Data Protection for Higher Education

Data Protection for Higher Education
Kate Carruthers
UNSW Sydney
August 2021
Edutech 2021

Agenda
• Data protection issues
• Some tips on where to start
• The need for teamwork
7 September, 2021 UNSW Sydney | Data Protection for Higher Education 1

Higher Education Context

Higher Education Context
Teaching
Research
Administration
Increasing amounts of student and
staff interaction data
Huge volumes of data – anything from
patient clinical data to climate data and
everything in between.
Large amounts of PII for staff and
students: TFNs, Bank accounts, etc.

Data governance is a key foundation for cyber &
information security
Cyber security, information security, data
governance, and enterprise risk management
are a key focus

Some definitions

Data
Governance
"Data governance is the
organization and
implementation of policies,
procedures, structure, roles,
and responsibilities which
outline and enforce rules of
engagement, decision rights,
and accountabilities for the
effective management of
information assets."
(John Ladley, Data Governance: How to Design, Deploy and Sustain an Effective Data Governance Program, 2012)

Cyber security
and information
security are not
the same thing

Cyber
Security
“The ability to protect
or defend the use of
cyberspace from cyber
attacks.”
Source: NIST Computer Security Resource Center - CNSSI-4009-2015

Information
Security
“The protection of information and
information systems from
unauthorized access, use, disclosure,
disruption, modification, or
destruction in order to provide
confidentiality, integrity, and
availability.”
Source(s): NIST Computer Security Resource Center - FIPS 199 (44 U.S.C., Sec. 3542)

Attack Surface
1.Digital attack surface
oKnown assets
oUnknown assets
oRogue assets
2.Physical attack surface
3.Social engineering
attack surface

Threat landscape

Threat landscape “Threat landscape maps
Malware standing strong as
#1 Cyber Threat in the EU,
with an increase in Phishing,
Identity Theft, Ransomware;
Monetisation holding its place
as cyber criminals’ top
motivation; and the COVID-19
environment fuelling attacks
on homes, businesses,
governments and critical
infrastructure.”
Source ENISA Threat Landscape 2020: Cyber Attacks Becoming More Sophisticated, Targeted, Widespread and Undetected:
https://www.enisa.europa.eu/news/enisa-news/enisa-threat-landscape-2020

Impact of cybercrime in Australia
Source: Cyber Security and Australian Small Businesses Results from the Australian Cyber Security Centre Small Business Survey, Nov 2020. Small Business Survey Results | Cyber.gov.au

Top threats
1. Malware
2. Web-based Attacks
3. Phishing
4. Web Application Attacks
5. SPAM
6. Distributed Denial of Service
(DDoS)
7. Identity Theft
8. Data Breach
9. Insider Threat
10. Botnets
11. Physical Manipulation,
Damage, Theft and Loss
12. Information Leakage
13. Ransomware
14. Cyber Espionage
15. Crypto-jacking

The perimeter has shifted

The perimeter is everywhere now
https://www.isaca.org/resources/isaca-journal/issues/2020/volume-6/harnessing-zero-trust-security

This means that we need to
evolve our practices.
We can’t hide behind our
firewalls any more.

Data security is not just one thing
Data & Information Governance Cyber & Information Security
Privacy
Data Management practices
Policies & Procedures
People & culture
Risk Management

Practices

Source: http://beyondplm.com/2014/07/22/plm-implementations-nuts-and-bolts-of-data-silos/

Five knows
of data
security
7 September, 2021 24

Data
privacy &
security
Source: https://www.bdo.com/services/business-financial-advisory/governance,-risk-compliance/data-privacy

How Data
Governance
helps with
defence in
depth
Identify data at risk
Locate sensitive data
Enables sensitive data to be stored
& managed properly
Identify sensitive data users
Ensure consistent data access
processes
Ensure safer access to sensitive
data

Identify data
at risk
Who is using sensitive data
Location of data
Map data flows through the enterprise
Organisational data stewardship with
business
Data access management
Mitigate people risk to data

Incident
response
framework
Source: https://www.bdo.com/services/business-financial-advisory/governance,-risk-compliance/data-privacy

Information
Security
Lifecycle

10 practices to secure your data
1. Know which data assets need protection
2. Encrypt important data
3. Undertake user awareness training
4. Only store necessary data
5. Close un-necessary open ports
Confidentiality
Prevent unauthorised
disclosure
Integrity
Data cannot be
modified in an
unauthorised
manner
Availability
Information should
be available for
authorised users

10 practices to secure your data
6. Implement MFA
7. Review network segmentation
8. Improve email security:
oSender Policy Framework (SPF)
oDomainKeys Identified Mail (DKIM)
oDomain-based Message Authentication,
Reporting, & Conformance (DMARC)
9. Establish regular user access reviews
10.Establish a patching schedule
Confidentiality
Prevent unauthorised
disclosure
Integrity
Data cannot be
modified in an
unauthorised
manner
Availability
Information should
be available for
authorised users

Team work

“Cybersecurity [and
information security] should
be managed as a risk
discipline across the three
lines of defense — ownership,
oversight and assurance.”
Source: The Convergence of Operational Risk and Cyber Security. Accenture.
The Convergence of Operational Risk and Cyber Security (accenture.com)

Traditional 3
lines of
defence
model
1st line of defence – functions that
own and manage risk
2nd line of defence – functions that
specialise in risk management and
compliance
3rd line of defence – functions that
provide independent assurance and
internal audit

Cyber security
Information Security
Privacy
Data & Information Governance
Management
controls
Internal control
measures
Internal audit
Financial Control
Security
Risk Management
Quality
Inspection
Compliance
SENIOR MANGEMENT
GOVERNING BODY, AUDIT COMMITTEE
First line of defence Second line of defence Third line of defence
External
audit
Regulator

https://www.accenture.com/us-en/blogs/blogs-new-data-ethics-guidelines-organizations-digital-trust

The essential team
Privacy
Cyber & Information Security
Risk Management
Ethics
Data & Information Governance

What we’ve
learned so far
• Methodically build up defensive
layers
• Every day do one thing better
• Data is an asset and should be
managed
• Data security is a team effort, and it
needs everyone to work
collaboratively
• It is a journey not a destination

Data security is
a team effort

Thank you
k.carruthers@unsw.edu.au
UNSW Sydney | Data Protection for Higher Education

Data Protection for Higher Education

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Data Protection for Higher Education

Similaire à Data Protection for Higher Education (20)

Plus de Kate Carruthers

Plus de Kate Carruthers (20)

Dernier

Dernier (20)

Data Protection for Higher Education