects only the fact of a positive find, not the specifics. If you scan and find 2 instances of social security numbers, CIS learns that 2 SSNs were found, not what they were. It’s best to mark false positives and clean up true PII using the tool, then run it again so it can report a clean status. David will be speaking to Academic Department Managers and Administrative Leadership group about ID finder. At some point it *may* become mandatory, but is not yet. Two useful sites: ISG’s introductory page on Identity finder and Brown’s ID Finder FAQ (on the wiki)
• Symantec EndPoint Encryption (SEE) coming out 2/9/12. ONLY IT staff should be the ones doing the installations. It is very important to read the documentation, as there are some critical things to be aware of. Brown has 1000 licenses. It is recommended for folks who travel inside the US a good deal, for people who work routinely with PII (such as HR folks), and those who use private research data. Please note however, if you travel internationally, that many countries forbid encrypted data to enter their countries; you could be asked to leave your machine with Customs! Check in with David Sherry before leaving the country with an encrypted hard drive.
CIS has a good FAQ by Pat Falcon up on SEE.
• Cisco VPN was decommissioned 10/30/11.
• David is actively pursuing PII discovery for servers.
• Google’s new privacy policy will not impact Google Apps for Education.
A discussion of Google’s practice of mining data from searches ensued. One search engine which does not do any data mining is duckduckgo.com. Chrome incognito is also good for avoiding tracking cookies.
• ISG staffing changes: David’s newly redefined position is a result of his being asked to focus more on areas of privacy and compliance. The shift is from more traditional “IT Security” to “Risk Function.” His technical staff have moved to the Network group, where they do the same work under a different director.
Chris Grossi: Announcements and Software Survey results
• Google+ is active
• Novell has been shut down and will be decommissioned. This project took 4500 hours.
• CS 5.5 for Windows and Mac is available.
• ESRI (ArcGIS): new toolboxes are available.
• FEP/Sophos: please uninstall all symantec antivirus. We need to be off of it by the middle of March.
• At the Tech Forum next week, Chris will present on the “current state of SCCM.” February 15 at 1PM @ 169 Angell St. Rm. 212.
Software Survey: performed as directed by ITAB (IT Advisory Board). 20% of faculty participated: over 1000 responses. Excellent representation, particularly by the sciences.
Shows usage of software and explains the new MS campus agreement, which brings us some new resources.
