Security Awareness

The multifaceted aspects of security programs become clearer with the creation and collection of appropriate metrics.

Ohio State University's policy includes institutional data procedures and resources. It also defines the scope and applicability of the policy, as well as enforcement.

Louisiana State University's Best Practices for Sensitive Data covers the following: Electronic Handling, Storage and Disposal; Physical Handling, Storage and Disposal; Security; and Legal Disclosure Requirements.

Today’s most prevalent and widely discussed attacks exploit code-level flaws such as buffer overruns and type-invalid input. We need to anticipate tomorrow’s attacks and think beyond buffer overruns, beyond code-level bugs, and beyond the horizon. To be ready for threats of the future, we need to be doing more basic research in cybersecurity today. This talk will outline a few suggestions for important research directions in cybersecurity: the foundations of trustworthy computing, security architectures, privacy, usability, and security metrics.

The Cybersecurity Summit meetings have proven to be a useful forum to foster dialog between awardees, cybersecurity experts and NSF. NSF will provide feedback on the 2007 Summit meeting and discuss best practices in cybersecurity that might be useful to large facilities.

We want cameras watching for problems, but we worry that they will observe or disclose things we'd like to keep private. We want network administrators to track harassing e-mail to its source, but we don't want anyone monitoring our e-mail. We want our buildings to admit occupants and keep strangers out, but we don't want anyone keeping track of when we arrive and leave. In other words, we want big brothers to watch out for us, but we don't want Big Brother to watch us. And IT is caught in the middle.

There has been much improvement in securing cyberspace in the last five years, but much still needs to be done. The Center for Strategic and International Studies (CSIS) has established a Commission on Cyber Security for the 44th Presidency, the administration that will take office in January 2009. The goal of the commission is to identify a strategy and set of recommendations for the next administration to move ahead in securing cyberspace. This session will provide a status report on the commission's work to date. It will also provide an opportunity to offer input regarding progress that has been made in the higher education sector, remaining challenges and opportunities, and the role of the federal government to help improve cybersecurity at colleges and universities.

Information security and the protection of a university's information assets and intellectual property begin with security awareness and education. This session will discuss Purdue University's approach to security education and training, focused on the university community at large, which is designed to develop and preserve a culture of security awareness.