Unit Information Security Lead

As the person who puts policy into practice, you are where the rubber meets the road when it comes to information security at UC. Your checklist includes the following steps:

1. Set an example and practice basic cyber hygiene. Be an evangelist for good security practices, and work with your Unit teammates to help tackle cybersecurity issues when they arise. Ensure your Unit embeds cybersecurity into all projects. Have a plan to regularly patch systems and application.
2. Be smart about access. As the go-to person for managing access rights for your Unit, be sure you operate by the principle of least privilege, which promotes minimal user privileges on computers based on users’ job necessities. Separate high-value and lower-value assets and handle them accordingly. Review all access rights periodically, and review privileged administrator access rights regularly. Your Chief Information Security Officer (CISO) and Location Network teams can help you implement a plan to separate high-value information and resources.
3. Take a risk-based approach to decision-making. For example, when setting up security measures for a new application in your Unit, think through what could happen if someone outside UC got access. Then act accordingly to set up the right level of protections.
4. Stay connected to your Chief Information Security Officer (CISO) and cybersecurity-related news and alerts. Set up regular touch-bases with your CISO and look for opportunities to learn about emerging cybersecurity threats and issues.
5. Review and update Risk Assessments for the applications in your Unit. These are the best tools to identify threats and vulnerabilities that could impact operations, Institutional Information or IT Resources. Work with your CISO to get access to these assessments.
6. Manage assets responsibly. You can’t protect it if you don’t know you have it. Keep a record of where your sensitive information is located. Also keep a record of where your IT Resources are located and what kind of data they handle. One of your key roles is ensuring the proper handling, storing and disposing of electronic media that contain Institutional Information. Read Section III, subsection 8 of UC’s Information Security Policy for details on how to handle these responsibilities.
7. Report incidents. Report cybersecurity incidents to your CISO, who can guide you through the process. Monitor your high-risk data and systems for signs of compromise. How will you know when an intrusion has occurred? Assume you will be compromised at some point … and have plans to answer the “now what?” question once it happens.
8. Manage your suppliers. Suppliers, even major ones, can ignore basic security requirements. Ensure your Suppliers understand their responsibilities to protect UC’s Institutional Information and IT Resources. Make sure your agreement has “Appendix DS” included. Remember, vendors’ promises that “nothing ever happened before” aren’t a substitute for good security practices. Many successful attacks are launched through supplier-created gaps in security defenses. Section III, Subsection 15 provides an easy-to-follow list of requirements.
9. Manage change responsibly. Make sure your Unit follows good change management practices. Review and approve changes before they are implemented. Ask implementers if the change impacts security or if the change can improve cybersecurity.