Data security is not their responsibility say 23% of employees

A news item in Computer Weekly states, "Nearly a quarter of employees believe that data security is not their responsibility, according to a survey by security management firm Absolute Software.

"The survey found that 23% of workers claimed that data security was up to the organisation and not the individual. However, 69% believed that a business should face legal action if the employer loses an individual’s data."

ICAEW  'Audit Insights: Cyber Security'

A review from November 2013, which is certainly worth reviewing:

"Auditors working in IT reveal that every business will have their security compromised and must change their mind set around cyber security. In the ICAEW report auditors say that businesses need to be able to tolerate a certain level of security breach and prioritise on protecting what information and data is important to them – their ‘crown jewels’.

Most businesses don’t get the basics right It is estimated that up to 80% of security breaches could be prevented by implementing basic good practices in cyber security. However, businesses of all sizes and across all industries still struggle to get the basics right. People continue to be the weakest link in implementing effective security and human failings are increasingly being exploited by attackers to gain access to confidential information. 

Businesses should focus on their critical information assetsBusinesses cannot sustain an approach of protecting all their information at all times. Instead, businesses increasingly need to prioritise their information assets and focus their resources on their ‘crown jewels’.  This enables a more sophisticated risk-based approach to security which balances the benefits and costs of security measures."

Safer Internet Day, Tuesday 11 February

Today is Safer Internet Day. It is organised by Insafe in February of each year to promote safer and more responsible use of online technology and mobile phones, especially amongst children and young people across the world.

In Oxford we held a Safer Internet Day Summit.  "Can we build an action plan for the University to protect staff, academics, and students from online harassment and abuse? Teams from Academic IT, Information Security, Legal Services, HR, Security Services and the Equality & Diversity Unit brought together a panel of experts to discuss the theme of this year's international Safer Internet Day 2014, which is 'Let's create a better internet together'.

Presentations addressed the Oxford landscape and included 'How does your institution keep you safe?' by Dr Sara Perry, University of York, a scholar who was harassed online and has researched how academics are particularly vulnerable."

EDUCAUSE - comparison of IT Risk Management Methodologies

Throughout higher education, increased emphasis is being placed on the necessity to manage IT risk/opportunity more effectively. One session compared and contrasted how Princeton and Oxford universities manage risk, reviewed experiences from many other universities, and sprinkled in the EDUCAUSE top-ten IT issues.

Only 33% of universities have adopted an IT risk management methodology....

Annual EDUCAUSE conference

The annual EDUCAUSE conference was held last week in Anaheim, California.Many of the talks are available online. An initial view of the EDUCAUSE Core Data Service 2013 survey was particularly interesting.

Cyber Security Information Sharing Partnership

The Government has launched a new partnership between government and industry to share information and intelligence on cyber security threats. The Cyber Security Information Sharing Partnership (CISP) is part of the UK’s cyber security strategy, established to help make UK businesses more secure in cyberspace. The partnership is being supported by the Security Service, GCHQ and the National Crime Agency, who will work with industry analysts to produce and disseminate information on cyber threats facing the UK. It complements the work being carried out by the National Cyber Crime Unit, which tackles the most serious, organised and complex forms of cyber crime.

The Cyber Security Information Sharing Partnership (CISP) delivers a key component of the UK’s cyber security strategy in facilitating the sharing of information on cyber threats in order to make UK businesses more secure in cyberspace. This follows a successful pilot scheme launched by the Prime Minister which included over 160 companies across a range of UK sectors.

At a UUK Round Table meeting today universities were invited to apply to be members of CISP.

Presentation to be given at EDUCAUSE annual conference on 'IT Risk Assessment'

Princeton and Oxford will be giving a presentation entitled: "IT Risk Assessment: Two Universities Share Their Methodologies" at the EDUCAUSE Conference on October 16th.  If anyone attends, either in-person or online, please submit comments.